feat: track general vector paths in the PDF content-stream reader #67
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| commitlint: | |
| name: Commitlint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: wagoid/commitlint-github-action@v6 | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm lint | |
| typecheck: | |
| name: Typecheck | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm typecheck | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| code-quality: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm test:coverage | |
| - name: Upload coverage report | |
| # GitHub Code Quality requires the org on Team/Enterprise Cloud (ExaDev is currently Free), so this no-ops until the org upgrades -- fail-on-error: false keeps that from blocking release, which depends on this job succeeding. | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| uses: actions/upload-code-coverage@v1 | |
| with: | |
| file: coverage/cobertura-coverage.xml | |
| language: typescript | |
| label: unit | |
| fail-on-error: false | |
| test-smoke: | |
| name: Smoke test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm test:smoke | |
| release: | |
| name: Release | |
| needs: [commitlint, lint, typecheck, test, test-smoke] | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write # to push the release commit/tag and create the GitHub Release | |
| issues: write # to comment on released issues | |
| pull-requests: write # to comment on released pull requests | |
| id-token: write # OIDC identity for npm trusted publishing (no NPM_TOKEN) | |
| outputs: | |
| published: ${{ steps.before.outputs.version != steps.after.outputs.version }} | |
| version: ${{ steps.after.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| # semantic-release analyses the full commit history since the last release. | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| # registry-url is deliberately absent. Setting it makes setup-node write an .npmrc containing an _authToken line, and that line wins over the OIDC token exchange -- so the setting that looks like it configures the registry is exactly the one that would stop trusted publishing working. | |
| - run: pnpm install --frozen-lockfile | |
| - name: Read pre-release version | |
| id: before | |
| run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT" | |
| - name: Upgrade npm for OIDC trusted publishing (needs npm CLI >=11.5.1) | |
| run: npm install -g npm@latest | |
| - name: Release | |
| # HUSKY=0 so the commit-msg hook never fires against the automated release commit. | |
| run: HUSKY=0 pnpm exec semantic-release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Blanked, not omitted -- an inherited NPM_TOKEN/NODE_AUTH_TOKEN from a workflow-level env block, reusable workflow, or composite action would otherwise be used in preference to the OIDC exchange. | |
| NPM_TOKEN: '' | |
| NODE_AUTH_TOKEN: '' | |
| - name: Read post-release version | |
| id: after | |
| run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT" | |
| publish-github-packages: | |
| name: Publish alias to GitHub Packages | |
| needs: release | |
| if: needs.release.outputs.published == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: main # the release commit semantic-release just pushed | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| registry-url: 'https://npm.pkg.github.com' | |
| # Explicit, not inferred: setup-node's scope default only matches the scoped package.json name if package.json is already scoped by the time this step runs, and the rewrite below happens after it. | |
| scope: '@exadev' | |
| # GitHub Packages has no OIDC trusted-publishing exchange, so this job (unlike release above) authenticates with a token -- GITHUB_TOKEN is sufficient and needs no separate secret. | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| - name: Rewrite package name and registry for the GitHub Packages scope | |
| # GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means this alias cannot drift away from the real package's metadata. publishConfig.registry has to be overridden too: it takes precedence over the .npmrc registry-url set by setup-node above, so without this the publish would silently target registry.npmjs.org instead of GitHub Packages. | |
| run: | | |
| npm pkg set name="@exadev/documents.js" | |
| npm pkg set publishConfig.registry="https://npm.pkg.github.com" | |
| - run: pnpm publish --access public --no-git-checks | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| attest: | |
| name: Attest SBOM and build provenance | |
| needs: release | |
| if: needs.release.outputs.published == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: main # the release commit semantic-release just pushed | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| # Pack into a directory of its own, separate from dist/ (tsdown's raw build output). The attestation subject has to be the artefact that actually ships -- attesting dist/ itself would mix in files that never leave the repo, producing digests that match nothing a consumer can download. | |
| - run: pnpm pack --pack-destination release-artifact | |
| - run: pnpm sbom --sbom-format spdx --prod > release-artifact/sbom.spdx.json | |
| - name: Attest SBOM | |
| uses: actions/attest@v4 | |
| with: | |
| subject-path: release-artifact/*.tgz | |
| sbom-path: release-artifact/sbom.spdx.json | |
| - name: Attest build provenance | |
| uses: actions/attest@v4 | |
| with: | |
| subject-path: release-artifact/*.tgz |