From 515ce75f3bf66894ddb1a04c7d6952f2595ded89 Mon Sep 17 00:00:00 2001 From: AlexYue Date: Wed, 18 Mar 2026 23:52:49 +0800 Subject: [PATCH] ci: add Dependabot, security audit, release-please, and CI optimization (#64) * chore(ci): add Dependabot for npm and GitHub Actions updates - Weekly npm dependency updates with PR limit of 10 - Weekly GitHub Actions version updates with PR limit of 5 - Conventional commit prefixes (chore(deps), chore(ci)) * ci: add security audit workflow - Run npm audit on push/PR and weekly schedule - Fail on high-severity vulnerabilities using audit-ci - Only audit production dependencies * ci: add release-please for automated changelog and versioning - Auto-generate CHANGELOG.md from Conventional Commits - Create version bump PRs on push to main - Works alongside existing release.yml for npm publish * ci: add concurrency controls and Node.js version matrix - Add concurrency groups to ci, e2e-headed, security workflows to cancel duplicate runs on the same branch - Test unit tests across Node 18/20/22 with fail-fast: false - Update test step name to show Node version * chore: bump minimum Node.js version from 18 to 20 - Update engines.node in package.json to >=20.0.0 - Update prerequisites in README.md and README.zh-CN.md - Remove Node 18 from CI test matrix * review: fix release token and prod-only audit scope * docs: align Node 20 troubleshooting guidance --------- Co-authored-by: jackwener --- .github/dependabot.yml | 27 +++++++++++++++++++++ .github/workflows/ci.yml | 10 ++++++-- .github/workflows/e2e-headed.yml | 4 ++++ .github/workflows/release-please.yml | 25 +++++++++++++++++++ .github/workflows/security.yml | 36 ++++++++++++++++++++++++++++ README.md | 4 ++-- README.zh-CN.md | 4 ++-- package.json | 2 +- 8 files changed, 105 insertions(+), 7 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/release-please.yml create mode 100644 .github/workflows/security.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..45e3380 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,27 @@ +version: 2 + +updates: + # npm dependencies + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 10 + labels: + - "dependencies" + commit-message: + prefix: "chore(deps)" + + # GitHub Actions + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + labels: + - "dependencies" + - "ci" + commit-message: + prefix: "chore(ci)" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6cacfd2..9769ff5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,6 +9,10 @@ on: - cron: '0 8 * * 1' # Weekly Monday 08:00 UTC — smoke tests workflow_dispatch: +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + jobs: # ── Fast gate: typecheck + build ── build: @@ -34,20 +38,22 @@ jobs: unit-test: runs-on: ubuntu-latest strategy: + fail-fast: false matrix: + node-version: ['20', '22'] shard: [1, 2] steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: '22' + node-version: ${{ matrix.node-version }} cache: 'npm' - name: Install dependencies run: npm ci - - name: Run unit tests (shard ${{ matrix.shard }}/2) + - name: Run unit tests (Node ${{ matrix.node-version }}, shard ${{ matrix.shard }}/2) run: npx vitest run src/ --reporter=verbose --shard=${{ matrix.shard }}/2 # ── Smoke tests (scheduled / manual only) ── diff --git a/.github/workflows/e2e-headed.yml b/.github/workflows/e2e-headed.yml index ca67071..407f862 100644 --- a/.github/workflows/e2e-headed.yml +++ b/.github/workflows/e2e-headed.yml @@ -7,6 +7,10 @@ on: branches: [main, dev] workflow_dispatch: +concurrency: + group: e2e-${{ github.ref }} + cancel-in-progress: true + jobs: e2e-headed: runs-on: ubuntu-latest diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml new file mode 100644 index 0000000..c922539 --- /dev/null +++ b/.github/workflows/release-please.yml @@ -0,0 +1,25 @@ +name: Release Please + +on: + push: + branches: [main] + +permissions: + contents: write + pull-requests: write + +jobs: + release-please: + runs-on: ubuntu-latest + steps: + - name: Ensure release-please token is configured + run: | + if [ -z "${{ secrets.RELEASE_PLEASE_TOKEN }}" ]; then + echo "RELEASE_PLEASE_TOKEN secret is required so release PRs can trigger downstream CI workflows." >&2 + exit 1 + fi + + - uses: googleapis/release-please-action@v4 + with: + release-type: node + token: ${{ secrets.RELEASE_PLEASE_TOKEN }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..a54b16f --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,36 @@ +name: Security Audit + +on: + push: + branches: [main, dev] + pull_request: + branches: [main, dev] + schedule: + - cron: '0 9 * * 1' # Weekly Monday 09:00 UTC + +permissions: + contents: read + +concurrency: + group: security-${{ github.ref }} + cancel-in-progress: true + +jobs: + audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-node@v4 + with: + node-version: '22' + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: npm audit (production) + run: npm audit --omit=dev --audit-level=high + + - name: Check for known vulnerabilities + run: npx --yes audit-ci@^7 --high --skip-dev diff --git a/README.md b/README.md index 794c26f..71067a8 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ Turn ANY Electron application into a CLI tool! Recombine, script, and extend app ## Prerequisites -- **Node.js**: >= 18.0.0 +- **Node.js**: >= 20.0.0 - **Chrome** running **and logged into the target site** (e.g. bilibili.com, zhihu.com, xiaohongshu.com). > **⚠️ Important**: Browser commands reuse your Chrome login session. You must be logged into the target website in Chrome before running commands. If you get empty data or errors, check your login status first. @@ -303,7 +303,7 @@ npx vitest run tests/e2e/ # E2E tests - **Empty data returns or 'Unauthorized' error** - Your login session in Chrome might have expired. Open a normal Chrome tab, navigate to the target site, and log in or refresh the page to prove you are human. - **Node API errors** - - Make sure you are using Node.js >= 18. Some dependencies require modern Node APIs. + - Make sure you are using Node.js >= 20. Some dependencies require modern Node APIs. - **Token issues** - Run `opencli doctor` to diagnose token configuration across all tools. diff --git a/README.zh-CN.md b/README.zh-CN.md index 5769584..45f9c72 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -45,7 +45,7 @@ CLI all electron！现在支持把所有 electron 应用 CLI 化，从而组合 ## 前置要求 -- **Node.js**: >= 18.0.0 +- **Node.js**: >= 20.0.0 - **Chrome** 浏览器正在运行，且**已登录目标网站**（如 bilibili.com、zhihu.com、xiaohongshu.com） > **⚠️ 重要**：大多数命令复用你的 Chrome 登录状态。运行命令前，你必须已在 Chrome 中打开目标网站并完成登录。如果获取到空数据或报错，请先检查你的浏览器登录状态。 @@ -286,7 +286,7 @@ opencli cascade https://api.example.com/data - **返回空数据，或者报错 "Unauthorized"** - Chrome 里的登录态可能已经过期（甚至被要求过滑动验证码）。请打开当前 Chrome 页面，在新标签页重新手工登录或刷新该页面。 - **Node API 错误 (如 parseArgs, fs 等)** - - 确保 Node.js 版本 `>= 18`。旧版不支持我们使用的现代核心库 API。 + - 确保 Node.js 版本 `>= 20`。旧版不支持我们使用的现代核心库 API。 - **Token 问题** - 运行 `opencli doctor` 诊断所有工具的 Token 配置状态。 - 使用 `opencli doctor --live` 测试浏览器连通性。 diff --git a/package.json b/package.json index c6f5e23..1d0ae03 100644 --- a/package.json +++ b/package.json @@ -6,7 +6,7 @@ }, "description": "Make any website your CLI. AI-powered.", "engines": { - "node": ">=18.0.0" + "node": ">=20.0.0" }, "type": "module", "main": "dist/main.js",