Skip to content

chore: make the setup-node contract assertion version-agnostic #154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
antonio-orionus merged 2 commits into from
Aug 8, 2026
Merged

chore: make the setup-node contract assertion version-agnostic #154

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
692b1f7
chore: make the setup-node contract assertion version-agnostic
antonio-orionus Aug 8, 2026
661e655
chore: use includes() for the setup-node contract assertion
antonio-orionus Aug 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion scripts/check-tooling-contract.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,7 +278,10 @@ for (const workflow of publishWorkflows) {
assert(text.includes(`run: ${workflow.command}`), `${workflow.path} must call "${workflow.command}".`)
assert(text.includes('bun pm view'), `${workflow.path} must use bun pm view for registry version checks.`)
assert(text.includes('bun pm pack --destination'), `${workflow.path} must pack artifacts with bun pm pack.`)
assert(text.includes('uses: actions/setup-node@v6'), `${workflow.path} must set up Node for registry trusted publishing.`)
// Version-agnostic on purpose: the contract cares that Node is set up for
// trusted publishing, not which release of the action does it. Pinning the
// major here meant every setup-node bump failed the gate.
assert(text.includes('uses: actions/setup-node@'), `${workflow.path} must set up Node for registry trusted publishing.`)
assert(text.includes('node-version: 24'), `${workflow.path} must use Node 24 for registry trusted publishing.`)
assert(text.includes('registry-url: https://registry.npmjs.org'), `${workflow.path} must target the npmjs registry for trusted publishing.`)
assert(text.includes('package-manager-cache: false'), `${workflow.path} must keep package-manager caching disabled in publish jobs.`)
Expand Down
Loading