ci: github actions workflow improvements (#5177)

* ci: use `npm ci` consistently

* ci: use `actions/setup-node` cache mechanism

* ci: reusable workflow for DRY:er setup

* ci: remove unused `delete-runs.yml`

* ci: fix matrix definitions

* ci: fix matrix definitions, take 2

* ci: ensure they all scripts can use `npm run`

See also #5128

* ci: add node 22 to `test-node`

* ci: have the coverage run always happen on `lts/*`

* ci: set permissions

* ci: lock down all non-github actions by hash

* ci: use reusable workflow for full tests as well

* ci: remove redundant activity types

* ci: add one more permissions

* ci: use full sha hashes for third party workflows

* ci: be consistent in naming

* ci: generate the coverage report using nps for now

See #5126

* ci: parallelize, run local browser test right away

* ci: disable saucelabs for now, too noisy

.github/workflows/browser-test.yml

@@ -11,34 +11,20 @@ permissions:
 
 jobs:
   test-browser:
-    # TODO: configure to retain build artifacts in `.karma/` dir
     name: 'Browser Tests'
-    timeout-minutes: 20
-    runs-on: ubuntu-latest
     if: contains(github.event.pull_request.labels.*.name, 'run-browser-test')
+    uses: ./.github/workflows/npm-script.yml
+    secrets: inherit
+    with:
+      npm-script: test.browser
+
+  remove-label:
+    needs: test-browser
+    if: always()
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          persist-credentials: false
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
-        with:
-          path: '~/.npm'
-          key: "ubuntu-latest-node-full-lts-${{ hashFiles('**/package-lock.json') }}"
-      - name: Install Dependencies
-        run: npm ci
-      - name: Run Browser Tests
-        run: npm start test.browser
-        env:
-          SAUCE_USERNAME: '${{secrets.SAUCE_USERNAME}}'
-          SAUCE_ACCESS_KEY: '${{secrets.SAUCE_ACCESS_KEY}}'
       - name: remove 'run-browser-test' label
-        uses: buildsville/[email protected]
-        if: ${{ always() }}
+        uses: buildsville/add-remove-label@ac59c9f0aeb66eb12d6366eb1d69ec1906e9ef9a
         with:
           token: ${{secrets.GITHUB_TOKEN}}
           label: run-browser-test

.github/workflows/compliance.yml

@@ -2,7 +2,7 @@ jobs:
   compliance:
     runs-on: ubuntu-latest
     steps:
-      - uses: mtfoley/pr-compliance-action@main
+      - uses: mtfoley/pr-compliance-action@11b664f0fcf2c4ce954f05ccfcaab6e52b529f86
         with:
           body-auto-close: false
           ignore-team-members: false

.github/workflows/mocha.yml

@@ -1,205 +1,56 @@
 name: Tests
+
 on:
   push:
     branches:
-      - '**'
-      - '!mochajs.org'
+      - main
     paths-ignore: ['*.md', 'docs/**']
-    tags-ignore:
-      - '**'
   pull_request:
-    types: [opened, synchronize, reopened]
+    branches:
+      - main
     paths-ignore: ['*.md', 'docs/**']
 
+permissions:
+  contents: read
+
 jobs:
-  prevent-double-run:
-    # skip 'push' event when an open PR exists
-    name: Prevent double run
-    runs-on: ubuntu-latest
-    outputs:
-      pr-id: ${{ steps.findPr.outputs.number }}
-    steps:
-      - name: Check event pull_request
-        if: github.event_name == 'pull_request'
-        run: 'echo pull_request: run workflow'
-      - uses: actions/checkout@v4
-        if: github.event_name == 'push'
-        with:
-          persist-credentials: false
-      - name: Check event push
-        id: findPr
-        if: github.event_name == 'push'
-        uses: jwalton/gh-find-current-pr@v1
-        with:
-          state: open
+  lint:
+    uses: ./.github/workflows/npm-script.yml
+    with:
+      npm-script: lint
 
   smoke:
-    name: 'Smoke [Node.js v${{ matrix.node }} / ${{ matrix.os }}]'
-    needs: prevent-double-run
-    if: needs.prevent-double-run.outputs.pr-id == ''
-    runs-on: '${{ matrix.os }}'
-    strategy:
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-2019
-        node:
-          - 14
-          - 16
-          - 18
-          - 20
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '${{ matrix.node }}'
-      - run: npm install --production
-      - run: npm run test:smoke
-
-  lint:
-    name: Linting code and markdown
-    runs-on: ubuntu-latest
-    needs: smoke
-    steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
-        with:
-          path: '~/.npm'
-          key: "ubuntu-latest-node-lts-${{ hashFiles('**/package-lock.json') }}"
-      - name: Install Dependencies
-        run: npm ci --ignore-scripts
-      - name: 'Check lint'
-        run: npm start lint
+    uses: ./.github/workflows/npm-script.yml
+    with:
+      os: 'ubuntu-latest,windows-2019'
+      node-versions: '14,16,18,20,22'
+      npm-script: test:smoke
 
   test-node:
-    name: 'Node.js [v${{ matrix.node }} / ${{ matrix.os }}]'
+    # TODO: Restore "mocha-github-actions-reporter" style reporting without relying on third party module
+    uses: ./.github/workflows/npm-script.yml
     needs: smoke
-    runs-on: '${{ matrix.os }}'
-    env:
-      NODE_OPTIONS: '--trace-warnings'
-    strategy:
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-2019
-        node:
-          - 14
-          - 16
-          - 18
-          - 20
-        include:
-          - os: ubuntu-latest
-            node: 16
-            env:
-              COVERAGE: 1
-    steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '${{ matrix.node }}'
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Get npm cache directory in Windows
-        id: npm-cache
-        if: ${{ matrix.os == 'windows-2019' }}
-        run: |
-          echo "dir=$(npm config get cache)" >> $env:GITHUB_OUTPUT
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
-        with:
-          path: ${{ matrix.os == 'ubuntu-latest' && '~/.npm' || steps.npm-cache.outputs.dir }}
-          key: "${{ matrix.os }}-node-v${{ matrix.node }}-${{ hashFiles('**/package-lock.json') }}"
-      - name: Install Dependencies
-        run: npm ci --ignore-scripts
-      - name: Install Annotation Support
-        run: npm install mocha-github-actions-reporter
-      - name: Run All Node.js Tests
-        run: npm start test.node
-        env:
-          COVERAGE: '${{ matrix.env.COVERAGE }}'
-          MOCHA_REPORTER: mocha-github-actions-reporter
-          # this is so mocha-github-actions-reporter can find mocha
-          NODE_PATH: lib
-      - name: Generate Coverage Report (Linux + Node.js latest)
-        if: ${{ matrix.env.COVERAGE }}
-        run: npm start coverage-report-lcov
-      - name: Upload Coverage to Coveralls (Linux + Node.js latest)
-        if: ${{ matrix.env.COVERAGE }}
-        uses: coverallsapp/github-action@master
-        with:
-          github-token: '${{ secrets.GITHUB_TOKEN }}'
+    with:
+      os: 'ubuntu-latest,windows-2019'
+      node-versions: '14,16,18,20,22'
+      npm-script: test:node
+      coverage: true
 
   test-browser-local:
-    name: Browser Test [ChromeHeadless]
-    needs: smoke
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    # Don't run forked 'pull_request' without saucelabs token
-    if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
-    steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
-        with:
-          path: '~/.npm'
-          # this key is different than above, since we are running scripts
-          # (builds, postinstall lifecycle hooks, etc.)
-          key: "ubuntu-latest-node-full-lts-${{ hashFiles('**/package-lock.json') }}"
-      - name: Install Dependencies
-        run: npm ci
-      - name: Run Browser Tests
-        run: npm start test.browser
-        env:
-          BROWSER: ChromeHeadless
+    uses: ./.github/workflows/npm-script.yml
+    with:
+      browsers: ChromeHeadless
+      npm-script: test:browser
 
-  test-browser-saucelabs:
-    name: Browser Tests on SauceLabs [${{ matrix.browser }}]
-    needs:
-      - smoke
-      - test-browser-local
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      matrix:
-        browser:
-          - firefox@latest
-          - chrome@latest
-          - MicrosoftEdge@latest
-          - safari@latest
-    # Don't run forked 'pull_request' without saucelabs token
-    if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
-    steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: 'Cache node_modules'
-        uses: actions/cache@v4
-        with:
-          path: '~/.npm'
-          # this key is different than above, since we are running scripts
-          # (builds, postinstall lifecycle hooks, etc.)
-          key: "ubuntu-latest-node-full-lts-${{ hashFiles('**/package-lock.json') }}"
-      - name: Install Dependencies
-        run: npm ci
-      - name: Run Browser Tests
-        run: npm start test.browser
-        env:
-          SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
-          SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
-          BROWSER: ${{ matrix.browser }}
+  # test-browser-saucelabs:
+  #   # Don't run forked 'pull_request' without saucelabs token
+  #   if: github.event_name == 'push' || !github.event.pull_request.head.repo.fork
+  #   needs:
+  #     - lint
+  #     - smoke
+  #     - test-browser-local
+  #   uses: ./.github/workflows/npm-script.yml
+  #   secrets: inherit
+  #   with:
+  #     browsers: 'firefox@latest,chrome@latest,MicrosoftEdge@latest,safari@latest'
+  #     npm-script: test:browser

.github/workflows/nightly-site-deploy.yml

@@ -2,15 +2,20 @@
 # This updates the list of supporters
 
 name: Nightly mochajs.org Deploy
+
 on:
   schedule:
     - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Webhook Action
-        uses: joelwmale/webhook-action@2.3.2
+        uses: joelwmale/webhook-action@448a17bf857ead98546cfbdbe3b9d4cf979dda95
         env:
           data: ''
           WEBHOOK_URL: ${{ secrets.NETLIFY_NIGHTLY_DEPLOY_URL }}