initial commit of new reusable gha stub by sarasvoss · Pull Request #107 · OpenSesame/core-github-actions

sarasvoss · 2026-01-17T18:13:28Z

PR Summary

Jira: https://opensesame.atlassian.net/browse/CORE-XXXX

Description of Changes

Adding reusable GHA for running npm scripts for CI

Versioning

⚠️ Components in this repo are used by multiple repos and teams. Breaking changes to non-versioned components are high-risk. Always apply correct versioning to versioned components to ensure safe, controlled updates.

Versioned components live under ./github/actions

Does this PR modify a versioned component?

No — label this PR with version:untracked
Yes
- Add a version label: version:<component-name>/X.Y.Z
- Ensure the component’s CHANGELOG.md includes a ## X.Y.Z entry
- Use version:untracked only if changes do not alter behavior, inputs, or outputs

If version labels are incorrect or missing, automated version validation will fail and block merge.

Dependencies of PR

N/A

Testing

tested in internal_ GHA runs for this repo's CI

github-actions · 2026-01-17T18:20:42Z

✅ Semgrep Security Scan Passed

🎉 No security issues found!

View run
_{🤖 Powered by Semgrep + reviewdog}

Copilot

Pull request overview

Adds a reusable GitHub Actions workflow for running common npm CI steps, and introduces two composite actions (audit-npm and run-npm-script) to standardize/DRY npm auditing and script execution across workflows.

Changes:

Added reusable workflow .github/workflows/run_npm_ci_scripts.yml to run npm install/audit/build/lint/format/test with a job summary and gating.
Refactored internal push CI to call the new reusable workflow.
Added composite actions audit-npm and run-npm-script with initial documentation and changelogs.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 16 comments.

Show a summary per file

File	Description
`.github/workflows/run_npm_ci_scripts.yml`	New reusable npm CI workflow (currently has working-directory + versioning/permissions issues).
`.github/workflows/internal_on_push_ci.yml`	Switches internal CI job to call the new reusable workflow.
`.github/actions/run-npm-script/action.yml`	New composite action to conditionally run an npm script and emit status.
`.github/actions/run-npm-script/README.md`	Documentation for `run-npm-script` (currently has input + version tag format mismatches).
`.github/actions/run-npm-script/CHANGELOG.md`	Initial changelog (currently uses an invalid version header format for this repo).
`.github/actions/audit-npm/action.yml`	New composite action to run/parse `npm audit` (currently not parameterized for working directory).
`.github/actions/audit-npm/README.md`	Documentation for `audit-npm` (currently has version tag format mismatch).
`.github/actions/audit-npm/CHANGELOG.md`	Initial changelog (currently uses an invalid version header format for this repo).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-26T20:09:52Z

.github/workflows/run_npm_ci_scripts.yml

+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN }}
+      WORKING_DIRECTORY: ${{ inputs.working_directory }}


This reusable workflow uses secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN but does not declare it under on.workflow_call.secrets. In this repo, reusable workflows that need org secrets declare them explicitly (e.g. .github/workflows/deploy_feature_branch.yml).

Suggestion: add on.workflow_call.secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN (required: true) so callers can pass it reliably.

Copilot · 2026-02-26T20:09:53Z

.github/actions/run-npm-script/README.md

+  id: build
+  uses: ./.github/actions/run-npm-script
+  with:
+    working-directory: '.'


The usage example sets working-directory, but the action input is working_directory (underscore) in action.yml. As written, the example won’t apply the input.

Suggestion: update the example to use working_directory.

Suggested change

working-directory: '.'

working_directory: '.'

Copilot · 2026-02-26T20:09:53Z

.github/actions/run-npm-script/README.md

+This action uses namespaced tags for versioning and is tracked in the CHANGELOG.
+
+```text
+action/run-npm-script/vX.Y.Z


The versioning section uses a tag format of action/.../vX.Y.Z, but this repo’s policy uses namespaced tags like actions/<component-name>/X.Y.Z (and changelog headings must be ## X.Y.Z).

Suggestion: update this section to match VERSIONING.md so consumers use the correct tag format.

Suggested change

This action uses namespaced tags for versioning and is tracked in the CHANGELOG.

```text

action/run-npm-script/vX.Y.Z

This action uses namespaced tags for versioning and is tracked in the CHANGELOG under headings of the form `## X.Y.Z`.

```text

actions/run-npm-script/X.Y.Z

Copilot · 2026-02-26T20:09:54Z

.github/workflows/run_npm_ci_scripts.yml

+          working_directory: '.'
+          script: build
+
+      - name: Lint
+        uses: ./.github/actions/run-npm-script
+        id: lint
+        with:
+          working_directory: '.'
+          script: lint:check
+
+      - name: Format
+        uses: ./.github/actions/run-npm-script
+        id: format
+        with:
+          working_directory: '.'
+          script: format:check
+
+      - name: Test
+        uses: ./.github/actions/run-npm-script
+        id: test
+        with:
+          working_directory: '.'


run-npm-script is invoked with working_directory: '.', which ignores inputs.working_directory.

Suggestion: pass ${{ inputs.working_directory }} so tests run in the intended package directory.

Suggested change

working_directory: '.'

script: build

- name: Lint

uses: ./.github/actions/run-npm-script

id: lint

with:

working_directory: '.'

script: lint:check

- name: Format

uses: ./.github/actions/run-npm-script

id: format

with:

working_directory: '.'

script: format:check

- name: Test

uses: ./.github/actions/run-npm-script

id: test

with:

working_directory: '.'

working_directory: ${{ inputs.working_directory }}

script: build

- name: Lint

uses: ./.github/actions/run-npm-script

id: lint

with:

working_directory: ${{ inputs.working_directory }}

script: lint:check

- name: Format

uses: ./.github/actions/run-npm-script

id: format

with:

working_directory: ${{ inputs.working_directory }}

script: format:check

- name: Test

uses: ./.github/actions/run-npm-script

id: test

with:

working_directory: ${{ inputs.working_directory }}

Copilot · 2026-02-26T20:09:54Z

.github/workflows/run_npm_ci_scripts.yml

+      - name: Change to working directory
+        run: |
+          echo "Changing to working directory: $WORKING_DIRECTORY"
+          cd "$WORKING_DIRECTORY"
+


The Change to working directory step won’t affect later steps (each step runs in a fresh shell), and it also runs before actions/checkout, so the target directory likely doesn’t exist yet. As a result, npm ci and the composite actions will execute from the repo root instead of inputs.working_directory.

Suggestion: remove this step and instead set defaults.run.working-directory: ${{ inputs.working_directory }} for run: steps (or add working-directory: on each run:), and pass ${{ inputs.working_directory }} through to the composite actions that need it.

Copilot · 2026-02-26T20:09:56Z

.github/workflows/run_npm_ci_scripts.yml

+name: NPM CI
+
+on:
+  workflow_call:
+    inputs:


Per VERSIONING.md, reusable workflows under .github/workflows are versioned and require an entry under .github/workflows/CHANGELOGS/<workflow-name>.md. This PR adds a new reusable workflow but does not add the corresponding workflow changelog, which will likely break automated version validation.

Suggestion: add the missing changelog file with a ## 1.0.0 entry (no v prefix).

Copilot · 2026-02-26T20:09:56Z

.github/actions/audit-npm/README.md

+
+This action uses namespaced tags for versioning and is tracked in the CHANGELOG.
+
+```text
+action/audit-npm/vX.Y.Z


The versioning section uses a tag format of action/.../vX.Y.Z, but this repo’s policy uses namespaced tags like actions/<component-name>/X.Y.Z and changelog headings must be ## X.Y.Z.

Suggestion: update this section to match VERSIONING.md so consumers use the correct tag format.

Copilot · 2026-02-26T20:09:56Z

.github/workflows/run_npm_ci_scripts.yml

+          working_directory: '.'
+          script: build
+
+      - name: Lint
+        uses: ./.github/actions/run-npm-script
+        id: lint
+        with:
+          working_directory: '.'
+          script: lint:check
+
+      - name: Format
+        uses: ./.github/actions/run-npm-script
+        id: format
+        with:
+          working_directory: '.'
+          script: format:check
+
+      - name: Test
+        uses: ./.github/actions/run-npm-script
+        id: test
+        with:
+          working_directory: '.'


run-npm-script is invoked with working_directory: '.', which ignores inputs.working_directory.

Suggestion: pass ${{ inputs.working_directory }} so lint runs in the intended package directory.

Suggested change

working_directory: '.'

script: build

- name: Lint

uses: ./.github/actions/run-npm-script

id: lint

with:

working_directory: '.'

script: lint:check

- name: Format

uses: ./.github/actions/run-npm-script

id: format

with:

working_directory: '.'

script: format:check

- name: Test

uses: ./.github/actions/run-npm-script

id: test

with:

working_directory: '.'

working_directory: ${{ inputs.working_directory }}

script: build

- name: Lint

uses: ./.github/actions/run-npm-script

id: lint

with:

working_directory: ${{ inputs.working_directory }}

script: lint:check

- name: Format

uses: ./.github/actions/run-npm-script

id: format

with:

working_directory: ${{ inputs.working_directory }}

script: format:check

- name: Test

uses: ./.github/actions/run-npm-script

id: test

with:

working_directory: ${{ inputs.working_directory }}

Copilot · 2026-02-26T20:09:57Z

.github/actions/run-npm-script/CHANGELOG.md

+
+All notable changes to the **run-npm-script** action are documented in this file.
+
+## v1.0.0


This changelog uses ## v1.0.0, but the repo’s version validation expects headings to be exactly ## X.Y.Z (no v prefix). Using v1.0.0 will cause automated version/changelog validation to fail.

Suggestion: change the heading to ## 1.0.0 and ensure the PR label matches that version format.

Suggested change

## v1.0.0

## 1.0.0

Copilot · 2026-02-26T20:09:57Z

.github/actions/audit-npm/CHANGELOG.md

+
+All notable changes to the **audit-npm** action are documented in this file.
+
+## v1.0.0


This changelog uses ## v1.0.0, but the repo’s version validation expects headings to be exactly ## X.Y.Z (no v prefix). Using v1.0.0 will cause automated version/changelog validation to fail.

Suggestion: change the heading to ## 1.0.0 and ensure the PR label matches that version format.

Suggested change

## v1.0.0

## 1.0.0

sarasvoss requested a review from a team as a code owner January 17, 2026 18:13

sarasvoss force-pushed the add-run-npm-ci-gha branch from 766021c to 66e3ebd Compare January 17, 2026 18:20

initial commit of new reusable gha stub

80aedaa

sarasvoss force-pushed the add-run-npm-ci-gha branch from 66e3ebd to 80aedaa Compare January 17, 2026 18:30

sarasvoss added 2 commits January 17, 2026 14:19

add composite action for npm audit

ff7ccd5

write summary with audit result

89a2638

sarasvoss force-pushed the add-run-npm-ci-gha branch from 0a319c0 to 89a2638 Compare January 17, 2026 20:01

sarasvoss added 3 commits January 17, 2026 15:09

fix variable access

e277b70

add readme and change log for composite audit action

ecba662

add build step to npm ci

d10f071

sarasvoss force-pushed the add-run-npm-ci-gha branch 2 times, most recently from 5657f62 to 5c1be5b Compare January 17, 2026 21:54

add lint and format checks

23c7548

sarasvoss force-pushed the add-run-npm-ci-gha branch from 5c1be5b to 23c7548 Compare January 17, 2026 22:00

add test to ci run

521babe

sarasvoss force-pushed the add-run-npm-ci-gha branch 2 times, most recently from b27a09b to aac3911 Compare January 17, 2026 22:58

extract run npm script ci logic

eaebb9e

sarasvoss force-pushed the add-run-npm-ci-gha branch from aac3911 to eaebb9e Compare January 17, 2026 23:19

sarasvoss and others added 3 commits January 17, 2026 18:32

add changelog and readme for run-npm-script composite action

1b527fe

normalize inputs and outputs to use _

5aba025

Merge branch 'main' into add-run-npm-ci-gha

c7b4996

Copilot AI review requested due to automatic review settings February 26, 2026 20:04

Copilot started reviewing on behalf of rebonat0 February 26, 2026 20:04 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

initial commit of new reusable gha stub#107

initial commit of new reusable gha stub#107
sarasvoss wants to merge 12 commits intomainfrom
add-run-npm-ci-gha

sarasvoss commented Jan 17, 2026

Uh oh!

github-actions bot commented Jan 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		All notable changes to the run-npm-script action are documented in this file.

		## v1.0.0


		All notable changes to the audit-npm action are documented in this file.

		## v1.0.0

Conversation

sarasvoss commented Jan 17, 2026

PR Summary

Description of Changes

Versioning

Dependencies of PR

Testing

Uh oh!

github-actions bot commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Semgrep Security Scan Passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Jan 17, 2026 •

edited

Loading