ci(workflows): update notification method to use webhook API instead …

.github/workflows/push.yml

@@ -5,33 +5,49 @@ jobs:
     runs-on: ubuntu-latest
     name: Unit Tests
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
-          node-version: 16
+          node-version: 24
+      - name: Setup npm
+        working-directory: ${{ runner.temp }}
+        run: npm install --global npm@11.17.0
       - name: Install
         run: npm i
       - name: Test
         run: npm t
+      - name: Notify release failure
+        if: ${{ failure() }}
+        env:
+          WEBHOOK_URI: ${{ secrets.WEBHOOK_API_URI }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          jq -n --arg text "Unit-test of code-integrity-actions failed: $RUN_URL" '{text: $text}' |
+            curl --fail --silent --show-error \
+              --header 'Content-Type: application/json' \
+              --data-binary @- "$WEBHOOK_URI"
+
 
   protect-e2e-tests:
     runs-on: ubuntu-latest
     name: Protect e2e Test
     environment: production
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
-          node-version: 16
+          node-version: 24
+      - name: Setup npm
+        working-directory: ${{ runner.temp }}
+        run: npm install --global npm@11.17.0
       - name: Install and Build
         run: npm i && npm run build
       - name: Test
         id: jscrambler
         uses: ./protect
         with:
-          # USER_ID: 19983
           application-id: ${{ secrets.JSCRAMBLER_APPLICATION_ID }}
           secret-key: ${{ secrets.JSCRAMBLER_SECRET_KEY }}
           access-key: ${{ secrets.JSCRAMBLER_ACCESS_KEY }}
@@ -46,43 +62,78 @@ jobs:
         if: "${{ steps.jscrambler.outputs.protection-id == '' }}"
         run: exit 1
       - name: Check Generated Files
-        uses: andstor/file-existence-action@v2
+        uses: andstor/file-existence-action@20b4d2e596410855db8f9ca21e96fbe18e12930b # v2
         with:
           files: "protect/src/utils/__tests__/fixtures-obfuscated/protect/src/utils/__tests__/fixtures/*.js, protect/src/utils/__tests__/fixtures-extra/jscramblerSourceMaps/protect/src/utils/__tests__/fixtures/*.js.map, protect/src/utils/__tests__/fixtures-extra/symbols/*_symbolTable.json"
           fail: true
-      # - name: Upload source maps
-      #  uses: actions/upload-artifact@v3
-      #  with:
-      #    name: source-maps
-      #    path: protect/dist-extra/jscramblerSourceMaps/
-      #    retention-days: 1
-
-  release:
-    name: Release
+          # - name: Upload source maps
+          #  uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
+          #  with:
+          #    name: source-maps
+          #    path: protect/dist-extra/jscramblerSourceMaps/
+          #    retention-days: 1
+      - name: Notify release failure
+        if: ${{ failure() }}
+        env:
+          WEBHOOK_URI: ${{ secrets.WEBHOOK_API_URI }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          jq -n --arg text "E2E tests of code-integrity-actions failed: $RUN_URL" '{text: $text}' |
+            curl --fail --silent --show-error \
+              --header 'Content-Type: application/json' \
+              --data-binary @- "$WEBHOOK_URI"
+
+
+  create-tag:
+    name: Create Jscrambler Version Tag
     runs-on: ubuntu-latest
     needs: [ unit-tests, protect-e2e-tests ]
-    if: github.ref_type == 'tag'
+    if: github.ref == 'refs/heads/main'
     steps:
-      - name: Parse Tag
-        id: get_version
-        uses: battila7/get-version-action@v2
-      - uses: technote-space/release-github-actions@v8
+      - name: Get Access Token
+        id: get_workflow_token
+        uses: peter-murray/workflow-application-token-action@dad2b81e50ce3edeb5f3b7ffbd79f731368bd668
+        with:
+          application_id: ${{ secrets.CODE_INTEGRITY_ACTIONS_APP_ID }}
+          application_private_key: ${{ secrets.CODE_INTEGRITY_ACTIONS_PRIVATE_KEY }}
+      - name: Checkout Code Integrity Actions Repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
+          repository: jscrambler/code-integrity-actions
+          token: ${{ steps.get_workflow_token.outputs.token }}
+          ref: ${{ github.sha }}
+      - name: Get Jscrambler CLI Version
+        id: dependency_jscrambler
+        uses: ActionsTools/read-json-action@9750aa7419d36b6bdc275883f2ecb4d2fdf0db2c # main
+        with:
+          file_path: "package.json"
+          prop_path: "dependencies.jscrambler"
+      - uses: technote-space/release-github-actions@052f205daf62dff0c3ece009f07b38f3ec83e01a # v8
+        name: Build github action assets
+        with:
+          CREATE_MAJOR_VERSION_TAG: false
+          CREATE_MINOR_VERSION_TAG: false
+          CREATE_PATCH_VERSION_TAG: false
+          GITHUB_TOKEN: ${{ steps.get_workflow_token.outputs.token }}
           COMMIT_MESSAGE: Built with Jscrambler ${{ steps.get_version.outputs.version }}
           DELETE_NODE_MODULES: true
           CLEAN_TARGETS: ".[!.]*,__tests__,docs,**/src,*.[jt]s,*.[mc][jt]s,jscrambler.json,tsconfig.json,package-lock.json,*.lock,*.yml,*.yaml"
-      - uses: ncipollo/release-action@v1
-        id: release
+      - name: Create and Push Version Tag
+        uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b # v6.2
         with:
-          draft: true
-          allowUpdates: true
-      - name: Send mail
-        uses: dawidd6/action-send-mail@v3
-        with:
-          server_address: ${{ secrets.MAIL_SMTP }}
-          username: ${{ secrets.MAIL_USERNAME }}
-          password: ${{ secrets.MAIL_PASSWORD }}
-          subject: "[Action Required] Publish release ${{ steps.get_version.outputs.version }}"
-          to: code@jscrambler.com
-          from: "code-integrity-actions"
-          body: "Publish code-integrity-actions release ${{ steps.get_version.outputs.version }} to the Marketplace - ${{ steps.release.outputs.html_url }}"
+          github_token: ${{ steps.get_workflow_token.outputs.token }}
+          custom_tag: ${{ steps.dependency_jscrambler.outputs.value }}
+          tag_prefix: v
+          release_branches: main
+          fetch_all_tags: true
+      - name: Notify release failure
+        if: ${{ failure() }}
+        env:
+          WEBHOOK_URI: ${{ secrets.WEBHOOK_API_URI }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          jq -n --arg text "Create git tag on code-integrity-actions failed: $RUN_URL" '{text: $text}' |
+            curl --fail --silent --show-error \
+              --header 'Content-Type: application/json' \
+              --data-binary @- "$WEBHOOK_URI"
+

.github/workflows/release.yml

@@ -0,0 +1,40 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Parse Tag
+        id: get_version
+        uses: battila7/get-version-action@d97fbc34ceb64d1f5d95f4dfd6dce33521ccccf5 # v2
+      - name: Get Access Token
+        id: get_workflow_token
+        uses: peter-murray/workflow-application-token-action@dad2b81e50ce3edeb5f3b7ffbd79f731368bd668
+        with:
+          application_id: ${{ secrets.CODE_INTEGRITY_ACTIONS_APP_ID }}
+          application_private_key: ${{ secrets.CODE_INTEGRITY_ACTIONS_PRIVATE_KEY }}
+      - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
+        id: release
+        with:
+          draft: true
+          allowUpdates: true
+          token: ${{ steps.get_workflow_token.outputs.token }}
+          tag: v${{ steps.get_version.outputs.version }}
+      - name: Send a publish notification
+        run: "wget -X POST \"${{ secrets.WEBHOOK_API_URI }}\" --header 'Content-Type: application/json' --post-data '{\"text\": \"Publish code-integrity-actions release ${{ steps.get_version.outputs.version }} to the Marketplace - ${{ steps.release.outputs.html_url }} is waiting approval 🕵️\"}'"
+      - name: Notify release failure
+        if: ${{ failure() }}
+        env:
+          WEBHOOK_URI: ${{ secrets.WEBHOOK_API_URI }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          jq -n --arg text "Release code-integrity-actions failed: $RUN_URL" '{text: $text}' |
+            curl --fail --silent --show-error \
+              --header 'Content-Type: application/json' \
+              --data-binary @- "$WEBHOOK_URI"

.gitignore

@@ -1,4 +1,3 @@
 node_modules
-package-lock.json
 coverage/
 dist/

.npmrc

@@ -0,0 +1,3 @@
+registry=https://registry.npmjs.org/
+min-release-age=10
+min-release-age-exclude[]=jscrambler

README.md

@@ -37,7 +37,7 @@ Place the ["No Secrets" Jscrambler Settings File](https://docs.jscrambler.com/la
 
 ```yaml
 steps:
-- uses: jscrambler/code-integrity-actions/protect@v6
+- uses: jscrambler/code-integrity-actions/protect@v8
   with:
     secret-key: ${{ secrets.JSCRAMBLER_SECRET_KEY }}
     access-key: ${{ secrets.JSCRAMBLER_ACCESS_KEY }}

action.yml

@@ -5,5 +5,5 @@ branding:
   icon: shield
   color: blue
 runs:
-  using: 'node16'
+  using: 'node24'
   main: 'main.js'