Improve ci

.gitlab-ci.yml

@@ -1,26 +1,65 @@
 image: node:22
 
+# We use stages for clarity of intent, and "needs" for dependencies and sequencing.
+# "needs" should work in parallel where acceptable, and get any artifacts directly from the source step.
 stages:
-  - test
-  - publish
+  - download (untrusted)
+  - prepare
+  - deploy
 
-cache:
-  # The cache is shared for same values of cache key
-  # Here, we use CI_PIPELINE_ID which is defined as:
-  # "The instance-level ID of the current pipeline. This ID is unique across all projects on the GitLab instance."
-  # This should ensure that we only cache the "node_modules" folder for this given pipeline instance.
-  # Refer to this docs to know more about the predefined variables used in the key here: https://docs.gitlab.com/ee/ci/variables/predefined_variables.html
-  key: $CI_PIPELINE_ID
-  # configure the path to be cached
-  paths:
-    - node_modules/
+# Install dependencies.
+install:
+  stage: download (untrusted)
 
-before_script:
-  - npm ci
-  - npm run build
+  # NOTE: We ignore lifecycle scripts as they are a common attack vector.
+  script:
+    - npm ci --ignore-scripts
 
+  # Carry over the installed dependencies as artifacts in the pipeline.
+  artifacts:
+    paths:
+      - node_modules/
+
+# Verify that installed dependencies are free from known security issues.
+audit:
+  stage: download (untrusted)
+
+  needs:
+    - install
+
+  script:
+    # Check for moderate, high and critical issues but ignore low impact issues.
+    - npm audit --audit-level=moderate
+    # Check for supply chain tampering with downloaded packages.
+    - npm audit signatures
+
+build:
+  stage: prepare
+
+  needs:
+    - install
+    - audit
+
+  script:
+    - npm run build
+
+  # Carry over the build application in the pipeline.
+  artifacts:
+    paths:
+      - packages/docs/dist/
+      - packages/json-payment-protocol-v2/dist/
+      - packages/primitives/dist/
+      - packages/stack/dist/
+
+# NOTE: Some tests depend on the build output, so we run tests after build.
 test:
-  stage: test
+  stage: prepare
+
+  needs:
+    - install
+    - audit
+    - build
+
   script:
     # Run tests
     - npm run test
@@ -28,12 +67,21 @@ test:
     - npm run madge
 
 publish:development:
-  stage: publish
+  stage: deploy
+
+  needs:
+    - build
+    - test
+
+  only:
+    - development
+
   # Configure what tag to use for this publication.
   variables:
     NPM_TAG: 'development'
     GITLAB_USER_EMAIL: 'ci@stack.xo.cash'
     GITLAB_USER_NAME: 'GitLab CI'
+
   script:
     # Setup git config
     - git config --global user.email "${GITLAB_USER_EMAIL}"
@@ -55,9 +103,7 @@ publish:development:
     - npm config set //registry.npmjs.org/:_authToken ${NPM_AUTH_TOKEN}
 
     # Version and publish
-    - npx lerna publish --yes --canary --preid ${NPM_TAG} --dist-tag ${NPM_TAG}
-  only:
-    - development
+    - npm run publish
 
 # TODO: Document the Lerna Recursive problem when we run lerna version on our main branch.
 # NOTE: The "lerna version" command will create a new commit and push it to our main branch.
@@ -67,13 +113,22 @@ publish:development:
 #       See: https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline
 
 # Publish the documentation to GitLab Pages (for now).
-pages:
-  stage: publish
+publish:docs:
+  stage: deploy
+
+  # After this job successfully completes, GitLab will initiates a Pages deployment, publishing the contents in the specified artifacts directory.
+  pages: true
+
+  needs:
+    - build
+    - test
+
+  only:
+    - development
+
   script:
-    - npm run docs:build
     - mv packages/docs/dist public
+
   artifacts:
     paths:
       - public
-  only:
-    - development