Improve ci

.gitlab-ci.yml

@@ -1,26 +1,65 @@
 image: node:22
 
+# We use stages for clarity of intent, and "needs" for dependencies and sequencing.
+# "needs" should work in parallel where acceptable, and get any artifacts directly from the source step.
 stages:
-  - test
+  - download (untrusted)
-  - publish
+  - prepare
+  - deploy
 
-cache:
+# Install dependencies.
-  # The cache is shared for same values of cache key
+install:
-  # Here, we use CI_PIPELINE_ID which is defined as:
+  stage: download (untrusted)
-  # "The instance-level ID of the current pipeline. This ID is unique across all projects on the GitLab instance."
-  # This should ensure that we only cache the "node_modules" folder for this given pipeline instance.
-  # Refer to this docs to know more about the predefined variables used in the key here: https://docs.gitlab.com/ee/ci/variables/predefined_variables.html
-  key: $CI_PIPELINE_ID
-  # configure the path to be cached
-  paths:
-    - node_modules/
 
-before_script:
+  # NOTE: We ignore lifecycle scripts as they are a common attack vector.
-  - npm ci
+  script:
-  - npm run build
+    - npm ci --ignore-scripts
 
+  # Carry over the installed dependencies as artifacts in the pipeline.
+  artifacts:
+    paths:
+      - node_modules/
+
+# Verify that installed dependencies are free from known security issues.
+audit:
+  stage: download (untrusted)
+
+  needs:
+    - install
+
+  script:
+    # Check for moderate, high and critical issues but ignore low impact issues.
+    - npm audit --audit-level=moderate
+    # Check for supply chain tampering with downloaded packages.
+    - npm audit signatures
+
+build:
+  stage: prepare
+
+  needs:
+    - install
+    - audit
+
+  script:
+    - npm run build
+
+  # Carry over the build application in the pipeline.
+  artifacts:
+    paths:
+      - packages/docs/dist/
+      - packages/json-payment-protocol-v2/dist/
+      - packages/primitives/dist/
+      - packages/stack/dist/
+
+# NOTE: Some tests depend on the build output, so we run tests after build.
 test:
-  stage: test
+  stage: prepare
+
+  needs:
+    - install
+    - audit
+    - build
+
   script:
     # Run tests
     - npm run test
@@ -28,12 +67,21 @@ test:
     - npm run madge
 
 publish:development:
-  stage: publish
+  stage: deploy
+
+  needs:
+    - build
+    - test
+
+  only:
+    - development
+
   # Configure what tag to use for this publication.
   variables:
     NPM_TAG: 'development'
     GITLAB_USER_EMAIL: 'ci@stack.xo.cash'
     GITLAB_USER_NAME: 'GitLab CI'
+
   script:
     # Setup git config
     - git config --global user.email "${GITLAB_USER_EMAIL}"
@@ -55,9 +103,7 @@ publish:development:
     - npm config set //registry.npmjs.org/:_authToken ${NPM_AUTH_TOKEN}
 
     # Version and publish
-    - npx lerna publish --yes --canary --preid ${NPM_TAG} --dist-tag ${NPM_TAG}
+    - npm run publish
-  only:
-    - development
 
 # TODO: Document the Lerna Recursive problem when we run lerna version on our main branch.
 # NOTE: The "lerna version" command will create a new commit and push it to our main branch.
@@ -67,13 +113,22 @@ publish:development:
 #       See: https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline
 
 # Publish the documentation to GitLab Pages (for now).
-pages:
+publish:docs:
-  stage: publish
+  stage: deploy
+
+  # After this job successfully completes, GitLab will initiates a Pages deployment, publishing the contents in the specified artifacts directory.
+  pages: true
+
+  needs:
+    - build
+    - test
+
+  only:
+    - development
+
   script:
-    - npm run docs:build
     - mv packages/docs/dist public
+
   artifacts:
     paths:
       - public
-  only:
-    - development

README.md

@@ -101,3 +101,19 @@ We will want to use inheritance in place of IWallet, etc. A neat structure to re
 - Rename IndexedCollection to ExtMap.
 - Rename from method to fromArray.
 - Have the from method accept an object.
+
+## Troubleshooting npm audit fix issues
+
+Currently we overrides `vite` dependency for `vitepress` and `vitepress-plugin-mermaid` for not being using a safe version free of vulnerabilities.
+
+The `overrides` clause can be found in the package.json file.
+
+Running `npm audit fix` doesn't look at `overrides` clause and will install the original ones.
+
+Instead of use `npm audit fix` to try to solve vulnerabilities, try updating the version of the vulnerable package. In case npm return errors trying to perform this is recommented to:
+
+1. Delete the `node_modules` folder
+- rm -Rf node_modules/
+
+2. Delete the package-lock.json
+- rm package-lock.json

package.json

@@ -29,7 +29,8 @@
     "version:patch": "lerna version patch",
     "version:minor": "lerna version minor",
     "version:major": "lerna version major",
-    "watch": "lerna run watch --parallel"
+    "watch": "lerna run watch --parallel",
+    "publish": "lerna publish --yes --canary --preid $NPM_TAG --dist-tag $NPM_TAG"
   },
   "repository": {
     "type": "git",
@@ -55,7 +56,7 @@
     "@types/eslint__js": "^8.42.3",
     "@typescript-eslint/eslint-plugin": "^8.5.0",
     "@typescript-eslint/parser": "^8.5.0",
-    "@vitest/coverage-v8": "^2.1.6",
+    "@vitest/coverage-v8": "^3.2.4",
     "eslint": "^9.10.0",
     "eslint-config-prettier": "^8.10.0",
     "eslint-plugin-prettier": "^5.2.1",
@@ -64,6 +65,14 @@
     "prettier": "^3.3.3",
     "typescript": "5.7.2",
     "typescript-eslint": "^8.6.0",
-    "vitest": "^2.1.6"
+    "vitest": "^3.2.4"
+  },
+  "overrides": {
+    "vitepress": {
+      "vite": "^7.1.10"
+    },
+    "vitepress-plugin-mermaid": {
+      "vite": "^7.1.10"
+    }
   }
 }

packages/docs/package.json

@@ -12,7 +12,7 @@
     "preview": "npm run api && vitepress preview src"
   },
   "author": "",
-  "license": "ISC",
+  "license": "MIT",
   "dependencies": {
     "@monaco-editor/loader": "^1.5.0",
     "@xocash/primitives": "*",
@@ -20,10 +20,10 @@
     "monaco-editor": "^0.52.2"
   },
   "devDependencies": {
-    "typedoc": "^0.27.5",
+    "typedoc": "^0.28.14",
     "typedoc-plugin-markdown": "^4.3.2",
     "typedoc-vitepress-theme": "^1.1.1",
-    "vitepress": "^1.3.4",
+    "vitepress": "^1.6.4",
     "vitepress-plugin-mermaid": "^2.0.17"
   }
 }

packages/docs/src/.vitepress/config.ts

@@ -311,6 +311,13 @@ export default withMermaid(
         // Configure to use browser version of @xocash/stack
         conditions: ['browser', 'import', 'module', 'default'],
       },
+      // SSR has its own separate ssr.resolve.conditions that must be explicitly set since not follow global resolve conditions.
+      ssr: {
+        resolve: {
+          // Configure to use browser version of @xocash/stack
+          conditions: ['browser', 'import', 'module', 'default'],
+        },
+      },
     },
   }),
 );

packages/json-payment-protocol-v2/package.json

@@ -16,5 +16,5 @@
     "prepublishOnly": "npm run build"
   },
   "author": "",
-  "license": "ISC"
+  "license": "MIT"
 }

packages/primitives/package.json

@@ -20,7 +20,7 @@
     "watch": "tsc --watch"
   },
   "author": "",
-  "license": "ISC",
+  "license": "MIT",
   "gitHead": "2d550cef4b179b17110363512ee0fde54a5da79a",
   "devDependencies": {
     "rollup": "^4.45.0",

packages/stack/package.json

@@ -33,7 +33,7 @@
     "watch": "tsc --watch"
   },
   "author": "",
-  "license": "ISC",
+  "license": "MIT",
   "dependencies": {
     "@bitauth/libauth": "^3.0.0",
     "@electrum-cash/network": "^4.1.1",

packages/stack/tsconfig.json

@@ -4,7 +4,7 @@
     "outDir": "./dist",
     "rootDir": "./src",
     "baseUrl": ".",
-    "lib": ["dom", "es2021"]
+    "lib": ["dom", "es2022"]
   },
   "include": ["src/**/*"],
   "exclude": ["node_modules", "dist"]