ci: switch to GHA (#337)

.github/workflows/release.yml

@@ -0,0 +1,35 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yml
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    needs: test
+    environment: npm
+    permissions:
+      id-token: write # for CFA and npm provenance
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: 20.x
+          cache: 'yarn'
+      - name: Install
+        run: yarn install --frozen-lockfile
+      - uses: continuousauth/action@4e8a2573eeb706f6d7300d6a9f3ca6322740b72d # v1.0.5
+        with:
+          project-id: ${{ secrets.CFA_PROJECT_ID }}
+          secret: ${{ secrets.CFA_SECRET }}
+          npm-token: ${{ secrets.NPM_TOKEN }}

.github/workflows/test.yml

@@ -0,0 +1,37 @@
+name: Test
+
+on:
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: '0 22 * * 3'
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test
+    strategy:
+      matrix:
+        node-version:
+          - '20.9'
+          - '18.17'
+          - '16.20'
+    runs-on: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Setup Node.js
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: "${{ matrix.node-version }}"
+          cache: 'yarn'
+      - name: Install
+        run: yarn install --frozen-lockfile
+      - name: Test
+        run: ./test/ci/generate-identity.sh
+      - name: Test
+        run: yarn build && yarn test

README.md

@@ -1,4 +1,4 @@
-# @electron/osx-sign [![npm][npm_img]][npm_url] [![Build Status][circleci_img]][circleci_url]
+# @electron/osx-sign [![npm][npm_img]][npm_url] [![Test][gha_img]][gha_url]
 
 Codesign Electron macOS apps
 
@@ -278,5 +278,5 @@ ok 10 app signed
 [electron-osx-sign]: https://github.com/electron/osx-sign
 [npm_img]: https://img.shields.io/npm/v/@electron/osx-sign.svg
 [npm_url]: https://npmjs.org/package/@electron/osx-sign
-[circleci_img]: https://img.shields.io/circleci/build/github/electron/osx-sign
-[circleci_url]: https://circleci.com/gh/electron/osx-sign
+[gha_img]: https://github.com/electron/symbolicate-mac/actions/workflows/test.yml/badge.svg
+[gha_url]: https://github.com/electron/symbolicate-mac/actions/workflows/test.yml

package.json

@@ -21,6 +21,9 @@
   },
   "author": "electron",
   "license": "BSD-2-Clause",
+  "publishConfig": {
+    "provenance": true
+  },
   "bugs": {
     "url": "https://github.com/electron/osx-sign/issues"
   },