chore: bump version [skip ci]

Reviewed-on: #2

.gitea/workflows/publish.yaml

@@ -24,6 +24,9 @@ jobs:
           git add VERSION
           git diff --cached --quiet || git commit -m "chore: bump version [skip ci]"
           version=$(cat VERSION)
+          major="${version%%.*}"
           git tag "v${version}"
+          git tag -f "v${major}"
           git push
-          git push --tags
+          git push origin "refs/tags/v${version}"
+          git push --force origin "refs/tags/v${major}"

Makefile

@@ -2,6 +2,7 @@ ACTIONS := \
 	docker \
 	node \
 	git/create_tag \
+	git/promotion-gate \
 	helm/diff \
 	helm/template \
 	helm/upgrade \

README.md

@@ -15,6 +15,7 @@ Reusable composite actions for Gitea CI/CD pipelines.
 | Action | Description |
 |---|---|
 | [git/create_tag](git/create_tag/README.md) | Create and push a git tag in the current repository |
+| [git/promotion-gate](git/promotion-gate/README.md) | Enforce which source branches may merge into which target branches |
 
 ### Helm
 

VERSION

@@ -1 +1 @@
-1.13.0
+1.22.0

git/promotion-gate/README.md

@@ -0,0 +1,21 @@
+# Promotion Gate
+
+<!-- action-docs-description source="action.yml" -->
+## Description
+
+Enforce which source branches may merge into which target branches
+<!-- action-docs-description source="action.yml" -->
+
+<!-- action-docs-inputs source="action.yml" -->
+## Inputs
+
+| name | description | required | default |
+| --- | --- | --- | --- |
+| `rules` | <p>One rule per line: "target:allowed1,allowed2,…". Targets not listed are unrestricted. Allowed entries may use a trailing glob, e.g. <code>hotfix-*</code>. Leave empty (default) to skip entirely.</p> | `false` | `""` |
+<!-- action-docs-inputs source="action.yml" -->
+
+<!-- action-docs-runs source="action.yml" -->
+## Runs
+
+This action is a `composite` action.
+<!-- action-docs-runs source="action.yml" -->

git/promotion-gate/action.yml

@@ -0,0 +1,75 @@
+name: Promotion Gate
+description: Enforce which source branches may merge into which target branches
+inputs:
+  rules:
+    description: |
+      One rule per line: "target:allowed1,allowed2,...". Targets not
+      listed are unrestricted. Allowed entries may use a trailing glob,
+      e.g. `hotfix-*`. Leave empty (default) to skip entirely.
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Check merge source is allowed for target branch
+      shell: sh
+      env:
+        BASE: ${{ gitea.event.pull_request.base.ref }}
+        HEAD: ${{ gitea.event.pull_request.head.ref }}
+        RULES: ${{ inputs.rules }}
+      run: |
+        if [ -z "$RULES" ]; then
+          echo "No promotion rules configured — skipping."
+          exit 0
+        fi
+
+        rc=0
+        found=0
+
+        oldIFS=$IFS
+        IFS='
+        '
+        set -f
+        set -- $RULES
+        set +f
+        IFS=$oldIFS
+
+        for line in "$@"; do
+          if [ -z "$line" ]; then
+            continue
+          fi
+          target=${line%%:*}
+          allowed=${line#*:}
+          if [ "$target" = "$line" ]; then
+            continue
+          fi
+          if [ "$BASE" = "$target" ]; then
+            found=1
+            matched=0
+            innerIFS=$IFS
+            IFS=','
+            for pat in $allowed; do
+              IFS=$innerIFS
+              case "$HEAD" in
+                $pat)
+                  matched=1
+                  ;;
+              esac
+              IFS=','
+            done
+            IFS=$innerIFS
+
+            if [ "$matched" -eq 1 ]; then
+              echo "Allowed: '$HEAD' -> '$BASE' (matches: $allowed)"
+            else
+              echo "::error::$BASE only accepts merges from: $allowed — got '$HEAD'"
+              rc=1
+            fi
+          fi
+        done
+
+        if [ "$found" -eq 0 ]; then
+          echo "No promotion-source restriction configured for base '$BASE'"
+        fi
+
+        exit $rc

helm/diff/action.yml

@@ -73,8 +73,3 @@ runs:
         fi
         helm dependency update "$CHART_PATH"
         helm diff upgrade "$DEPLOYMENT_NAME" "$CHART_PATH" -n "$NAMESPACE" --values "$VALUES_FILE" $SET_FLAGS --context 5
-
-    - name: Remove kubeconfig
-      if: always()
-      shell: sh
-      run: rm -f ~/.kube/config

helm/template/action.yml

@@ -68,8 +68,3 @@ runs:
         fi
         helm dependency update "$CHART_PATH"
         helm template "$DEPLOYMENT_NAME" "$CHART_PATH" -n "$NAMESPACE" --values "$VALUES_FILE" $SET_FLAGS
-
-    - name: Remove kubeconfig
-      if: always()
-      shell: sh
-      run: rm -f ~/.kube/config

infra/update_version/action.yml

@@ -38,5 +38,9 @@ runs:
         git config user.email "gitea-actions@gitea.pixelparasol.com"
         git config user.name "Gitea Actions"
         git add releases/versions.yaml
+        if git diff --cached --quiet; then
+          echo "No version change for ${{ inputs.service }}, skipping commit"
+          exit 0
+        fi
         git commit -m "chore: update ${{ inputs.service }} to ${{ inputs.tag }}"
         git push

node/README.md

@@ -18,6 +18,8 @@ Install dependencies, build, and upload a build artifact
 | `ARTIFACT_PATH` | <p>Path to upload as the artifact</p> | `false` | `dist` |
 | `COPY_PRISMA_ENGINE` | <p>Copy the Prisma query engine binaries into the build directory</p> | `false` | `false` |
 | `WORKING_DIRECTORY` | <p>Working directory for install, build, and artifact steps</p> | `false` | `.` |
+| `UPLOAD_ARTIFACT` | <p>Whether to upload the build artifact</p> | `false` | `true` |
+| `NPM_TOKEN` | <p>Auth token for the private Gitea npm registry (@stat-tackler scope). Leave empty if the repo installs no private packages.</p> | `false` | `""` |
 <!-- action-docs-inputs source="action.yml" -->
 
 <!-- action-docs-runs source="action.yml" -->

node/action.yml

@@ -22,6 +22,12 @@ inputs:
   WORKING_DIRECTORY:
     description: "Working directory for install, build, and artifact steps"
     default: "."
+  UPLOAD_ARTIFACT:
+    description: "Whether to upload the build artifact"
+    default: "true"
+  NPM_TOKEN:
+    description: "Auth token for the private Gitea npm registry (@stat-tackler scope). Leave empty if the repo installs no private packages."
+    default: ""
 
 runs:
   using: composite
@@ -33,6 +39,16 @@ runs:
       with:
         node-version-file: ${{ inputs.WORKING_DIRECTORY }}/package.json
 
+    - name: Configure private registry auth
+      if: inputs.NPM_TOKEN != ''
+      shell: sh
+      working-directory: ${{ inputs.WORKING_DIRECTORY }}
+      run: |
+        printf '%s\n%s\n' \
+          '@stat-tackler:registry=https://gitea.pixelparasol.com/api/packages/stat-tackler/npm/' \
+          '//gitea.pixelparasol.com/api/packages/stat-tackler/npm/:_authToken=${{ inputs.NPM_TOKEN }}' \
+          >> .npmrc
+
     - name: Install
       shell: sh
       working-directory: ${{ inputs.WORKING_DIRECTORY }}
@@ -56,6 +72,7 @@ runs:
         cp node_modules/.prisma/client/libquery_engine-* build/prisma/
 
     - name: Upload Build Artifact
+      if: inputs.UPLOAD_ARTIFACT != 'false'
       uses: actions/upload-artifact@v3
       with:
         name: ${{ inputs.ARTIFACT_NAME }}

test/npm/README.md

@@ -8,7 +8,9 @@ Composite action: install dependencies and run an npm test script.
 |---|---|---|
 | `INSTALL_CMD` | Install command | `npm ci` |
 | `TEST_SCRIPT` | npm script to run (must exist in `package.json`) | `test` |
+| `TEST_ARGS` | Additional arguments passed after `--` to the test script | `` |
 | `WORKING_DIRECTORY` | Directory to run commands in | `.` |
+| `NPM_TOKEN` | Auth token for the private Gitea npm registry (`@stat-tackler` scope). Leave empty if the repo installs no private packages. | `` |
 
 ## Usage
 
@@ -18,6 +20,24 @@ Composite action: install dependencies and run an npm test script.
     TEST_SCRIPT: test:unit
 ```
 
+With a private `@stat-tackler` package in `package.json`:
+
+```yaml
+- uses: stat-tackler/stat-tackler-infra/test/npm@main
+  with:
+    TEST_SCRIPT: test:unit
+    NPM_TOKEN: ${{ secrets.REGISTRY_READ_WRITE_AGENT }}
+```
+
+With extra args:
+
+```yaml
+- uses: stat-tackler/stat-tackler-infra/test/npm@main
+  with:
+    TEST_SCRIPT: test:coverage
+    TEST_ARGS: --silent --reporter=dot --test-timeout=30000
+```
+
 ### Common test scripts by project
 
 | Project | Script | Runner |

test/npm/action.yml

@@ -8,9 +8,15 @@ inputs:
   TEST_SCRIPT:
     description: "npm script to run (must exist in package.json)"
     default: "test"
+  TEST_ARGS:
+    description: "Additional arguments to pass after -- to the test script"
+    default: ""
   WORKING_DIRECTORY:
     description: "Directory to run commands in"
     default: "."
+  NPM_TOKEN:
+    description: "Auth token for the private Gitea npm registry (@stat-tackler scope). Leave empty if the repo installs no private packages."
+    default: ""
 
 runs:
   using: composite
@@ -29,6 +35,16 @@ runs:
         key: node-modules-${{ hashFiles(format('{0}/package-lock.json', inputs.WORKING_DIRECTORY)) }}
         restore-keys: node-modules-
 
+    - name: Configure private registry auth
+      if: inputs.NPM_TOKEN != ''
+      shell: sh
+      working-directory: ${{ inputs.WORKING_DIRECTORY }}
+      run: |
+        printf '%s\n%s\n' \
+          '@stat-tackler:registry=https://gitea.pixelparasol.com/api/packages/stat-tackler/npm/' \
+          '//gitea.pixelparasol.com/api/packages/stat-tackler/npm/:_authToken=${{ inputs.NPM_TOKEN }}' \
+          >> .npmrc
+
     - name: Install
       shell: sh
       working-directory: ${{ inputs.WORKING_DIRECTORY }}
@@ -37,4 +53,4 @@ runs:
     - name: Test
       shell: sh
       working-directory: ${{ inputs.WORKING_DIRECTORY }}
-      run: npm run ${{ inputs.TEST_SCRIPT }}
+      run: npm run ${{ inputs.TEST_SCRIPT }}${{ inputs.TEST_ARGS != '' && format(' -- {0}', inputs.TEST_ARGS) || '' }}