Use Node.js v20, bump deps, add CI jobs to build and audit

.github/workflows/ci.yml

@@ -0,0 +1,87 @@
+name: CI
+on:
+  push:
+    branches:
+      - staging
+  pull_request:
+    branches:
+      - staging
+  workflow_dispatch:
+  schedule:
+    - cron: '12 0 1 * *' # At noon (UTC) on the first of the month
+
+env:
+  node_version: '20.x'
+  FORCE_COLOR: 3
+
+jobs:
+  build: # make sure build/ci work properly
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.node_version }}
+          cache: npm
+          cache-dependency-path: '**/package-lock.json'
+
+      - name: npm ci
+        run: npm ci --prefer-offline
+
+      - name: npm run package
+        run: npm run package
+
+      - name: Check for any changed files
+        run: |
+          [[ -z $(git status --untracked-files=no --porcelain) ]] || \
+            (echo "::error title=npm run package::Files in the /dist directory shouldn't have changed. You forgot to run 'npm run package'." && exit 1)
+
+  audit:
+    name: Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.node_version }}
+
+      # We don't need to install deps to audit them
+
+      - name: npm audit
+        run: npm audit --audit-level=critical
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.node_version }}
+          cache: npm
+          cache-dependency-path: '**/package-lock.json'
+
+      - name: npm ci
+        run: npm ci --prefer-offline
+
+      - name: npm lint
+        run: npm run lint
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Send Teams notification
+        uses: ./
+        with:
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.MS_TEAMS_WEBHOOK_URL }}
+        # We need to manually check the notification

.github/workflows/codeql-analysis.yml

@@ -18,12 +18,12 @@ jobs:
       security-events: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: javascript
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

action.yml

@@ -10,5 +10,5 @@ inputs:
     # https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook#create-an-incoming-webhook
     required: true
 runs:
-  using: 'node16'
+  using: 'node20'
   main: 'dist/index.js'

index.js

@@ -1,15 +1,6 @@
 const { getInput, setFailed, info } = require('@actions/core')
 const github = require('@actions/github')
 
-// Polyfill fetch for Node.js 16
-if (!global.fetch) {
-  const nodeFetch = require('node-fetch')
-  global.fetch = nodeFetch
-  global.Headers = nodeFetch.Headers
-  global.Request = nodeFetch.Request
-  global.Response = nodeFetch.Response
-}
-
 // TODO: Use GitHub's icons (primer/octicons), which will require converting and colorizing the SVGs
 function getImageUrl (status) {
   switch (status) {