Modernize Storefront SDK for v1.2

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+    - package-ecosystem: npm
+      directory: /
+      schedule:
+          interval: weekly
+          day: monday
+      open-pull-requests-limit: 5
+      groups:
+          development-dependencies:
+              dependency-type: development
+          production-dependencies:
+              dependency-type: production
+    - package-ecosystem: github-actions
+      directory: /
+      schedule:
+          interval: weekly
+          day: monday
+      open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -1,109 +1,212 @@
-name: storefront-js
+name: CI
 
 on:
     push:
-        branches: [main, dev-**]
-        tags:
-            - 'v*'
+        branches: [main, 'dev-**', 'feature/**', 'release/**']
     pull_request:
-        branches: [main, dev-**]
+        branches: [main, 'release/**']
+
+permissions:
+    contents: read
+
+concurrency:
+    group: ci-${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+env:
+    PNPM_VERSION: 9.15.4
 
 jobs:
-    build:
+    quality:
+        name: Quality and coverage
         runs-on: ubuntu-latest
+        timeout-minutes: 20
+        steps:
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+            - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+              with:
+                  version: ${{ env.PNPM_VERSION }}
+            - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+              with:
+                  node-version: 24
+                  cache: pnpm
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm run format:check
+            - run: pnpm run lint
+            - run: pnpm run typecheck
+            - run: pnpm run test:coverage
+            - name: Upload coverage report
+              if: always()
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              with:
+                  name: coverage-node-24
+                  path: coverage
+                  if-no-files-found: error
+                  retention-days: 7
 
+    runtime:
+        name: Node ${{ matrix.node }}
+        runs-on: ubuntu-latest
+        timeout-minutes: 20
+        continue-on-error: ${{ matrix.experimental }}
         strategy:
+            fail-fast: false
             matrix:
-                node-version: [18.x]
-
+                include:
+                    - node: 22
+                      experimental: false
+                    - node: 24
+                      experimental: false
+                    - node: 26
+                      experimental: true
         steps:
-            - uses: actions/checkout@v4
-
-            - name: Setup Node.js ${{ matrix.node-version }}
-              uses: actions/setup-node@v4
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+            - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+              with:
+                  version: ${{ env.PNPM_VERSION }}
+            - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+              with:
+                  node-version: ${{ matrix.node }}
+                  cache: pnpm
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm test
+            - run: pnpm run build
+            - name: Require reproducible generated artifacts
+              run: git diff --exit-code -- dist types
+            - run: pnpm run test:browser
+
+    package:
+        name: Packed artifact
+        runs-on: ubuntu-latest
+        timeout-minutes: 25
+        steps:
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+            - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
               with:
-                  node-version: ${{ matrix.node-version }}
-            - uses: actions/cache@v3
-              id: npm-cache
+                  version: ${{ env.PNPM_VERSION }}
+            - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
               with:
-                  path: ~/.pnpm-store # Replace this with the path you want to cache
-                  key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
-                  restore-keys: |
-                      ${{ runner.os }}-pnpm-
-            - name: Setup pnpm
-              uses: pnpm/action-setup@v4
+                  node-version: 24
+                  cache: pnpm
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm run build
+            - run: pnpm run test:browser
+            - run: pnpm run package:check
+            - name: Pack once
+              run: |
+                  mkdir -p artifacts
+                  pnpm pack --pack-destination artifacts
+                  pnpm run package:artifact artifacts/*.tgz
+            - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
               with:
-                  version: 9.5.0
-
-            - name: Install Dependencies
-              run: pnpm install
-
-            - name: Test
-              run: pnpm test
-              env:
-                  STOREFRONT_KEY: ${{ secrets.STOREFRONT_KEY }}
-                  FLEETBASE_KEY: ${{ secrets.FLEETBASE_KEY }}
-                  FLEETBASE_HOST: ${{ secrets.FLEETBASE_HOST }}
-
-            - name: Build
-              run: pnpm run bundle
-
-    npm_publish:
-        needs: build
+                  name: npm-package
+                  path: artifacts/*.tgz
+                  if-no-files-found: error
+                  retention-days: 7
+
+    compatibility:
+        name: ${{ matrix.manager }} consumer
+        needs: package
         runs-on: ubuntu-latest
-        if: startsWith(github.ref, 'refs/tags/')
+        timeout-minutes: 20
+        strategy:
+            fail-fast: false
+            matrix:
+                manager: [npm, pnpm, yarn, bun]
         steps:
-            - uses: actions/checkout@v4
-
-            - name: Setup Node.js 18.x
-              uses: actions/setup-node@v4
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+            - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
               with:
-                  node-version: 18.x
-
-            - name: Setup pnpm
-              uses: pnpm/action-setup@v4
+                  node-version: 24
+            - if: matrix.manager == 'pnpm'
+              uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
               with:
-                  version: 9.5.0
-
-            - name: Install Dependencies
-              run: pnpm install
-
-            - name: Build
-              run: pnpm run bundle
-
-            - name: Set up npm
-              run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_AUTH_TOKEN }}" > ~/.npmrc
-
-            - name: Publish
-              run: npm publish --access public
+                  version: ${{ env.PNPM_VERSION }}
+            - if: matrix.manager == 'yarn'
+              name: Install Yarn
+              run: |
+                  npm install --global corepack@0.34.0
+                  corepack enable
+                  corepack prepare yarn@4.9.2 --activate
+            - if: matrix.manager == 'bun'
+              uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+              with:
+                  bun-version: 1.2.22
+            - run: npm install --ignore-scripts
+            - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              with:
+                  name: npm-package
+                  path: artifacts
+            - run: node scripts/verify-packed-package.mjs ${{ matrix.manager }} artifacts/*.tgz
 
-    github_publish:
-        needs: build
+    framework-compatibility:
+        name: Framework consumers
+        needs: package
         runs-on: ubuntu-latest
-        if: startsWith(github.ref, 'refs/tags/')
+        timeout-minutes: 25
         steps:
-            - uses: actions/checkout@v4
-
-            - name: Setup Node.js 18.x
-              uses: actions/setup-node@v4
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+            - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
               with:
-                  node-version: 18.x
-
-            - name: Setup pnpm
-              uses: pnpm/action-setup@v4
+                  version: ${{ env.PNPM_VERSION }}
+            - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
               with:
-                  version: 9.5.0
-
-            - name: Install Dependencies
-              run: pnpm install
-
-            - name: Build
-              run: pnpm run bundle
+                  node-version: 24
+                  cache: pnpm
+            - run: pnpm install --frozen-lockfile
+            - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+              with:
+                  name: npm-package
+                  path: artifacts
+            - run: node scripts/verify-framework-consumers.mjs artifacts/*.tgz
 
-            - name: Configure npm for GitHub registry
-              run: |
-                  echo "@fleetbase:registry=https://npm.pkg.github.com/" >> ~/.npmrc
-                  echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" >> ~/.npmrc
+    security:
+        name: Production dependency audit
+        runs-on: ubuntu-latest
+        timeout-minutes: 10
+        steps:
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+            - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+              with:
+                  version: ${{ env.PNPM_VERSION }}
+            - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+              with:
+                  node-version: 24
+                  cache: pnpm
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm audit --prod --audit-level moderate
+
+    dependency-review:
+        name: Dependency review
+        if: github.event_name == 'pull_request'
+        runs-on: ubuntu-latest
+        timeout-minutes: 10
+        steps:
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+            - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
+              with:
+                  fail-on-severity: moderate
 
-            - name: Publish to GitHub registry
-              run: npm publish
+    mutation:
+        name: Critical mutation score
+        runs-on: ubuntu-latest
+        timeout-minutes: 30
+        steps:
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+            - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+              with:
+                  version: ${{ env.PNPM_VERSION }}
+            - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+              with:
+                  node-version: 24
+                  cache: pnpm
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm run test:mutation
+            - name: Upload mutation report
+              if: always()
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              with:
+                  name: mutation-report
+                  path: reports/mutation
+                  if-no-files-found: warn
+                  retention-days: 7

.github/workflows/live-smoke.yml

@@ -0,0 +1,35 @@
+name: Live Storefront smoke
+
+on:
+    workflow_dispatch:
+    schedule:
+        - cron: '17 3 * * 2'
+
+permissions:
+    contents: read
+
+concurrency:
+    group: live-storefront-smoke
+    cancel-in-progress: true
+
+jobs:
+    smoke:
+        name: Non-destructive API smoke
+        runs-on: ubuntu-latest
+        timeout-minutes: 10
+        environment: storefront-smoke
+        steps:
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+            - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+              with:
+                  version: 9.15.4
+            - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+              with:
+                  node-version: 24
+                  cache: pnpm
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm run build
+            - run: node scripts/live-smoke.mjs
+              env:
+                  FLEETBASE_STOREFRONT_PUBLIC_KEY: ${{ secrets.FLEETBASE_STOREFRONT_PUBLIC_KEY }}
+                  FLEETBASE_STOREFRONT_HOST: ${{ vars.FLEETBASE_STOREFRONT_HOST }}