Fix GitHub Actions CI and package/site publishing

.github/labeler.yml

@@ -1,15 +1,20 @@
 data-update:
-- '_data/**'
+- changed-files:
+  - any-glob-to-any-file: '_data/**'
 
 text-update:
-- '**/*.md'
+- changed-files:
+  - any-glob-to-any-file: '**/*.md'
 
 tool-update:
-- '_tools/**'
+- changed-files:
+  - any-glob-to-any-file: '_tools/**'
 
 code-update:
-- '**/*.rb'
-- 'Gemfile'
-- 'Rakefile'
-- '_config.yml'
-- '.*'
+- changed-files:
+  - any-glob-to-any-file:
+    - '**/*.rb'
+    - 'Gemfile'
+    - 'Rakefile'
+    - '_config.yml'
+    - '.*'

.github/workflows/build-ci.yml

@@ -7,24 +7,24 @@ on:
 jobs:
   ci-test:
     name: "Root Project"
-    uses: hack-different/apple-knowledge/.github/workflows/build-test.yml@main
+    uses: ./.github/workflows/build-test.yml
 
   ci-build-jekyll:
     name: "Jekyll"
     needs: ci-test
-    uses: hack-different/apple-knowledge/.github/workflows/build-jekyll.yml@main
+    uses: ./.github/workflows/build-jekyll.yml
 
   ci-build-python:
     name: "Python"
     needs: ci-test
-    uses: hack-different/apple-knowledge/.github/workflows/build-python.yml@main
+    uses: ./.github/workflows/build-python.yml
 
   ci-build-ruby:
     name: "Ruby"
     needs: ci-test
-    uses: hack-different/apple-knowledge/.github/workflows/build-ruby.yml@main
+    uses: ./.github/workflows/build-ruby.yml
 
   ci-build-node:
     name: "Node"
     needs: ci-test
-    uses: hack-different/apple-knowledge/.github/workflows/build-node.yml@main
+    uses: ./.github/workflows/build-node.yml

.github/workflows/build-jekyll.yml

@@ -15,18 +15,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install OS Packages
+        run: sudo apt-get update && sudo apt-get install -y libidn-dev cmake
 
-      - name: Cache Ruby Gems and Bundle
-        id: cache-gems
-        uses: actions/cache@v4
+      - uses: actions/checkout@v5
         with:
-          path: vendor/bundle
-          key: ${{ runner.os }}-build-ruby-${{ hashFiles('Gemfile.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-build-ruby-
+          fetch-depth: ${{ inputs.fetch-depth }}
 
       - name: Setup Ruby 4.0.5
         uses: ruby/setup-ruby@v1
@@ -36,9 +30,13 @@ jobs:
 
       - name: Build Jekyll Site
         run: bundle exec jekyll build
+        env:
+          JEKYLL_ENV: production
+          JEKYLL_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Archive Site Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: data-ci-site
           path: _site
+          include-hidden-files: true

.github/workflows/build-node.yml

@@ -19,44 +19,41 @@ jobs:
       matrix:
         node-version: ["22", "24"]
 
+    defaults:
+      run:
+        working-directory: ./_packages/node
+
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
         with:
           fetch-depth: ${{ inputs.fetch-depth }}
 
       - uses: oven-sh/setup-bun@v2
 
-      - name: Cache Node Packages
-        id: cache-node
-        uses: actions/cache@v4
+      - uses: actions/setup-node@v5
         with:
-          path:  _packages/node/node_modules
-          key: ${{ runner.os }}-build-ci-node-yarn-${{ matrix.node-version }}-${{ hashFiles('_packages/node/yarn.lock') }}
+          node-version: ${{ matrix.node-version }}
 
-      - uses: actions/setup-node@v3
+      - name: Cache Node Packages
+        uses: actions/cache@v5
         with:
-          node-version: ${{ matrix.node-version }}
-          cache-dependency-path: _packages/node/yarn.lock
-          registry-url: https://registry.npmjs.org/
+          path: _packages/node/node_modules
+          key: ${{ runner.os }}-build-ci-node-${{ matrix.node-version }}-${{ hashFiles('_packages/node/bun.lock') }}
 
       - name: Install dependencies
-        working-directory: ./_packages/node
         run: bun install
 
       - name: Perform a Build
-        working-directory: ./_packages/node
         run: bun run build
 
       - name: Run Package Tests
-        working-directory: ./_packages/node
         run: bun run test
 
       - name: Package Node Artifact
-        working-directory: ./_packages/node
         run: bun pm pack
 
       - name: Archive Node Package Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: package-node-${{ matrix.node-version }}
-          path: _packages/node/*.tgz
+          path: _packages/node/*.tgz

.github/workflows/build-python.yml

@@ -23,12 +23,13 @@ jobs:
         python-version: ["3.10", "3.11", "3.12"]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
         with:
           fetch-depth: ${{ inputs.fetch-depth }}
 
-      - name: Set up Python with Poetry Caching
-        uses: actions/setup-python@v4
+      - name: Set up Python
+        id: setup-python
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -40,15 +41,11 @@ jobs:
 
       - name: Load cached venv
         id: cached-poetry-dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ./_packages/python/.venv
           key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('_packages/python/poetry.lock') }}
 
-      - name: Install dependencies
-        if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
-        run: poetry install --no-interaction --no-root
-
       - name: Update Version String
         run: python ./update_version.py
 
@@ -62,4 +59,10 @@ jobs:
         run: poetry run pytest
 
       - name: Build package
-        run: poetry build
+        run: poetry build
+
+      - name: Archive Python Package Artifacts
+        uses: actions/upload-artifact@v5
+        with:
+          name: package-python-${{ matrix.python-version }}
+          path: _packages/python/dist/*

.github/workflows/build-ruby.yml

@@ -24,17 +24,10 @@ jobs:
         working-directory: ./_packages/ruby
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
         with:
           fetch-depth: ${{ inputs.fetch-depth }}
 
-      - name: Cache Ruby Gems and Bundle
-        id: cache-gems
-        uses: actions/cache@v4
-        with:
-          path: _packages/ruby/vendor/bundle
-          key: ${{ runner.os }}-build-ci-ruby-${{ matrix.ruby-version }}-gem-${{ hashFiles('_packages/ruby/Gemfile.lock') }}
-
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -52,7 +45,7 @@ jobs:
         run: gem build *.gemspec
 
       - name: Archive Gem Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: package-gem-${{ matrix.ruby-version }}
-          path: _packages/ruby/*.gem
+          path: _packages/ruby/*.gem

.github/workflows/build-test.yml

@@ -16,20 +16,13 @@ jobs:
 
     steps:
       - name: Install OS Packages
-        run: sudo apt-get install -y libidn-dev
+        run: sudo apt-get update && sudo apt-get install -y libidn-dev cmake
 
       - name: Checkout Repository with History
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: ${{ inputs.fetch-depth }}
 
-      - name: Cache Ruby Gems and Bundle
-        id: cache-gems
-        uses: actions/cache@v4
-        with:
-          path: vendor/bundle
-          key: ${{ runner.os }}-build-ci-ruby-${{ hashFiles('Gemfile.lock') }}
-
       - name: Setup Ruby 4.0.5
         uses: ruby/setup-ruby@v1
         with:
@@ -40,7 +33,7 @@ jobs:
         run: bundle exec rake
 
       - name: Archive Data Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: data-artifacts
           path: _data

.github/workflows/label.yml

@@ -11,6 +11,6 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/labeler@v2
+    - uses: actions/labeler@v5
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/publish-gem.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   ci-build-ruby:
-    uses: hack-different/apple-knowledge/.github/workflows/build-ruby.yml@main
+    uses: ./.github/workflows/build-ruby.yml
 
   publish-gem:
     name: Publish to RubyGems
@@ -15,25 +15,19 @@ jobs:
     environment: gem-push
     permissions:
       contents: read
-      packages: write
 
     steps:
       - name: Setup Ruby 4.0.5
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: 4.0.5
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         name: Download Ruby Package Artifacts
         with:
           name: package-gem-4.0
 
       - name: Publish to RubyGems
         env:
           GEM_HOST_API_KEY: "${{secrets.RUBYGEMS_AUTH_TOKEN}}"
-        run: |
-          mkdir -p $HOME/.gem
-          touch $HOME/.gem/credentials
-          chmod 0600 $HOME/.gem/credentials
-          printf -- "---\n:rubygems_api_key: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
-          gem push *.gem
+        run: gem push *.gem

.github/workflows/publish-npm.yml

@@ -1,6 +1,3 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
-
 name: Publish Package - Node / NPM
 
 on:
@@ -9,39 +6,32 @@ on:
 
 jobs:
   ci-build-node:
-    uses: hack-different/apple-knowledge/.github/workflows/build-node.yml@main
+    uses: ./.github/workflows/build-node.yml
 
   publish-npm:
     name: Publish to NPM
     runs-on: ubuntu-latest
     needs: ci-build-node
     environment: node-push
+    permissions:
+      contents: read
+      # Required for npm trusted publishing (OIDC) and provenance
+      id-token: write
 
     steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Cache Node Packages
-        id: cache-node
-        uses: actions/cache@v4
-        with:
-          path:  _packages/node/node_modules
-          key: ${{ runner.os }}-publish-npm-${{ hashFiles('_packages/node/yarn.lock') }}
-
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v5
         with:
           node-version: 24
-          cache: bun
           registry-url: https://registry.npmjs.org/
 
       - name: Download Node Package Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: package-node-24
-          path:  _packages/node/dist/
+          path: dist
 
       - name: Publish to NPM Registry
-        run: yarn publish  _packages/node/
+        # Uses npm trusted publishing (OIDC) when configured on npmjs.com, otherwise falls back to NPM_TOKEN
+        run: npm publish dist/*.tgz --access public --provenance
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}