feat(ubuntu-ci): add gh-cli (#3)

.github/workflows/assign-pr-author.yaml

@@ -5,6 +5,9 @@ jobs:
   assign-pr-author:
     runs-on: ubuntu-latest
 
+    permissions:
+      pull-requests: write
+
     steps:
       - uses: samspills/[email protected]
         if: github.event_name == 'pull_request' && github.event.action == 'opened'

.github/workflows/check-pr.yaml

@@ -13,7 +13,6 @@ jobs:
 
     permissions:
       contents: read
-      pull-requests: write
 
     container:
       image: ghcr.io/${{ github.repository_owner }}/ubuntu-ci:jammy-0.1.0
@@ -43,6 +42,6 @@ jobs:
         run: |
           task images:configure-builder
 
-      - name: Build images
+      - name: Run tests
         run: |
           task test

Taskfile.yaml

@@ -19,6 +19,11 @@ tasks:
     cmds:
       - "{{.NENV}}/.bin/prettier {{.COMMAND}}"
 
+  _with_nvm:
+    internal: true
+    cmds:
+      - "source ${HOME}/.nvm/nvm.sh && nvm use && {{.COMMAND}}"
+
   _dockerfilelint:
     internal: true
     cmds:
@@ -28,13 +33,16 @@ tasks:
     desc: Initialize project environment
     cmds:
       - echo 'Installing node version...'
-      - . ${HOME}/.nvm/nvm.sh && nvm install
+      - task: _with_nvm
+        vars: { COMMAND: "nvm install" }
 
       - echo 'Installing node dependencies...'
-      - npm install
+      - task: _with_nvm
+        vars: { COMMAND: "npm install" }
 
       - echo 'Installing husky pre-commit...'
-      - npm run prepare-husky
+      - task: _with_nvm
+        vars: { COMMAND: "npm run prepare-husky" }
 
   lint:
     desc: Lint project
@@ -72,6 +80,17 @@ tasks:
       - echo 'Cleaning node dependencies...'
       - rm -rf {{.NENV}}
 
+  update-dependencies:
+    desc: Update dependencies
+    cmds:
+      - echo 'Updating node dependencies...'
+      - task: _with_nvm
+        vars: { COMMAND: "npm update" }
+      - task: _with_nvm
+        vars: { COMMAND: "npm outdated" }
+      - task: _with_nvm
+        vars: { COMMAND: "npm audit" }
+
   login-gh-cli:
     desc: Login to GitHub CLI
     cmds:
@@ -99,8 +118,8 @@ tasks:
   ci-login-ghcr:
     desc: Login to GitHub Container Registry in CI
     requires:
-      vars:
+      env:
         - GITHUB_TOKEN
     cmds:
       - echo 'Logging to GitHub Container Registry...'
-      - echo {{.GITHUB_TOKEN}} | docker login ghcr.io -u USERNAME --password-stdin
+      - echo "${GITHUB_TOKEN}" | docker login ghcr.io -u USERNAME --password-stdin

src/ubuntu-ci/jammy/scripts/103-trivy.sh

@@ -2,7 +2,7 @@
 set -eu
 export DEBIAN_FRONTEND=noninteractive
 
-echo 'Installing native libs...'
+echo 'Installing trivy...'
 
 apt-get install --yes \
     apt-transport-https \

src/ubuntu-ci/jammy/scripts/104-github-cli.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -eu
+export DEBIAN_FRONTEND=noninteractive
+
+echo 'Installing GitHub CLI...'
+
+apt-get install --yes \
+    curl
+
+curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | \
+    dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
+echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] \
+    https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+
+apt-get update
+apt-get install --yes \
+    gh