chore: add license headers and CI

.github/workflows/npm_publish_bq_scripts.yml

@@ -14,9 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     name: publish_if_newer_version
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
       - name: NPM install

.github/workflows/readmes-updated.yml

@@ -20,17 +20,20 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          persist-credentials: false
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7
         with:
           node-version: 22
           cache: "npm"
@@ -44,7 +47,7 @@ jobs:
           echo "::set-output name=dir::$(npm config get prefix)"
 
       - name: Cache global dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: ${{ steps.global-deps-setup.outputs.dir }}
           key:
@@ -54,8 +57,10 @@ jobs:
             ${{ runner.os }}-npm-global-deps-v1-
 
       - name: Install Firebase and Lerna
+        env:
+          GLOBAL_DEPS_DIR: ${{ steps.global-deps-setup.outputs.dir }}
         run: |
-          echo "${{ steps.global-deps-setup.outputs.dir }}/bin" >> $GITHUB_PATH
+          echo "$GLOBAL_DEPS_DIR/bin" >> $GITHUB_PATH
           npm install -g firebase-tools lerna
 
       - name: Install local dependencies

.github/workflows/release-kit.yaml

@@ -0,0 +1,265 @@
+name: Release Kit
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_kit:
+        description: "Kit / Package to publish"
+        required: true
+        type: choice
+        options:
+          - "kits/bigquery-firestore-export"
+          - "kits/delete-user-data"
+          - "kits/firestore-bigquery-export"
+          - "kits/firestore-bundle-builder"
+          - "kits/firestore-counter"
+          - "kits/firestore-genai-chatbot"
+          - "kits/firestore-incremental-capture"
+          - "kits/firestore-send-email"
+          - "kits/firestore-translate-text"
+          - "kits/firestore-vector-search"
+          - "kits/rtdb-limit-child-nodes"
+          - "kits/speech-to-text"
+          - "kits/storage-resize-images"
+      bump_level:
+        description: "Version Bump Level"
+        required: true
+        default: "patch"
+        type: choice
+        options:
+          - "patch"
+          - "minor"
+          - "major"
+      is_prerelease:
+        description: "Publish as Release Candidate (RC)"
+        required: true
+        default: true
+        type: boolean
+      dry_run:
+        description: "Dry run (validate without pushing/publishing)"
+        required: true
+        default: true
+        type: boolean
+
+jobs:
+  # =========================================================
+  # 1. TEST JOB (Low Permissions: Read-Only)
+  # =========================================================
+  test:
+    name: Run Tests
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # zizmor: ignore[artipacked]
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "24"
+
+      - name: Install Dependencies & Run Tests
+        working-directory: ${{ inputs.target_kit }}
+        run: |
+          npm ci
+          npm test
+
+  # =========================================================
+  # 2. RELEASE JOB (Elevated Permissions: Write)
+  # =========================================================
+  release:
+    name: Version, Publish & Tag Release
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # Needed to push version commit, git tag & create GitHub Release
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # zizmor: ignore[artipacked]
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "24"
+          registry-url: "https://wombat-dressing-room.appspot.com"
+          always-auth: false
+
+      - name: Configure Git User
+        if: ${{ !inputs.dry_run }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Read & Validate CHANGELOG.md
+        id: changelog
+        working-directory: ${{ inputs.target_kit }}
+        run: |
+          CHANGELOG_FILE="CHANGELOG.md"
+
+          if [ ! -f "$CHANGELOG_FILE" ]; then
+            echo "::error file=${{ inputs.target_kit }}/CHANGELOG.md::CHANGELOG.md is missing! Releasing requires a CHANGELOG.md file."
+            exit 1
+          fi
+
+          NOTES=$(cat "$CHANGELOG_FILE")
+
+          if [ -z "$(echo "$NOTES" | tr -d '[:space:]')" ]; then
+            echo "::error file=${{ inputs.target_kit }}/CHANGELOG.md::CHANGELOG.md is empty! Please populate it with release notes before publishing."
+            exit 1
+          fi
+
+          # Output notes via multiline heredoc
+          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+          echo "notes<<$EOF" >> $GITHUB_OUTPUT
+          echo "$NOTES" >> $GITHUB_OUTPUT
+          echo "$EOF" >> $GITHUB_OUTPUT
+
+      - name: Determine Version Bump Type
+        id: config
+        working-directory: ${{ inputs.target_kit }}
+        env:
+          BUMP_LEVEL: ${{ inputs.bump_level }}
+          IS_PRERELEASE: ${{ inputs.is_prerelease }}
+        run: |
+          CURRENT_VER=$(node -p "require('./package.json').version")
+          BUMP="$BUMP_LEVEL"
+
+          if [ "$IS_PRERELEASE" = "true" ]; then
+            if [[ "$CURRENT_VER" =~ -rc\.[0-9]+$ ]]; then
+              BUMP_TYPE="prerelease"
+            else
+              BUMP_TYPE="pre${BUMP}"
+            fi
+            TARGET_TAG="next"
+          else
+            BUMP_TYPE="$BUMP"
+            TARGET_TAG="latest (and next)"
+          fi
+
+          echo "current_ver=$CURRENT_VER" >> $GITHUB_OUTPUT
+          echo "bump_type=$BUMP_TYPE" >> $GITHUB_OUTPUT
+          echo "target_tag=$TARGET_TAG" >> $GITHUB_OUTPUT
+
+      - name: Install Dependencies & Build
+        working-directory: ${{ inputs.target_kit }}
+        run: |
+          npm ci --registry=https://registry.npmjs.org
+          npm run build
+
+      - name: Bump Version (Clear CHANGELOG on Stable Release Only)
+        id: versioning
+        working-directory: ${{ inputs.target_kit }}
+        env:
+          BUMP_TYPE: ${{ steps.config.outputs.bump_type }}
+          IS_PRERELEASE: ${{ inputs.is_prerelease }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          if [ "$DRY_RUN" = "true" ]; then
+            npm version $BUMP_TYPE --preid=rc --no-git-tag-version
+          else
+            # Only truncate CHANGELOG.md if this is a STABLE release (not a prerelease)
+            if [ "$IS_PRERELEASE" != "true" ]; then
+              echo "Stable release detected: clearing CHANGELOG.md..."
+              > CHANGELOG.md
+              git add CHANGELOG.md
+            else
+              echo "Prerelease detected: preserving CHANGELOG.md content."
+            fi
+
+            # Create version bump commit and git tag
+            if [[ "$BUMP_TYPE" == pre* ]] || [[ "$BUMP_TYPE" == "prerelease" ]]; then
+              npm version $BUMP_TYPE --preid=rc -m "chore(release): %s [skip ci]"
+            else
+              npm version $BUMP_TYPE -m "chore(release): %s [skip ci]"
+            fi
+          fi
+
+          NEW_VER=$(node -p "require('./package.json').version")
+          PKG_NAME=$(node -p "require('./package.json').name")
+
+          echo "version=$NEW_VER" >> $GITHUB_OUTPUT
+          echo "pkg_name=$PKG_NAME" >> $GITHUB_OUTPUT
+          echo "tag_name=${PKG_NAME}@${NEW_VER}" >> $GITHUB_OUTPUT
+
+      - name: Dry Run Summary
+        if: ${{ inputs.dry_run }}
+        env:
+          PKG_NAME: ${{ steps.versioning.outputs.pkg_name }}
+          TARGET_KIT: ${{ inputs.target_kit }}
+          CURRENT_VER: ${{ steps.config.outputs.current_ver }}
+          VERSION: ${{ steps.versioning.outputs.version }}
+          BUMP_TYPE: ${{ steps.config.outputs.bump_type }}
+          TARGET_TAG: ${{ steps.config.outputs.target_tag }}
+          IS_PRERELEASE: ${{ inputs.is_prerelease }}
+          TAG_NAME: ${{ steps.versioning.outputs.tag_name }}
+          NOTES: ${{ steps.changelog.outputs.notes }}
+        run: |
+          echo "=========================================================="
+          echo "                 DRY RUN SUMMARY                          "
+          echo "=========================================================="
+          echo " Package Name:     $PKG_NAME"
+          echo " Target Directory: $TARGET_KIT"
+          echo " Current Version:  $CURRENT_VER"
+          echo " Target Version:   $VERSION"
+          echo " Version Bump:     $BUMP_TYPE"
+          echo " NPM Dist-Tag:     $TARGET_TAG"
+          echo " Release Type:     $( [ "$IS_PRERELEASE" = "true" ] && echo "Release Candidate (RC)" || echo "Stable Release" )"
+          echo " Git Tag Name:     $TAG_NAME"
+          echo " CHANGELOG State:  $( [ "$IS_PRERELEASE" = "true" ] && echo "Preserved" || echo "Will be cleared on publish" )"
+          echo "----------------------------------------------------------"
+          echo " Release Notes from CHANGELOG.md:"
+          echo "$NOTES"
+          echo "=========================================================="
+
+      - name: Push Version Commit & Tags to Branch
+        if: ${{ !inputs.dry_run }}
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git push origin "$REF_NAME" --follow-tags
+
+      - name: Publish to NPM
+        # zizmor: ignore[use-trusted-publishing]
+        working-directory: ${{ inputs.target_kit }}
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          IS_PRERELEASE: ${{ inputs.is_prerelease }}
+          DRY_RUN: ${{ inputs.dry_run }}
+          PKG_NAME: ${{ steps.versioning.outputs.pkg_name }}
+          VERSION: ${{ steps.versioning.outputs.version }}
+        run: |
+          DRY_RUN_FLAG=""
+          if [ "$DRY_RUN" = "true" ]; then
+            DRY_RUN_FLAG="--dry-run"
+            echo "Executing npm publish with --dry-run..."
+          fi
+
+          if [ "$IS_PRERELEASE" = "true" ]; then
+            npm publish --tag next --access public $DRY_RUN_FLAG
+          else
+            npm publish --tag latest --access public $DRY_RUN_FLAG
+            if [ "$DRY_RUN" != "true" ]; then
+              npm dist-tag add ${PKG_NAME}@${VERSION} next
+            fi
+          fi
+
+      - name: Create GitHub Release via GitHub CLI
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ steps.versioning.outputs.tag_name }}
+          PKG_NAME: ${{ steps.versioning.outputs.pkg_name }}
+          VERSION: ${{ steps.versioning.outputs.version }}
+          IS_PRERELEASE: ${{ inputs.is_prerelease }}
+          NOTES: ${{ steps.changelog.outputs.notes }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          PRERELEASE_FLAG=""
+          if [ "$IS_PRERELEASE" = "true" ]; then
+            PRERELEASE_FLAG="--prerelease"
+          fi
+
+          gh release create "$TAG_NAME" \
+            --title "$PKG_NAME v$VERSION" \
+            --notes "$NOTES" \
+            --target "$REF_NAME" \
+            $PRERELEASE_FLAG

.github/workflows/release.yml

@@ -9,8 +9,12 @@ jobs:
   release:
     name: "Create Releases"
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+        with:
+          persist-credentials: false
       - name: Release Script
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -9,14 +9,18 @@ on:
 jobs:
   nodejs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         node: ["22"]
     name: node.js_${{ matrix.node }}_test
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+        with:
+          persist-credentials: false
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"
@@ -26,7 +30,7 @@ jobs:
       - name: Build emulator functions
         run: cd _emulator/functions && npm i && npm run build & cd ../..
       - name: Install Firebase CLI
-        uses: nick-invision/retry@v1
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08
         with:
           timeout_minutes: 10
           retry_wait_seconds: 60