From 29eed0571b97377e5a539079a5a06064d648ce9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Natan=20S=C4=85gol?= <m@merlinnot.com>
Date: Sun, 16 Feb 2020 21:08:16 +0100
Subject: [PATCH] ci: improve consistency and security of the release workflow
 (#1907)

---
 .github/workflows/continuous-delivery.yaml | 37 ++++++++++++++++++++++
 .github/workflows/release.yml              | 23 --------------
 2 files changed, 37 insertions(+), 23 deletions(-)
 create mode 100644 .github/workflows/continuous-delivery.yaml
 delete mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/continuous-delivery.yaml b/.github/workflows/continuous-delivery.yaml
new file mode 100644
index 000000000..0c4d1f8f1
--- /dev/null
+++ b/.github/workflows/continuous-delivery.yaml
@@ -0,0 +1,37 @@
+name: Continuous Delivery
+
+on:
+  push:
+    branches:
+      - '*.x' # maintenance releases such as 15.x
+      - beta
+      - master
+      - next
+
+jobs:
+  build:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@v1
+        with:
+          node-version: 12
+      - name: Cache npm dependencies
+        uses: actions/cache@v1
+        with:
+          key: npm-${{ hashFiles('package-lock.json') }}
+          path: ~/.npm
+          restore-keys: |
+            npm-
+      - name: Install dependencies
+        run: npm ci --ignore-scripts --no-audit --no-progress --prefer-offline
+      - env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        name: Release
+        run: npx semantic-release
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 6f7b363c1..000000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-on:
-  push:
-    branches:
-      - master
-      - next
-      - beta
-      - '*.x' # maintenance releases such as 15.x
-
-name: Release
-jobs:
-  build:
-    name: release
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@master
-      - uses: actions/setup-node@v1
-        with:
-          node-version: '12.x'
-      - run: npm ci
-      - run: npx semantic-release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}