pipery-dev/Pipery npm CI

CI pipeline for npm/Node.js: SAST, SCA, lint, build, test, versioning, packaging, publish, optional Docker image release, reintegration

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit May 28, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: pipery-dev/npm-ci@3748415316749b5cb71606027bd871c696d23021 # v1.1.2

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
project_path	Path to the project source tree the action should operate on.	no	.
config_file	Path to pipery config file.	no	.pipery/config.yaml
node_version	Node.js version to use.	no	20
package_manager	Package manager: auto, npm, yarn.	no	auto
skip_sast	Skip SAST scan.	no	false
skip_sca	Skip SCA scan.	no	false
skip_lint	Skip lint step.	no	false
strict_lint	Fail the action when lint reports errors.	no	false
skip_build	Skip build step.	no	false
tests_path	Path or glob passed to the test runner as an argument.	no	""
skip_test	Skip test step.	no	false
skip_versioning	Skip versioning step.	no	false
skip_packaging	Skip packaging step.	no	false
skip_release	Skip npm release step.	no	false
release_docker_image	Build and push a Docker image for the application after npm packaging/release.	no	false
docker_registry	Docker registry host used for login and image prefix.	no	ghcr.io
docker_image	Docker image name without tag. Defaults to the GitHub repository when available.	no	""
docker_tags	Comma, space, or newline separated Docker tags. Defaults to package version and sha-<short sha> when available.	no	""
docker_context	Docker build context, relative to project_path unless absolute.	no	.
dockerfile	Dockerfile path, relative to project_path unless absolute.	no	Dockerfile
docker_platforms	Comma separated Docker target platforms for buildx, e.g. linux/amd64,linux/arm64. Empty uses a regular Docker build for the runner platform.	no	""
docker_username	Docker registry username. For ghcr.io this is usually the GitHub actor.	no	""
docker_password	Docker registry password or token.	no	""
docker_push_latest	Also tag and push latest.	no	false
skip_reintegration	Skip reintegration step.	no	false
version_bump	Version bump kind: patch, minor, major.	no	patch
npm_token	npm registry auth token for publishing.	no	""
github_token	GitHub token for reintegration.	no	""
log_file	Path to the JSONL log file.	no	pipery.jsonl
registry	npm registry target for release.	no	npmjs

Outputs

no outputs