Knip configuration for keygen (#5)

* chore: knip configuration for keygen

Set correct entry points in knip.ts for keygen repository to find all dependencies

* chore: run knip on pull_request_target and workflow_dispatch

Sync with ubiquibot-kernel settings.

* chore: switch knip workflow from pull_request_target to pull request

* chore: remove workflow_dispatch, restrict write permissions to checks and issues for knip workflow

* chore: switch knip workflow to workflow_run

* chore: remove download artifact step in knip workflow

* chore: use secure pull_request knip workflow

Knip workflow uses pull_request. If Knip result fails, Knip-reporter
workflow is triggered which updates Knip report directly in the pull
request summary and inline comments.

.github/workflows/knip-reporter.yml

@@ -0,0 +1,49 @@
+name: Knip-reporter
+
+on:
+  workflow_run:
+    workflows: ["Knip"]
+    types:
+      - completed
+
+jobs:
+  knip-reporter:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.10.0
+
+      - name: Install toolchain
+        run: yarn install
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: knip-results
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Read pr number
+        id: pr-number
+        uses: juliangruber/read-file-action@v1
+        with:
+          path: ./pr-number.txt
+          trim: true
+
+      - name: Report knip results to pull request
+        if: ${{ github.event.workflow_run.conclusion != 'success' }}
+        uses: gitcoindev/knip-reporter@main
+        with:
+          verbose: true
+          comment_id: ${{ github.workflow }}-reporter
+          command_script_name: knip-ci
+          annotations: true
+          ignore_results: false
+          json_input: true
+          json_input_file_name: knip-results.json
+          pull_request_number: ${{ steps.pr-number.outputs.content }}
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/knip.yml

@@ -3,8 +3,6 @@ name: Knip
 on:
   pull_request:
 
-permissions: write-all
-
 jobs:
   run-knip:
     runs-on: ubuntu-latest
@@ -20,11 +18,17 @@ jobs:
       - name: Install toolchain
         run: yarn install
 
-      - name: Report knip results to pull request
-        uses: Codex-/knip-reporter@v2
+      - name: Store PR number
+        run: echo ${{ github.event.number }} > pr-number.txt
+
+      - name: Run Knip
+        run: yarn knip || yarn -s knip --reporter json > knip-results.json
+
+      - name: Upload knip result
+        if: failure()
+        uses: actions/upload-artifact@v4
         with:
-          verbose: true
-          comment_id: ${{ github.workflow }}-reporter
-          command_script_name: knip-ci
-          annotations: true
-          ignore_results: false
+          name: knip-results
+          path: |
+            knip-results.json
+            pr-number.txt

knip.ts

@@ -1,9 +1,8 @@
 import type { KnipConfig } from "knip";
 
 const config: KnipConfig = {
-  entry: ["build/index.ts"],
-  project: ["src/**/*.ts"],
-  ignore: ["src/types/config.ts"],
+  entry: ["static/scripts/key-generator/keygen.ts"],
+  project: ["static/**/*.ts"],
   ignoreExportsUsedInFile: true,
   ignoreDependencies: ["libsodium-wrappers", "eslint-config-prettier", "eslint-plugin-prettier"],
 };