chore: update dev dependencies and workflow

.eslintrc.json

@@ -0,0 +1,21 @@
+{
+  "env": {
+    "node": true,
+    "es2021": true,
+    "jest/globals": true
+  },
+  "extends": [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/recommended",
+    "plugin:jest/recommended"
+  ],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": "latest",
+    "sourceType": "module"
+  },
+  "plugins": [
+    "@typescript-eslint",
+    "jest"
+  ]
+}

__tests__/context.test.ts

@@ -1,21 +1,27 @@
+import {beforeEach, describe, expect, it, jest} from '@jest/globals';
 import * as os from 'os';
 import * as context from '../src/context';
 
 describe('setOutput', () => {
   beforeEach(() => {
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
     process.stdout.write = jest.fn();
   });
 
+  // eslint-disable-next-line jest/expect-expect
   it('setOutput produces the correct command', () => {
     context.setOutput('some output', 'some value');
     assertWriteCalls([`::set-output name=some output::some value${os.EOL}`]);
   });
 
+  // eslint-disable-next-line jest/expect-expect
   it('setOutput handles bools', () => {
     context.setOutput('some output', false);
     assertWriteCalls([`::set-output name=some output::false${os.EOL}`]);
   });
 
+  // eslint-disable-next-line jest/expect-expect
   it('setOutput handles numbers', () => {
     context.setOutput('some output', 1.01);
     assertWriteCalls([`::set-output name=some output::1.01${os.EOL}`]);

__tests__/gpg.test.ts

@@ -1,3 +1,4 @@
+import {describe, expect, it} from '@jest/globals';
 import * as fs from 'fs';
 import * as gpg from '../src/gpg';
 import {parseKeygripFromGpgColonsOutput} from '../src/gpg';
@@ -71,12 +72,14 @@ describe('getDirs', () => {
 });
 
 describe('configureAgent', () => {
+  // eslint-disable-next-line jest/expect-expect
   it('configures GnuPG agent', async () => {
     await gpg.configureAgent(gpg.agentConfig);
   });
 });
 
-for (let userInfo of userInfos) {
+for (const userInfo of userInfos) {
+  // eslint-disable-next-line jest/valid-title
   describe(userInfo.key, () => {
     describe('importKey', () => {
       it('imports key (as armored string) to GnuPG', async () => {
@@ -109,7 +112,7 @@ for (let userInfo of userInfos) {
     describe('getKeygrip', () => {
       it('returns the keygrip for a given fingerprint', async () => {
         await gpg.importKey(userInfo.pgp);
-        for (let [i, fingerprint] of userInfo.fingerprints.entries()) {
+        for (const [i, fingerprint] of userInfo.fingerprints.entries()) {
           await gpg.getKeygrip(fingerprint).then(keygrip => {
             console.log(`Fingerprint: ${fingerprint}; Index: ${i}; Keygrip: ${keygrip}`);
             expect(keygrip.length).toEqual(userInfo.keygrips[i].length);
@@ -123,7 +126,7 @@ for (let userInfo of userInfos) {
       it('presets passphrase', async () => {
         await gpg.importKey(userInfo.pgp);
         await gpg.configureAgent(gpg.agentConfig);
-        for (let keygrip of await gpg.getKeygrips(userInfo.fingerprint)) {
+        for (const keygrip of await gpg.getKeygrips(userInfo.fingerprint)) {
           await gpg.presetPassphrase(keygrip, userInfo.passphrase).then(output => {
             console.log(output);
             expect(output).not.toEqual('');
@@ -133,6 +136,7 @@ for (let userInfo of userInfos) {
     });
 
     describe('deleteKey', () => {
+      // eslint-disable-next-line jest/expect-expect
       it('removes key from GnuPG', async () => {
         await gpg.importKey(userInfo.pgp);
         await gpg.deleteKey(userInfo.primary_key_fingerprint);
@@ -142,6 +146,7 @@ for (let userInfo of userInfos) {
 }
 
 describe('killAgent', () => {
+  // eslint-disable-next-line jest/expect-expect
   it('kills GnuPG agent', async () => {
     await gpg.killAgent();
   });

__tests__/openpgp.test.ts

@@ -1,3 +1,4 @@
+import {describe, expect, it} from '@jest/globals';
 import * as fs from 'fs';
 import * as openpgp from '../src/openpgp';
 
@@ -44,7 +45,8 @@ const userInfos = [
   }
 ];
 
-for (let userInfo of userInfos) {
+for (const userInfo of userInfos) {
+  // eslint-disable-next-line jest/valid-title
   describe(userInfo.key, () => {
     describe('readPrivateKey', () => {
       it('returns a PGP private key from an armored string', async () => {

dev.Dockerfile

@@ -0,0 +1,71 @@
+# syntax=docker/dockerfile:1.4
+
+ARG NODE_VERSION=12
+
+FROM node:${NODE_VERSION}-alpine AS base
+RUN apk add --no-cache cpio findutils git
+WORKDIR /src
+
+FROM base AS deps
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn install && mkdir /vendor && cp yarn.lock /vendor
+
+FROM scratch AS vendor-update
+COPY --from=deps /vendor /
+
+FROM deps AS vendor-validate
+RUN --mount=type=bind,target=.,rw <<EOT
+set -e
+git add -A
+cp -rf /vendor/* .
+if [ -n "$(git status --porcelain -- yarn.lock)" ]; then
+  echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor-update"'
+  git status --porcelain -- yarn.lock
+  exit 1
+fi
+EOT
+
+FROM deps AS build
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn run build && mkdir /out && cp -Rf dist /out/
+
+FROM scratch AS build-update
+COPY --from=build /out /
+
+FROM build AS build-validate
+RUN --mount=type=bind,target=.,rw <<EOT
+set -e
+git add -A
+cp -rf /out/* .
+if [ -n "$(git status --porcelain -- dist)" ]; then
+  echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'
+  git status --porcelain -- dist
+  exit 1
+fi
+EOT
+
+FROM deps AS format
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn run format \
+  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' | cpio -pdm /out
+
+FROM scratch AS format-update
+COPY --from=format /out /
+
+FROM deps AS lint
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn run lint
+
+FROM deps AS test
+ENV RUNNER_TEMP=/tmp/github_runner
+ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/node_modules \
+  yarn run test --coverageDirectory=/tmp/coverage
+
+FROM scratch AS test-coverage
+COPY --from=test /tmp/coverage /