.github/workflows/deploy.yml

@@ -0,0 +1,40 @@
+name: deploy
+on:
+  push:
+    branches:
+      - deploy-staging
+      - deploy-production
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Set staging variables
+      run: |
+        echo "ENVIRONMENT_URL=https://your_service.npm.red" >> $GITHUB_ENV
+        echo "DEPLOYMENT_CONFIDENCE_URL=${{ secrets.DATADOG_STAGING_DEPLOYMENT_DASHBOARD_URL }}" >> $GITHUB_ENV
+      if: github.ref == 'refs/heads/deploy-staging'
+
+    - name: Set production variables
+      run: |
+        echo "ENVIRONMENT_URL=https://your_service.internal.npmjs.com" >> $GITHUB_ENV
+        echo "DEPLOYMENT_CONFIDENCE_URL=${{ secrets.DATADOG_PRODUCTION_DEPLOYMENT_DASHBOARD_URL }}" >> $GITHUB_ENV
+      if: github.ref == 'refs/heads/deploy-production'
+
+    - name: create a deployment
+      uses: npm/action-deploy@v2
+      with:
+        type: create
+        token: ${{github.token}}
+        logs: https://github.slack.com/archives/C02UYAZ5P # npm-deploys channel
+        environment_url: ${{env.ENVIRONMENT_URL}}
+        deployment_confidence_url: ${{env.DEPLOYMENT_CONFIDENCE_URL}}
+        job_status: ${{job.status}} # keep that to track status of the current job, when deployment is completed
+        slack_token: ${{secrets.NPM_ROBOT_SLACK_TOKEN}}
+        slack_channel: npm-ops
+
+    # change to actual deployment steps
+    - name: placeholder for actual deployment
+      run: sleep 10s

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |
+
+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.