ci: overhaul CI and Release workflows

Split CI into parallel lint/typecheck/test jobs with build gating on all
three. Add JUnit test reporter for PR visibility. Bump Node 20 to 22.
Replace inline npx commands with npm run scripts. Add CI gate and
concurrency control to Release workflow. Harden tarball validation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/ci.yaml

@@ -7,31 +7,57 @@ on:
     branches: [main]
 
 jobs:
-  lint-and-test:
+  lint:
     runs-on: ubuntu-latest
     timeout-minutes: 10
-
     steps:
-      - name: Checkout
+      - uses: actions/checkout@v4
-        uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
+      - run: npm ci
+      - run: npm run lint
 
-      - name: Install dependencies
+  typecheck:
-        run: npm ci
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run tsc
 
-      - name: Build plugin
+  test:
-        run: npx @kinvolk/headlamp-plugin build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npx vitest run --reporter=default --reporter=junit --outputFile=test-results.xml
+      - uses: dorny/test-reporter@v1
+        if: always()
+        with:
+          name: Test Results
+          path: test-results.xml
+          reporter: java-junit
 
-      - name: Lint
+  build:
-        run: npx eslint --ext .ts,.tsx src/
+    runs-on: ubuntu-latest
-
+    timeout-minutes: 10
-      - name: Type-check
+    needs: [lint, typecheck, test]
-        run: npx tsc --noEmit
+    steps:
-
+      - uses: actions/checkout@v4
-      - name: Run unit tests
+      - uses: actions/setup-node@v4
-        run: npm test
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run build

.github/workflows/release.yaml

@@ -8,9 +8,28 @@ on:
         required: true
         type: string
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
+  ci:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run tsc
+      - run: npm test
+
   release:
     runs-on: ubuntu-latest
+    needs: [ci]
     permissions:
       contents: write
     steps:
@@ -45,27 +64,26 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
 
       - name: Build plugin
-        run: npx @kinvolk/headlamp-plugin build
+        run: npm run build
 
       - name: Package plugin
         run: npx @kinvolk/headlamp-plugin package
 
-      - name: Validate tarball name
+      - name: Validate tarball
         run: |
           EXPECTED="headlamp-tns-csi-plugin-${{ inputs.version }}.tar.gz"
-          ACTUAL=$(ls *.tar.gz)
+          if [ ! -f "$EXPECTED" ]; then
-          if [ "$EXPECTED" != "$ACTUAL" ]; then
+            echo "::error::Expected tarball not found: $EXPECTED"
-            echo "::error::Tarball name mismatch! Expected: $EXPECTED, Got: $ACTUAL"
             exit 1
           fi
-          echo "✓ Tarball name validated: $ACTUAL"
+          echo "Tarball validated: $EXPECTED"
 
       - name: Compute checksum
         id: compute_checksum
@@ -105,7 +123,7 @@ jobs:
 
       - name: Summary
         run: |
-          echo "✓ Version bumped to ${{ inputs.version }}"
+          echo "Version bumped to ${{ inputs.version }}"
-          echo "✓ Metadata updated with checksum sha256:${{ steps.compute_checksum.outputs.checksum }}"
+          echo "Metadata updated with checksum sha256:${{ steps.compute_checksum.outputs.checksum }}"
-          echo "✓ Tag v${{ inputs.version }} created"
+          echo "Tag v${{ inputs.version }} created"
-          echo "✓ GitHub release published with tarball"
+          echo "GitHub release published with tarball"