Replace Travis with GitHub Actions, remove codecov

We want to do some maintenance to the @semantic-release repository, starting with replacing Travis with GitHub Actions.

@travi here is my current plan, does it cover everything? I’d do it manually in this repository, confirm that we didn’t miss anything, then codify it for the remaining repositories using https://github.com/gr2m/mutate-github-repositories-cli

1. Delete .travis file

2. Remove Travis & Codecov badges from README.

3. Enforce 100% code coverage by updating package.json

      "nyc": {
        "include": [
          "lib/**/*.js",
          "index.js"
        ],
        "reporter": [
          "json",
          "text",
          "html"
        ],
   -    "all": true
   +    "all": true,
   +    "check-coverage": true,
   +    "branches": 100,
   +    "lines": 100,
   +    "functions": 100,
   +    "statements": 100
      },
   

4. Create .github/workflows/test.yml with the following content

   name: Test
   "on":
     push:
       branches:
         - master
         - next
         - beta
         - *.x
     pull_request:
       types:
         - opened
         - synchronize
   jobs:
     test:
       runs-on: ubuntu-latest
       strategy:
         matrix:
           node_version:
             - 10.8
             - 12
             - 14
       steps:
         - uses: actions/checkout@v2
         - uses: actions/setup-node@v1
           with:
             version: "${{ matrix.node_version }}"
         - run: npm install
         - run: npm run test
   

5. Create .github/workflows/release.yml with the following content

   on:
     push:
       branches:
         - master
         - next
         - beta
         - "*.x" # maintenance releases such as 15.x
   
   name: Release
   jobs:
     build:
       name: release
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v2
         - uses: actions/setup-node@v1
           with:
             node-version: 12
         - run: npm install
         - run: npx semantic-release
           env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
             NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   

6. Add secret to the @semantic-release org: NPM_TOKEN (publish token for https://www.npmjs.com/~semantic-release-bot)

7. Remove Codecov app installation and required status check from branch protection

[gr2m]

I think we are good to close this?

[travi]

We can keep a 100% badge, but instead of linking to Codecov, we can link to the nyc setting requiring 100% coverage, that’s what I did in the past. That way we can keep the signaling, but can reduce the complexity of our CI. Alternatively, we could also add a section about coverage to CONTRIBUTING.md and link to that?

i think this is a good option and think the combination of both can actually make sense. i’m usually not a huge fan of specific coverage metrics, but i think it makes a lot of sense for projects like this that expect outside contribution.

How about SEMANTIC_RELEASE_BOT_NPM_PUBLISH_TOKEN

works for me

I’m not familiar with CIDR. Would this docs help?

this doc looks familiar. i think this

If you use an IP address allow list for your GitHub organization or enterprise account, you cannot use GitHub-hosted runners and must instead use self-hosted runners.

plus

Microsoft updates the Azure IP address ranges weekly

give us enough of an answer to say that restricting IP addresses isnt realistic. i’ll admit that i’ve considered going as far as creating a bot that could rotate the token each time IP address list changes, but i havent looked very far into it yet.

Doesn’t look like it: actions/setup-node#32. But we could probably hack it by using outputs?

i think this is a good approach to consider, but maybe its not worth complicating moving the rest of this forward to accomplish this, especially considering that we dont currently have .nvmrc in use