chore: Improve supply chain security for WASM binary

.github/workflows/audit.yml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          submodules: true
       - uses: EmbarkStudios/cargo-deny-action@8371184bd11e21dcf8ac82ebf8c9c9f74ebf7268 # v2.0.1
         with:
           manifest-path: "deps/swc/bindings/binding_typescript_wasm/Cargo.toml"
@@ -32,10 +34,12 @@ jobs:
     strategy:
       matrix:
         include:
-        - language: javascript-typescript
+          - language: javascript-typescript
     steps:
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          submodules: true
       - name: Initialize CodeQL
         uses: github/codeql-action/init@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0
         with:

.github/workflows/ci.yml

@@ -40,11 +40,16 @@ jobs:
     runs-on: ${{matrix.platform}}
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          submodules: true
       - name: "Use Node.js ${{matrix.node}}.x"
         uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: ${{matrix.node}}.x
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
       - run: npm install
+      - run: node ./tools/build-wasm.js
       - run: npm run typecheck
       - run: npm run build
       - run: npm test

.github/workflows/release.yml

@@ -13,11 +13,16 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          submodules: true
       - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
-          node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
       - run: npm install
+      - run: node ./tools/build-wasm.js
       - run: npm run build
       - name: Create NPM release
         run: npm publish --provenance --access public

.github/workflows/update-swc.yml

@@ -10,7 +10,7 @@ on:
     - cron: '0 0 * * 1' # Every Monday at 00:00 UTC
 
 env:
-    NODE_VERSION: lts/*
+  NODE_VERSION: lts/*
 
 jobs:
   update-swc:
@@ -20,14 +20,15 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           persist-credentials: false
+          submodules: true
 
       - name: Set up Node.js
         uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
 
       - name: Check if SWC update is required
         id: version-check
         run: |
-          CURRENT_SWC_VERSION=$(cat lib/package.json | jq -r '.version')
+          CURRENT_SWC_VERSION=$(grep '^version' "deps/swc/bindings/binding_typescript_wasm/Cargo.toml" | awk -F\" '{print $2}')
           if [[ -n "${{ github.event.inputs.swc_version }}" ]]; then
             NEW_SWC_VERSION="${{ github.event.inputs.swc_version }}"
           else
@@ -45,6 +46,8 @@ jobs:
 
       - name: Update SWC
         if: steps.version-check.outputs.UPDATE_REQUIRED == 'true'
+        env:
+          NEW_SWC_VERSION: ${{ steps.version-check.outputs.NEW_SWC_VERSION }}
         run: ./tools/update-swc.sh
 
       - name: Create Pull Request with first commit
@@ -53,30 +56,15 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-            author: Node.js GitHub Bot <[email protected]>
-            title: "chore(deps): update SWC to v${{ github.event.inputs.swc_version || steps.version-check.outputs.NEW_SWC_VERSION }}"
-            branch: "chore/update-swc-${{ github.event.inputs.swc_version || steps.version-check.outputs.NEW_SWC_VERSION }}"
-            commit-message: "chore: update swc to v${{ github.event.inputs.swc_version || steps.version-check.outputs.NEW_SWC_VERSION }}"
-            path: deps
-            body: |
-                This PR updates SWC to v${{ github.event.inputs.swc_version || steps.version-check.outputs.NEW_SWC_VERSION }}.
-                View the [SWC changelog](https://github.com/swc-project/swc/releases/tag/v${{ github.event.inputs.swc_version || steps.version-check.outputs.NEW_SWC_VERSION }}) for more information.
+          author: Node.js GitHub Bot <[email protected]>
+          title: "chore(deps): update SWC to v${{ steps.version-check.outputs.NEW_SWC_VERSION }}"
+          branch: "chore/update-swc-${{ steps.version-check.outputs.NEW_SWC_VERSION }}"
+          commit-message: "chore: update swc to v${{ steps.version-check.outputs.NEW_SWC_VERSION }}"
+          path: deps
+          body: |
+            This PR updates SWC to v${{ steps.version-check.outputs.NEW_SWC_VERSION }}.
+            View the [SWC changelog](https://github.com/swc-project/swc/releases/tag/v${{ steps.version-check.outputs.NEW_SWC_VERSION }}) for more information.
 
       - name: Set up Docker
         if: steps.version-check.outputs.UPDATE_REQUIRED == 'true'
         uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
-
-      - name: Build WASM
-        if: steps.version-check.outputs.UPDATE_REQUIRED == 'true'
-        run: node ./tools/build-wasm.js
-
-      - name: Create second commit
-        if: steps.version-check.outputs.UPDATE_REQUIRED == 'true'
-        uses: gr2m/create-or-update-pull-request-action@86ec1766034c8173518f61d2075cc2a173fb8c97 # v1.9.4
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-            author: Node.js GitHub Bot <[email protected]>
-            branch: "chore/update-swc-${{ github.event.inputs.swc_version || steps.version-check.outputs.NEW_SWC_VERSION }}"
-            commit-message: "chore: build wasm from swc v${{ github.event.inputs.swc_version || steps.version-check.outputs.NEW_SWC_VERSION }}"
-            path: lib

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "deps/swc"]
+	path = deps/swc
+	url = https://github.com/swc-project/swc.git

README.md

@@ -44,15 +44,6 @@ git add deps
 git commit -m "chore: update swc to vX.Y.Z"
 ```
 
-Once you have updated the rust source code we must build the wasm.
-To build the wasm it is necessary to have Docker installed.
-
-```shell
-node ./tools/build-wasm.js
-git add lib
-git commit -m "chore: build wasm from swc vX.Y.Z"
-```
-
 ### TypeScript Version
 
 The supported TypeScript version is 5.5.4.