strapi-community
diff --git a/‎.github/workflows/npm-publish.yml‎
Lines changed: 146 additions & 12 deletions b/‎.github/workflows/npm-publish.yml‎
Lines changed: 146 additions & 12 deletions
diff --git a/‎README.md‎
Lines changed: 111 additions & 4 deletions b/‎README.md‎
Lines changed: 111 additions & 4 deletions
@@ -1,28 +1,162 @@
-# This workflow will publish a package to NPM when a release is created
+# Strapi Plugin CI/CD Pipeline
+# Best Practices workflow for building, testing, and publishing Strapi v5 plugins
 
-name: Publish to NPM
+name: CI/CD
 
 on:
+  push:
+    branches: [main, feat/v5-support]
+  pull_request:
+    branches: [main]
   release:
     types: [published]
 
+env:
+  NODE_VERSION: '20.x'
+
 jobs:
-  publish-npm:
+  # ============================================
+  # Build & Verify Job
+  # Runs on every push and PR to validate the plugin
+  # ============================================
+  build:
+    name: Build & Verify
     runs-on: ubuntu-latest
+    
     steps:
-      - name: Checkout branch
-        uses: actions/checkout@v2
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
-      - name: Install Node v18
-        uses: actions/setup-node@v2
+      - name: Setup Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@v4
         with:
-          node-version: '18.x'
-          registry-url: 'https://registry.npmjs.org'
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
 
-      - name: Clean install deps
+      - name: Install dependencies
         run: npm ci
 
+      - name: Build plugin
+        run: npm run build
+
+      - name: Verify plugin structure
+        run: npm run verify
+
+      - name: Check package.json exports
+        run: |
+          echo "[INFO] Checking package exports..."
+          node -e "
+            const pkg = require('./package.json');
+            const required = ['./strapi-admin', './strapi-server'];
+            for (const exp of required) {
+              if (!pkg.exports[exp]) {
+                console.error('[ERROR] Missing export:', exp);
+                process.exit(1);
+              }
+            }
+            console.log('[SUCCESS] All required exports present');
+          "
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+  # ============================================
+  # Publish to NPM Job
+  # Only runs when a GitHub Release is published
+  # ============================================
+  publish:
+    name: Publish to NPM
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.event_name == 'release'
+    
+    permissions:
+      contents: read
+      id-token: write
+    
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Verify version matches release tag
+        run: |
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          RELEASE_TAG="${{ github.event.release.tag_name }}"
+          # Remove 'v' prefix if present
+          RELEASE_VERSION="${RELEASE_TAG#v}"
+          
+          echo "[INFO] Package version: $PKG_VERSION"
+          echo "[INFO] Release tag: $RELEASE_TAG (version: $RELEASE_VERSION)"
+          
+          if [ "$PKG_VERSION" != "$RELEASE_VERSION" ]; then
+            echo "[ERROR] Version mismatch! Package: $PKG_VERSION, Release: $RELEASE_VERSION"
+            echo "[INFO] Please update package.json version to match the release tag."
+            exit 1
+          fi
+          
+          echo "[SUCCESS] Version match confirmed"
+
+      - name: Determine npm tag
+        id: npm-tag
+        run: |
+          RELEASE_TAG="${{ github.event.release.tag_name }}"
+          
+          # Determine npm dist-tag based on release type
+          if [[ "$RELEASE_TAG" == *"-beta"* ]]; then
+            echo "tag=beta" >> $GITHUB_OUTPUT
+          elif [[ "$RELEASE_TAG" == *"-alpha"* ]]; then
+            echo "tag=alpha" >> $GITHUB_OUTPUT
+          elif [[ "$RELEASE_TAG" == *"-rc"* ]]; then
+            echo "tag=next" >> $GITHUB_OUTPUT
+          else
+            echo "tag=latest" >> $GITHUB_OUTPUT
+          fi
+          
+          echo "[INFO] NPM tag: $(cat $GITHUB_OUTPUT | grep tag | cut -d= -f2)"
+
       - name: Publish to NPM
-        run: npm publish
+        run: |
+          echo "[INFO] Publishing with tag: ${{ steps.npm-tag.outputs.tag }}"
+          npm publish --access public --tag ${{ steps.npm-tag.outputs.tag }}
         env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Post-publish verification
+        run: |
+          PKG_NAME=$(node -p "require('./package.json').name")
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          
+          echo "[INFO] Waiting for NPM registry to update..."
+          sleep 10
+          
+          echo "[INFO] Verifying package on NPM..."
+          npm view "$PKG_NAME@$PKG_VERSION" version || echo "[WARNING] Package may take a few minutes to appear on NPM"
+          
+          echo ""
+          echo "============================================"
+          echo "[SUCCESS] Published $PKG_NAME@$PKG_VERSION"
+          echo "============================================"
+          echo ""
+          echo "Install with:"
+          echo "  npm install $PKG_NAME@$PKG_VERSION"
+          echo ""
+          echo "View on NPM:"
+          echo "  https://www.npmjs.com/package/$PKG_NAME"
+          echo ""
@@ -165,15 +165,24 @@ module.exports = {
   io: {
     enabled: true,
     config: {
-      // Content types with specific actions
+      // Content types with specific actions and populate
       contentTypes: [
         {
           uid: 'api::article.article',
-          actions: ['create', 'update']  // Only these events
+          actions: ['create', 'update'],  // Only these events
+          populate: '*'                    // Include all relations
         },
         {
           uid: 'api::comment.comment',
-          actions: ['create', 'delete']
+          actions: ['create', 'delete'],
+          populate: ['author', 'article']  // Only specific relations
+        },
+        {
+          uid: 'api::order.order',
+          populate: {                      // Strapi populate syntax
+            customer: { fields: ['name', 'email'] },
+            items: { populate: ['product'] }
+          }
         }
       ],
 
@@ -217,7 +226,105 @@ module.exports = {
 };
 ```
 
-> **Note**: Relations are included globally via the admin panel settings (`Settings > Socket.IO > Events > Include Relations`), not per content type in the config file.
+### Populate Configuration
+
+Include relations in emitted events by adding the `populate` option to content types. When configured, the plugin refetches entities with populated relations after create/update operations.
+
+#### Populate Formats
+
+| Format | Example | Description |
+|--------|---------|-------------|
+| `'*'` or `true` | `populate: '*'` | Include all relations (1 level deep) |
+| String array | `populate: ['author', 'category']` | Only specific relations |
+| Object | `populate: { author: { fields: ['name'] } }` | Full Strapi populate syntax |
+
+#### Examples
+
+```javascript
+contentTypes: [
+  // All relations with wildcard
+  { uid: 'api::article.article', populate: '*' },
+  
+  // Specific relations only
+  { 
+    uid: 'api::comment.comment', 
+    populate: ['author', 'post'] 
+  },
+  
+  // Strapi populate syntax with field selection
+  { 
+    uid: 'api::order.order', 
+    populate: { 
+      customer: { fields: ['username', 'email'] },
+      items: { 
+        populate: { product: { fields: ['name', 'price'] } }
+      }
+    } 
+  },
+  
+  // No populate (only base fields)
+  { uid: 'api::log.log' }  // populate not set = no relations
+]
+```
+
+> **Note**: The `populate` option only affects `create` and `update` events. Delete events always contain minimal data (id, documentId) since the entity no longer exists.
+
+### Sensitive Fields Protection
+
+The plugin automatically removes sensitive fields from all emitted data for security. This works in addition to Strapi's built-in `private: true` field filtering.
+
+#### Default Blocked Fields
+
+The following fields are **always removed** from emitted data:
+
+- `password`, `salt`, `hash`
+- `resetPasswordToken`, `confirmationToken`
+- `refreshToken`, `accessToken`, `token`
+- `secret`, `apiKey`, `api_key`
+- `privateKey`, `private_key`
+
+#### Custom Sensitive Fields
+
+Add your own sensitive fields to the block list:
+
+```javascript
+// config/plugins.js
+module.exports = {
+  io: {
+    enabled: true,
+    config: {
+      contentTypes: ['api::user.user'],
+      
+      // Additional fields to never emit
+      sensitiveFields: [
+        'creditCard',
+        'ssn',
+        'socialSecurityNumber',
+        'bankAccount',
+        'internalNotes'
+      ]
+    }
+  }
+};
+```
+
+#### How It Works
+
+1. **Schema-level filtering**: Strapi's `sanitize.contentAPI` removes `private: true` fields
+2. **Blocklist filtering**: Plugin removes all sensitive field names recursively
+3. **Applies to all emits**: Both `emit()` and `raw()` methods are protected
+
+```javascript
+// Even with populate, sensitive fields are stripped
+contentTypes: [
+  {
+    uid: 'api::user.user',
+    populate: '*'  // Relations included, but passwords etc. still removed
+  }
+]
+```
+
+> **Security Note**: Fields are matched case-insensitively and also partial matches work (e.g., `apiKey` blocks `myApiKey`, `user_api_key`, etc.)
 
 ### Environment Variables