chore: Fix 33 vulnerabilities, replace dead gulp build, restore tests and CI

.github/workflows/ci.yml

@@ -0,0 +1,68 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        # currently supported Node.js release lines
+        node-version: [20, 22, 24]
+    name: test (node ${{ matrix.node-version }})
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - name: Install packages
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Check the build actually emitted the transpiler
+        # bin/ is gitignored, so a silently skipped build would otherwise
+        # only surface as a confusing "Cannot find module" inside mocha
+        run: |
+          for file in transpiler_base.js transpiler_esprima.js transpiler_esprima.d.ts; do
+            if [ ! -f "bin/$file" ]; then
+              echo "::error::bin/$file is missing from the build"
+              exit 1
+            fi
+            echo "ok  bin/$file"
+          done
+
+      - name: Test
+        run: npm test
+
+      - name: Stage the browser test libraries
+        run: npm run copy:lib
+
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install packages
+        run: npm ci
+
+      # runs separately from the test matrix so a new advisory turning CI red
+      # is never confused with an actual build or test regression
+      - name: Audit dependencies
+        run: npm audit --audit-level=high

.gitignore

@@ -1,6 +1,9 @@
 # Built files
 bin/*.js
 bin/*.js.map
+bin/*.d.ts
+dist/*.js
+dist/*.js.map
 doc/*
 
 # Lib files js/css to exclude

README.md

@@ -1,14 +1,42 @@
-[![Logo](http://gpu.rocks/img/ogimage.png)](http://gpu.rocks/)
+[![Logo](https://gpu.rocks/img/ogimage.png)](https://gpu.rocks/)
 
+[![CI](https://github.com/gpujs/gpujs-transpile/actions/workflows/ci.yml/badge.svg)](https://github.com/gpujs/gpujs-transpile/actions/workflows/ci.yml)
 [![Join the chat at https://gitter.im/gpujs/gpu.js](https://badges.gitter.im/gpujs/gpu.js.svg)](https://gitter.im/gpujs/gpu.js?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 
 Sup-project of GPU.JS - Focusing purely on the language transpilation aspect.
 
 This is written and maintained in typescript format
 
+> **Status:** this is an unfinished prototype. `ast_generic` only walks node
+> lists; every concrete AST node type is still unimplemented, so `parse()`
+> raises "Unknown ast type" for real input. The build, tests and dependencies
+> are kept current, but the transpiler itself has not been completed.
+
+# Requirements
+
+Node.js 20 or newer.
+
 # Key commands
 
-`npm test` - Run the test engine inside nodejs
+`npm run build` - Compile `src/*.ts` into `bin/` with the TypeScript compiler
+
+`npm test` - Build, then run the test engine inside nodejs
+
+`npm run copy:lib` - Stage esprima, mocha and chai into `lib/` for the browser
+test page
+
+# Running the tests in a browser
+
+```
+npm install
+npm run build
+npm run copy:lib
+npx --yes serve .    # or any other static file server
+```
+
+Then open `test.html` from the served address. It needs to be served over
+HTTP rather than opened from disk, because the test loader fetches the suite
+with XMLHttpRequest.
 
 # License 
 

lib/_anchor.txt

@@ -1 +1,2 @@
-library files. this is copied over, via `gulp copy` as part of the build process.
+library files. this is copied over, via `npm run copy:lib`, for the browser
+test page in test.html.