Merge branch 'beta'

* beta:
  feat(payments): upgrade Web Payments SDK to v1 (#10)
  chore(deps): bump @babel/preset-typescript from 7.12.17 to 7.14.5 (#16)
  chore(deps): bump @types/jest from 26.0.20 to 26.0.23 (#15)
  chore(deps): bump @babel/core from 7.12.17 to 7.14.5 (#12)
  ci: add @codecov (#9)
  chore(deps): add @dependabot (#8)
  ci: add code scanning action (#7)
  feat: add typings, and ability to import typings, to package (#11)
  docs: snowpack example (#6)
  docs: release process + script to automate (#5)

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically
+
+version: 2
+updates:
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    target-branch: 'beta'
+    commit-message:
+      prefix: 'chore(deps): '

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v2
         with:
-          node-version: '15' # keep in sync w/ .nvmrc
+          node-version: '16' # keep in sync w/ .nvmrc
 
       - name: Get npm cache directory
         id: npm-cache
@@ -36,10 +36,17 @@ jobs:
         run: npm ci
 
       - name: Run tests
+        id: test
         run: npm test
 
+      - name: Collect coverage
+        run: npx codecov
+        continue-on-error: true
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
       - name: Semantic Release
-        if: success()
+        if: ${{ steps.test.conclusion == 'success' }}
         run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,48 @@
+name: 'CodeQL'
+
+on:
+  push:
+    branches: [beta, main]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [beta]
+  schedule:
+    - cron: '44 22 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
+        language: ['javascript']
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1

.nvmrc

@@ -1 +1 @@
-v15.8
+v16

README.md

@@ -2,14 +2,15 @@
 
 [![LICENSE](https://img.shields.io/badge/license-Apache%202-blue.svg)](https://github.com/square/web-sdk/blob/main/LICENSE)
 [![CI](https://github.com/square/web-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/square/web-sdk/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/square/web-sdk/branch/beta/graph/badge.svg?token=YK448D4KX7)](https://codecov.io/gh/square/web-sdk)
 [![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg)](https://conventionalcommits.org)
 [![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
 
 ## Development
 
 ### Getting Started
 
-This project uses Node v15 as defined by `.nvmrc` to take advantage of npm@7. You can use [nvm](https://github.com/nvm-sh/nvm) to install the correct version:
+This project uses Node v16 as defined by `.nvmrc` to take advantage of npm@7. You can use [nvm](https://github.com/nvm-sh/nvm) to install the correct version:
 
 ```sh
 nvm install $(cat .nvmrc)
@@ -87,14 +88,6 @@ npm run build
 
 [GitHub Actions](https://docs.github.com/en/actions) is used for our CI/CD workflows. See `.github/workflows` for details.
 
-## Releasing
-
-We use [semantic-release](https://semantic-release.gitbook.io/semantic-release/#highlights) to automatically create changelogs from commits, publish to npm, and create GitHub releases.
-
-[Read more](https://github.com/semantic-release/semantic-release/blob/6013a5633ecb71aac80f7b68b8e7250c5c58f7c0/docs/recipes/pre-releases.md) about publishing pre-releases.
-
-[Read more](https://github.com/semantic-release/semantic-release/blob/6013a5633ecb71aac80f7b68b8e7250c5c58f7c0/docs/usage/workflow-configuration.md#workflow-configuration) about expected behavior when pushing to the `main` and `beta` branches.
-
 ## License
 
 ```plaintext

docs/Releasing.md

@@ -0,0 +1,23 @@
+# Releasing
+
+We use [semantic-release](https://semantic-release.gitbook.io/semantic-release/#highlights) to automatically create changelogs from commits, publish to [npm](https://www.npmjs.com/package/@square/web-sdk), and create [GitHub releases](https://github.com/square/web-sdk/releases).
+
+Our `beta` git branch allows us to publish pre-releases as the `beta` tag on npm (i.e. `npm i @square/web-sdk@beta`). Pull Requests should target this branch so changes can be tried out before being promoted to the default distribution channel.
+
+Our `main` git branch is the default distribution channel which is published as the `latest` tag on npm (i.e. `npm i @square/web-sdk@latest`). Fixes can be made directly to this branch (preferably via Pull Request). Features, including breaking changes, should be developed and tested on the `beta` branch before being merged upstream to this `main` branch.
+
+Promoting features from `beta` to `main` is a manually process but a simple script:
+
+```sh
+./script/release.sh
+```
+
+That script will:
+
+1. get your local up to date
+1. merge `beta` into `main` using a merge commit strategy to help semantic-release
+1. push `main` to GitHub to trigger GitHub Actions which will run semantic-release
+
+[Read more](https://github.com/semantic-release/semantic-release/blob/6013a5633ecb71aac80f7b68b8e7250c5c58f7c0/docs/recipes/pre-releases.md) about publishing pre-releases.
+
+[Read more](https://github.com/semantic-release/semantic-release/blob/6013a5633ecb71aac80f7b68b8e7250c5c58f7c0/docs/usage/workflow-configuration.md#workflow-configuration) about expected behavior when pushing to the `main` and `beta` branches.

examples/snowpack/README.md

@@ -0,0 +1,20 @@
+# snowpack
+
+Use [Snowpack](https://www.snowpack.dev/), "a lightning-fast frontend build tool, designed for the modern web", to build a simple payment form with Square Web SDK.
+
+## How to use
+
+Clone, install, and start:
+
+```sh
+# clone from github
+git clone https://github.com/square/web-sdk.git
+# go to example
+cd examples/snowpack
+# install dependencies
+npm install
+# start development server
+npm start
+```
+
+Snowpack will open `index.html` which includes `pay.js` where Square Web SDK is set up to take a card payment.

examples/snowpack/index.html

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html lange="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Square Web SDK Example</title>
+  </head>
+
+  <body>
+    <div id="card"></div>
+    <button type="button" id="pay">Pay $1.00</button>
+
+    <script type="module" src="./pay.js"></script>
+  </body>
+</html>