Skip to content

Commit 86d0e1a

Browse files
GudahttGudahtt
authored
chore: Adopt standard CI workflows (#129)
Adopt standard CI workflows from `metamask-module-template`, minus the doc generation.
1 parent 56445a7 commit 86d0e1a

File tree

9 files changed

+301
-71
lines changed

9 files changed

+301
-71
lines changed

‎.github/workflows/build-lint-test.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Build, Lint, and Test
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
prepare:
8+
name: Prepare
9+
runs-on: ubuntu-latest
10+
strategy:
11+
matrix:
12+
node-version: [18.x, 20.x, 22.x]
13+
steps:
14+
- name: Checkout and setup environment
15+
uses: MetaMask/action-checkout-and-setup@v1
16+
with:
17+
is-high-risk-environment: false
18+
node-version: ${{ matrix.node-version }}
19+
cache-node-modules: ${{ matrix.node-version == '22.x' }}
20+
21+
build:
22+
name: Build
23+
needs: prepare
24+
runs-on: ubuntu-latest
25+
strategy:
26+
matrix:
27+
node-version: [22.x]
28+
steps:
29+
- name: Checkout and setup environment
30+
uses: MetaMask/action-checkout-and-setup@v1
31+
with:
32+
is-high-risk-environment: false
33+
node-version: ${{ matrix.node-version }}
34+
- run: yarn build
35+
- name: Require clean working directory
36+
shell: bash
37+
run: |
38+
if ! git diff --exit-code; then
39+
echo "Working tree dirty at end of job"
40+
exit 1
41+
fi
42+
43+
lint:
44+
name: Lint
45+
needs: prepare
46+
runs-on: ubuntu-latest
47+
strategy:
48+
matrix:
49+
node-version: [22.x]
50+
steps:
51+
- name: Checkout and setup environment
52+
uses: MetaMask/action-checkout-and-setup@v1
53+
with:
54+
is-high-risk-environment: false
55+
node-version: ${{ matrix.node-version }}
56+
- run: yarn lint
57+
- name: Validate RC changelog
58+
if: ${{ startsWith(github.head_ref, 'release/') }}
59+
run: yarn lint:changelog --rc
60+
- name: Validate changelog
61+
if: ${{ !startsWith(github.head_ref, 'release/') }}
62+
run: yarn lint:changelog
63+
- name: Require clean working directory
64+
shell: bash
65+
run: |
66+
if ! git diff --exit-code; then
67+
echo "Working tree dirty at end of job"
68+
exit 1
69+
fi
70+
71+
test:
72+
name: Test
73+
needs: prepare
74+
runs-on: ubuntu-latest
75+
strategy:
76+
matrix:
77+
node-version: [18.x, 20.x, 22.x]
78+
steps:
79+
- name: Checkout and setup environment
80+
uses: MetaMask/action-checkout-and-setup@v1
81+
with:
82+
is-high-risk-environment: false
83+
node-version: ${{ matrix.node-version }}
84+
- run: yarn test
85+
- name: Require clean working directory
86+
shell: bash
87+
run: |
88+
if ! git diff --exit-code; then
89+
echo "Working tree dirty at end of job"
90+
exit 1
91+
fi

‎.github/workflows/create-release-pr.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ on:
88
default: 'main'
99
required: true
1010
release-type:
11-
description: 'A SemVer version diff, i.e. major, minor, patch, prerelease etc. Mutually exclusive with "release-version".'
11+
description: 'A SemVer version diff, i.e. major, minor, or patch. Mutually exclusive with "release-version".'
1212
required: false
1313
release-version:
1414
description: 'A specific version to bump to. Mutually exclusive with "release-type".'
@@ -33,9 +33,10 @@ jobs:
3333
# We check out the specified branch, which will be used as the base
3434
# branch for all git operations and the release PR.
3535
ref: ${{ github.event.inputs.base-branch }}
36-
- uses: MetaMask/action-create-release-pr@v1
37-
env:
38-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36+
37+
- uses: MetaMask/action-create-release-pr@v4
3938
with:
4039
release-type: ${{ github.event.inputs.release-type }}
4140
release-version: ${{ github.event.inputs.release-version }}
41+
env:
42+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/lint-test.yml‎

Lines changed: 0 additions & 46 deletions
This file was deleted.

‎.github/workflows/main.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Main
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
8+
jobs:
9+
check-workflows:
10+
name: Check workflows
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout and setup environment
14+
uses: MetaMask/action-checkout-and-setup@v1
15+
with:
16+
is-high-risk-environment: false
17+
- name: Download actionlint
18+
id: download-actionlint
19+
run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/7fdc9630cc360ea1a469eed64ac6d78caeda1234/scripts/download-actionlint.bash) 1.6.23
20+
shell: bash
21+
- name: Check workflow files
22+
run: ${{ steps.download-actionlint.outputs.executable }} -color
23+
shell: bash
24+
25+
analyse-code:
26+
name: Code scanner
27+
needs: check-workflows
28+
uses: ./.github/workflows/security-code-scanner.yml
29+
permissions:
30+
actions: read
31+
contents: read
32+
security-events: write
33+
secrets:
34+
SECURITY_SCAN_METRICS_TOKEN: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
35+
APPSEC_BOT_SLACK_WEBHOOK: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}
36+
37+
build-lint-test:
38+
name: Build, lint, and test
39+
uses: ./.github/workflows/build-lint-test.yml
40+
41+
all-jobs-completed:
42+
name: All jobs completed
43+
runs-on: ubuntu-latest
44+
needs:
45+
- check-workflows
46+
- analyse-code
47+
- build-lint-test
48+
outputs:
49+
PASSED: ${{ steps.set-output.outputs.PASSED }}
50+
steps:
51+
- name: Set PASSED output
52+
id: set-output
53+
run: echo "PASSED=true" >> "$GITHUB_OUTPUT"
54+
55+
all-jobs-pass:
56+
name: All jobs pass
57+
if: ${{ always() }}
58+
runs-on: ubuntu-latest
59+
needs: all-jobs-completed
60+
steps:
61+
- name: Check that all jobs have passed
62+
run: |
63+
passed="${{ needs.all-jobs-completed.outputs.PASSED }}"
64+
if [[ $passed != "true" ]]; then
65+
exit 1
66+
fi
67+
68+
is-release:
69+
# Filtering by `push` events ensures that we only release from the `main` branch, which is a
70+
# requirement for our npm publishing environment.
71+
# The commit author should always be 'github-actions' for releases created by the
72+
# 'create-release-pr' workflow, so we filter by that as well to prevent accidentally
73+
# triggering a release.
74+
if: github.event_name == 'push' && startsWith(github.event.head_commit.author.name, 'github-actions')
75+
needs: all-jobs-pass
76+
outputs:
77+
IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
78+
runs-on: ubuntu-latest
79+
steps:
80+
- uses: MetaMask/action-is-release@v1
81+
id: is-release
82+
83+
publish-release:
84+
needs: is-release
85+
if: needs.is-release.outputs.IS_RELEASE == 'true'
86+
name: Publish release
87+
permissions:
88+
contents: write
89+
uses: ./.github/workflows/publish-release.yml
90+
secrets:
91+
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
92+
PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }}
93+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

‎.github/workflows/publish-release.yml‎

Lines changed: 68 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,80 @@
11
name: Publish Release
22

33
on:
4-
pull_request:
5-
types: [closed]
6-
4+
workflow_call:
5+
secrets:
6+
NPM_TOKEN:
7+
required: true
8+
SLACK_WEBHOOK_URL:
9+
required: true
10+
PUBLISH_DOCS_TOKEN:
11+
required: true
712
jobs:
813
publish-release:
914
permissions:
1015
contents: write
11-
if: |
12-
github.event.pull_request.merged == true &&
13-
startsWith(github.event.pull_request.head.ref, 'release/')
1416
runs-on: ubuntu-latest
1517
steps:
16-
- uses: actions/checkout@v4
17-
with:
18-
# We check out the release pull request's base branch, which will be
19-
# used as the base branch for all git operations.
20-
ref: ${{ github.event.pull_request.base.ref }}
21-
- uses: actions/setup-node@v4
18+
- name: Checkout and setup environment
19+
uses: MetaMask/action-checkout-and-setup@v1
2220
with:
23-
node-version-file: .nvmrc
24-
- uses: MetaMask/action-publish-release@v1
21+
is-high-risk-environment: true
22+
ref: ${{ github.sha }}
23+
- uses: MetaMask/action-publish-release@v3
2524
env:
2625
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26+
- run: yarn build
27+
- name: Upload build artifacts
28+
uses: actions/upload-artifact@v4
29+
with:
30+
name: publish-release-artifacts-${{ github.sha }}
31+
retention-days: 4
32+
include-hidden-files: true
33+
path: |
34+
./dist
35+
./node_modules/.yarn-state.yml
36+
37+
publish-npm-dry-run:
38+
needs: publish-release
39+
runs-on: ubuntu-latest
40+
steps:
41+
- name: Checkout and setup environment
42+
uses: MetaMask/action-checkout-and-setup@v1
43+
with:
44+
is-high-risk-environment: true
45+
ref: ${{ github.sha }}
46+
- name: Restore build artifacts
47+
uses: actions/download-artifact@v4
48+
with:
49+
name: publish-release-artifacts-${{ github.sha }}
50+
- name: Dry Run Publish
51+
# omit npm-token token to perform dry run publish
52+
uses: MetaMask/action-npm-publish@v5
53+
with:
54+
slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
55+
subteam: S042S7RE4AE # @metamask-npm-publishers
56+
env:
57+
SKIP_PREPACK: true
58+
59+
publish-npm:
60+
needs: publish-npm-dry-run
61+
runs-on: ubuntu-latest
62+
environment: npm-publish
63+
steps:
64+
- name: Checkout and setup environment
65+
uses: MetaMask/action-checkout-and-setup@v1
66+
with:
67+
is-high-risk-environment: true
68+
ref: ${{ github.sha }}
69+
- name: Restore build artifacts
70+
uses: actions/download-artifact@v4
71+
with:
72+
name: publish-release-artifacts-${{ github.sha }}
73+
- name: Publish
74+
uses: MetaMask/action-npm-publish@v5
75+
with:
76+
# This `NPM_TOKEN` needs to be manually set per-repository.
77+
# Look in the repository settings under "Environments", and set this token in the `npm-publish` environment.
78+
npm-token: ${{ secrets.NPM_TOKEN }}
79+
env:
80+
SKIP_PREPACK: true

‎.github/workflows/security-code-scanner.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,24 @@
11
name: MetaMask Security Code Scanner
22

33
on:
4-
push:
5-
branches:
6-
- main
7-
pull_request:
8-
branches:
9-
- main
4+
workflow_call:
5+
secrets:
6+
SECURITY_SCAN_METRICS_TOKEN:
7+
required: false
8+
APPSEC_BOT_SLACK_WEBHOOK:
9+
required: false
1010
workflow_dispatch:
1111

1212
jobs:
1313
run-security-scan:
14+
name: Run security scan
1415
runs-on: ubuntu-latest
1516
permissions:
1617
actions: read
1718
contents: read
1819
security-events: write
1920
steps:
20-
- name: MetaMask Security Code Scanner
21+
- name: Analyse code
2122
uses: MetaMask/action-security-code-scanner@v1
2223
with:
2324
repo: ${{ github.repository }}

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
"build": "tsc --project tsconfig.build.json",
1717
"build:clean": "rimraf dist && yarn build",
1818
"lint": "yarn lint:eslint && yarn lint:misc --check",
19+
"lint:changelog": "auto-changelog validate",
1920
"lint:eslint": "eslint . --cache --ext js,ts",
2021
"lint:fix": "yarn lint:eslint --fix && yarn lint:misc --write",
2122
"lint:misc": "prettier '**/*.json' '**/*.md' '!CHANGELOG.md' '**/*.yml' '!.yarnrc.yml' --ignore-path .gitignore --no-error-on-unmatched-pattern",

0 commit comments

Comments
 (0)