Skip to content

Commit 1e78ec4

Browse files
authored
fix: Docs pipeline (#167)
* chore: Fix docs pipeline * fix: Permissions for binary attestations * fix: Temp remove hardcoded version links for docs * fix: Cargo lock file * feat: Add scorecard workflows * fix: Ignore changelog from typos pre-commit * fix: Cargo lock file
1 parent be5b901 commit 1e78ec4

12 files changed

+239
-1725
lines changed

.github/release-please/.config.json

+13-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
{
2525
"type": "docs",
2626
"section": "📚 Documentation",
27-
"hidden": false
27+
"hidden": true
2828
},
2929
{
3030
"type": "refactor",
@@ -61,5 +61,17 @@
6161
"section": "🥏 Continuous Integration",
6262
"hidden": true
6363
}
64+
],
65+
"extra-files": [
66+
{
67+
"type": "toml",
68+
"path": "Cargo.toml",
69+
"jsonpath": "package.version"
70+
},
71+
{
72+
"type": "generic",
73+
"path": "docs/antora.yml"
74+
}
6475
]
76+
6577
}

.github/workflows/release-bins.yml

+2
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@ jobs:
7171
contents: write
7272
pull-requests: write
7373
attestations: write
74+
packages: write
75+
id-token: write
7476
needs: build
7577
runs-on: ubuntu-latest
7678
steps:

.github/workflows/release-docker.yml

+4-2
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,10 @@ jobs:
5454
type=raw,value=latest
5555
labels: |
5656
org.opencontainers.image.created={{commit_date 'YYYY-MM-DDTHH:mm:ss.SSS[Z]'}}
57-
org.opencontainers.image.title=openzeppelin-monitor
58-
org.opencontainers.image.vendor=openzeppelin
57+
org.opencontainers.image.title="openzeppelin-monitor"
58+
org.opencontainers.image.vendor="openzeppelin"
59+
org.opencontainers.image.description="Blockchain monitoring service that watches for specific onchain activities and triggers notifications based on configurable conditions."
60+
org.opencontainers.image.documentation="https://docs.openzeppelin.com/monitor"
5961
env:
6062
DOCKER_METADATA_SHORT_SHA_LENGTH: 10
6163

.github/workflows/release-docs.yml

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
name: Publish Docs
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
tag:
8+
type: string
9+
description: The tag to use for creating docs branch or merging to docs branch.
10+
required: true
11+
12+
jobs:
13+
docs:
14+
name: publish docs
15+
runs-on: ubuntu-latest
16+
env:
17+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
18+
SLACK_CHANNEL: '#oss-releases'
19+
steps:
20+
- name: Get github app token
21+
uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
22+
id: gh-app-token
23+
with:
24+
app-id: ${{ vars.GH_APP_ID }}
25+
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
26+
27+
- name: Checkout tag
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
with:
30+
ref: ${{ inputs.tag }}
31+
token: ${{ steps.gh-app-token.outputs.token }}
32+
33+
- name: Slack notification
34+
uses: act10ns/slack@44541246747a30eb3102d87f7a4cc5471b0ffb7d # v2.1.0
35+
with:
36+
status: starting
37+
steps: ${{ toJson(steps) }}
38+
channel: ${{ env.SLACK_CHANNEL }}
39+
message: Starting creating docs for ${{ github.repository }} with tag ${{
40+
inputs.tag }}......
41+
if: always()
42+
43+
- name: Validate Tag
44+
id: validate_tag
45+
run: |-
46+
TAG="${{ inputs.tag }}"
47+
echo "Validating tag: $TAG"
48+
49+
# Check if the tag matches the semantic versioning pattern
50+
if ! echo "$TAG" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' > /dev/null; then
51+
echo "Error: Tag '$TAG' is not a valid semantic version."
52+
exit 1
53+
fi
54+
55+
IFS='.' read -r MAJOR MINOR PATCH <<< "${TAG#v}"
56+
57+
echo "Major: $MAJOR, Minor: $MINOR, Patch: $PATCH"
58+
RELEASE_BRANCH="release-v${MAJOR}.${MINOR}.0"
59+
DOCS_BRANCH="docs-v${MAJOR}.${MINOR}.0"
60+
61+
echo "DOCS_BRANCH=${DOCS_BRANCH}" >> $GITHUB_OUTPUT
62+
echo "RELEASE_BRANCH=${RELEASE_BRANCH}" >> $GITHUB_OUTPUT
63+
64+
if [ "$PATCH" -ne 0 ]; then
65+
# If it's a patch version, create a PR to merge release branch into docs branch
66+
echo "Creating PR to merge ${RELEASE_BRANCH} into ${DOCS_BRANCH}"
67+
echo "PR_TITLE=chore: Merge ${RELEASE_BRANCH} into ${DOCS_BRANCH}"
68+
else
69+
# If the patch version is zero, create a new docs branch
70+
echo "Creating new docs branch ${DOCS_BRANCH}"
71+
fi
72+
echo "PR_TITLE=${PR_TITLE:-}" >> $GITHUB_OUTPUT
73+
74+
- name: Create Pull Request for Docs
75+
if: ${{ steps.validate_tag.outputs.PR_TITLE != '' }}
76+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
77+
with:
78+
token: ${{ steps.gh-app-token.outputs.token }}
79+
title: ${{ steps.validate_tag.outputs.PR_TITLE }}
80+
body: Automatically generated PR to merge release branch into docs branch
81+
for patch version update.
82+
base: ${{ steps.validate_tag.outputs.DOCS_BRANCH }}
83+
sign-commits: true
84+
branch: ${{ steps.validate_tag.outputs.RELEASE_BRANCH }}
85+
commit-message: ${{ steps.validate_tag.outputs.PR_TITLE }}
86+
87+
- name: Create Docs Branch
88+
if: ${{ steps.validate_tag.outputs.PR_TITLE == '' }}
89+
run: |
90+
echo "Creating docs branch ${DOCS_BRANCH}"
91+
92+
git checkout -b "${DOCS_BRANCH}"
93+
git push origin "${DOCS_BRANCH}"
94+
env:
95+
DOCS_BRANCH: ${{ steps.validate_tag.outputs.DOCS_BRANCH }}

.github/workflows/release-please.yml

+11-24
Original file line numberDiff line numberDiff line change
@@ -50,28 +50,6 @@ jobs:
5050
fetch-depth: 0
5151
token: ${{ steps.gh-app-token.outputs.token }}
5252

53-
- name: Check release branch
54-
id: check_branch
55-
run: |
56-
RELEASE_BRANCH=${{ github.ref_name }}
57-
CURRENT_VERSION=$(echo "$RELEASE_BRANCH" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n 1)
58-
echo "CURRENT_VERSION=$CURRENT_VERSION" >> $GITHUB_OUTPUT
59-
60-
# Sort release branches
61-
HIGHER_BRANCHES=$(git branch -r | grep release-v | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -V | tail -n +2)
62-
if [[ -n "$HIGHER_BRANCHES" ]]; then
63-
# Extract the highest version
64-
HIGHEST_VERSION=$(echo "$HIGHER_BRANCHES" | tail -n 1)
65-
if [[ "$CURRENT_VERSION" == "$HIGHEST_VERSION" ]]; then
66-
echo "run_release_please=true" >> $GITHUB_OUTPUT
67-
else
68-
echo "run_release_please=false" >> $GITHUB_OUTPUT
69-
echo "Release-please skipped for branch: $RELEASE_BRANCH. Higher versioned release branches exist."
70-
fi
71-
else
72-
echo "run_release_please=true" >> $GITHUB_OUTPUT # if no higher version branch exists run release-please.
73-
fi
74-
7553
- name: Get merged PR number from commit
7654
id: get_pr
7755
run: |
@@ -123,15 +101,15 @@ jobs:
123101
- name: Start release please action
124102
id: release
125103
uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4.2.0
126-
if: ${{ steps.check_branch.outputs.run_release_please == 'true' }}
127104
with:
128105
token: ${{ steps.gh-app-token.outputs.token }}
129106
target-branch: ${{ github.ref_name }}
130107
config-file: .github/release-please/.config.json
131108
manifest-file: .github/release-please/manifest.json
132109

133110
- name: Get release branch name on release please prs
134-
if: ${{ steps.release.outputs.releases_created == 'false' }}
111+
if: ${{ steps.release.outputs.releases_created == 'false' && steps.release.outputs.pr
112+
!= '' }}
135113
id: get_release_branch
136114
run: |
137115
echo "release_branch=${{ fromJSON(steps.release.outputs.pr).headBranchName }}" >> $GITHUB_OUTPUT
@@ -229,3 +207,12 @@ jobs:
229207
with:
230208
tag: ${{ needs.release-please.outputs.tag }}
231209
secrets: inherit
210+
211+
# Trigger workflow to publish docs
212+
release-docs:
213+
if: ${{ needs.release-please.outputs.release_created == 'true' }}
214+
needs: [release-please, release-binaries, release-docker]
215+
uses: ./.github/workflows/release-docs.yml
216+
with:
217+
tag: ${{ needs.release-please.outputs.tag }}
218+
secrets: inherit

.github/workflows/scorecard.yml

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
---
2+
# This workflow uses actions that are not certified by GitHub. They are provided
3+
# by a third-party and are governed by separate terms of service, privacy
4+
# policy, and support documentation.
5+
6+
name: Scorecard supply-chain security
7+
on:
8+
# For Branch-Protection check. Only the default branch is supported. See
9+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
10+
branch_protection_rule:
11+
# To guarantee Maintained check is occasionally updated. See
12+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
13+
schedule:
14+
- cron: 35 1 * * 6
15+
push:
16+
branches: [main]
17+
18+
# Declare default permissions as read only.
19+
permissions: read-all
20+
21+
jobs:
22+
analysis:
23+
name: Scorecard analysis
24+
runs-on: ubuntu-latest
25+
permissions:
26+
# Needed to upload the results to code-scanning dashboard.
27+
security-events: write
28+
# Needed to publish results and get a badge (see publish_results below).
29+
id-token: write
30+
31+
steps:
32+
- name: Harden Runner
33+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
34+
with:
35+
egress-policy: audit
36+
37+
- uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
38+
id: gh-app-token
39+
with:
40+
app-id: ${{ vars.GH_APP_ID }}
41+
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
42+
43+
- name: Checkout code
44+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
45+
with:
46+
persist-credentials: false
47+
token: ${{ steps.gh-app-token.outputs.token }}
48+
49+
- name: Run analysis
50+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
51+
with:
52+
results_file: results.sarif
53+
results_format: sarif
54+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
55+
# - you want to enable the Branch-Protection check on a *public* repository, or
56+
# - you are installing Scorecard on a *private* repository
57+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
58+
repo_token: ${{ steps.gh-app-token.outputs.token }}
59+
60+
# Public repositories:
61+
# - Publish results to OpenSSF REST API for easy access by consumers
62+
# - Allows the repository to include the Scorecard badge.
63+
# - See https://github.com/ossf/scorecard-action#publishing-results.
64+
publish_results: true
65+
66+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
67+
# format to the repository Actions tab.
68+
- name: Upload artifact
69+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
70+
with:
71+
name: SARIF file
72+
path: results.sarif
73+
retention-days: 5
74+
75+
# Upload the results to GitHub's code scanning dashboard.
76+
- name: Upload to code-scanning
77+
uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
78+
with:
79+
sarif_file: results.sarif

.typos.toml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[files]
2+
extend-exclude = ["CHANGELOG.md"]

0 commit comments

Comments
 (0)