chore: Update release workflow (#509)

Author: cgero-eth

.changeset/all-turtles-yell.md

@@ -0,0 +1,5 @@
+---
+'@aragon/gov-ui-kit': patch
+---
+
+Update release workflow

.github/workflows/library-publish.yml

@@ -8,6 +8,14 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
+      - name: Load secrets from OP
+        id: load-secrets
+        uses: 1password/load-secrets-action@v2.0.0
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          NPM_TOKEN: op://kv_gov-ui-kit_infra/NPM_TOKEN/credential
       - name: Setup
         uses: aragon/gov-ui-kit/.github/actions/setup@main
         with:
@@ -18,7 +26,7 @@ jobs:
         run: yarn build
       - name: Publish library
         run: |
-          yarn config set npmAuthToken ${{ secrets.NPM_TOKEN }}
+          yarn config set npmAuthToken ${{ steps.load-secrets.outputs.NPM_TOKEN }}
           yarn npm publish --access public
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ steps.load-secrets.outputs.NPM_TOKEN }}

.github/workflows/library-release.yml

@@ -8,14 +8,27 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
     steps:
+      - name: Load secrets
+        id: load-secrets
+        uses: 1password/load-secrets-action@v2.0.0
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          GPG_PASSPHRASE: op://kv_gov-ui-kit_infra/arabot-1_SIGN_CERTS/credential
+          GPG_PRIVATE_KEY: op://kv_gov-ui-kit_infra/arabot-1_SIGN_CERTS/private_key
+          ARABOT_PAT_TRIGGER_WORKFLOW: op://kv_gov-ui-kit_infra/GITHUB_PAT/credential
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@v6.3.0
+        with:
+          gpg_private_key: ${{ steps.load-secrets.outputs.GPG_PRIVATE_KEY }}
+          passphrase: ${{ steps.load-secrets.outputs.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
       - name: Setup
         uses: aragon/gov-ui-kit/.github/actions/setup@main
         with:
-          token: ${{ secrets.ARABOT_PAT_TRIGGER_WORKFLOW }}
-      - name: Setup Git config
-        run: |
-          git config --global user.name "Arabot-1"
-          git config --global user.email "arabot-1@users.noreply.github.com"
+          token: ${{ steps.load-secret.outputs.ARABOT_PAT_TRIGGER_WORKFLOW }}
       - name: Update version and changelog
         # Run prettier on CHANGELOG.md file (used for Github release notes) to remove automatic formatting applied by
         # changeset as Github does not support soft line breaks.
@@ -24,7 +37,7 @@ jobs:
           yarn changeset version
           yarn prettier --write CHANGELOG.md --print-width 9999999 --ignore-path
         env:
-          GITHUB_TOKEN: ${{ secrets.ARABOT_PAT_TRIGGER_WORKFLOW }}
+          GITHUB_TOKEN: ${{ steps.load-secrets.outputs.ARABOT_PAT_TRIGGER_WORKFLOW }}
       - name: Create tag
         run: yarn changeset tag
       - name: Get package version
@@ -51,4 +64,4 @@ jobs:
           prerelease: false
           tag_name: "v${{ steps.package-version.outputs.current-version}}"
           body: ${{ steps.read-changelog.outputs.changes }}
-          token: ${{ secrets.ARABOT_PAT_TRIGGER_WORKFLOW }}
+          token: ${{ steps.load-secrets.outputs.ARABOT_PAT_TRIGGER_WORKFLOW }}

.github/workflows/library-snapshot.yml

@@ -7,28 +7,37 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
+      - name: Load secrets from OP
+        id: load-secrets
+        uses: 1password/load-secrets-action@v2.0.0
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          ARABOT_PAT_TRIGGER_WORKFLOW: op://kv_gov-ui-kit_infra/GITHUB_PAT/credential
+          NPM_TOKEN: op://kv_gov-ui-kit_infra/NPM_TOKEN/credential
       - name: Setup
         uses: aragon/gov-ui-kit/.github/actions/setup@main
         with:
           # Checkout full history to correclty check changeset status
           fetch-depth: 0
-          token: ${{ secrets.ARABOT_PAT_TRIGGER_WORKFLOW }}
+          token: ${{ steps.load-secrets.outputs.ARABOT_PAT_TRIGGER_WORKFLOW }}
       - name: Check changeset
         run: yarn changeset status --since origin/main
       - name: Build library
         run: yarn build
       - name: Update version
         run: yarn changeset version --snapshot
         env:
-          GITHUB_TOKEN: ${{ secrets.ARABOT_PAT_TRIGGER_WORKFLOW }}
+          GITHUB_TOKEN: ${{ steps.load-secrets.outputs.ARABOT_PAT_TRIGGER_WORKFLOW }}
       - name: Get package version
         id: package-version
         uses: martinbeentjes/npm-get-version-action@v1.3.1
       - name: Publish snapshot
         run: |
-          yarn config set npmAuthToken ${{ secrets.NPM_TOKEN }}
+          yarn config set npmAuthToken ${{ steps.load-secrets.outputs.NPM_TOKEN }}
           yarn npm publish --access public --tag ${{ steps.package-version.outputs.current-version }}
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ steps.load-secrets.outputs.NPM_TOKEN }}
       - name: Print snapshot version
         run: echo "Snapshot release - ${{ steps.package-version.outputs.current-version }}"

.github/workflows/storybook-preview.yml

@@ -22,9 +22,17 @@ jobs:
     permissions:
       pull-requests: write
     steps:
+      - name: Load secrets from OP
+        id: load-secrets
+        uses: 1password/load-secrets-action@v2.0.0
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          ARABOT_PAT_TRIGGER_WORKFLOW: op://kv_gov-ui-kit_infra/GITHUB_PAT/credential
       - name: Comment preview PR
         uses: thollander/actions-comment-pull-request@v3.0.1
         with:
           message: "🚀 **Preview Deployment:** [View Here](${{ needs.deploy.outputs.deploymentUrl }})"
           comment-tag: preview-url
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.load-secrets.outputs.ARABOT_PAT_TRIGGER_WORKFLOW }}