Skip to content

Commit a965f9d

Browse files
Ti8m-BigATi8m-BigA
committed
feat(init): adds release please
1 parent d9e16fc commit a965f9d

12 files changed

Lines changed: 276 additions & 54 deletions

‎.github/examples/frontend_default_workflow.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: "default workflow"
2+
3+
permissions:
4+
contents: write
5+
pull-requests: write
6+
id-token: write
7+
issues: write
8+
9+
on:
10+
pull_request:
11+
branches: [main, develop]
12+
push:
13+
branches: [main, develop]
14+
merge_group:
15+
branches: [main, develop]
16+
jobs:
17+
resolve-env:
18+
runs-on: ubuntu-latest
19+
environment: ${{ github.ref == 'refs/heads/develop' && 'develop' || 'integration' }}
20+
outputs:
21+
frontend_s3_bucket: ${{ steps.out.outputs.frontend_s3_bucket }}
22+
cloudfront_distribution_id: ${{ steps.out.outputs.cloudfront_distribution_id }}
23+
aws_region: ${{ steps.out.outputs.aws_region }}
24+
steps:
25+
- id: out
26+
run: |
27+
echo "resolving environment specific variables for environment $environment setting outputs for frontend_s3_bucket to ${{ vars.FRONTEND_S3_BUCKET }}"
28+
echo "frontend_s3_bucket=${{ vars.FRONTEND_S3_BUCKET }}" >> "$GITHUB_OUTPUT"
29+
echo "cloudfront_distribution_id=${{ vars.CLOUDFRONT_DISTRIBUTION_ID }}" >> "$GITHUB_OUTPUT"
30+
31+
frontend-workflow:
32+
name: '.'
33+
uses: ./.github/workflows/frontend_workflow.yml
34+
needs: resolve-env
35+
secrets:
36+
GH_ORG_PRIVATE_KEY: ${{ secrets.GH_ORG_PRIVATE_KEY }}
37+
GH_ORG_GITLEAKS_PRIVATE_KEY: ${{ secrets.GH_ORG_GITLEAKS_PRIVATE_KEY }}
38+
LICENSE_KEY_GITLEAKS: ${{ secrets.LICENSE_KEY_GITLEAKS }}
39+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
40+
AWS_OIDC_ROLE_ARN: ${{ secrets.AWS_OIDC_ROLE_ARN }}
41+
AWS_DEPLOYMENT_ROLE_ARN: ${{ secrets.AWS_DEPLOYMENT_ROLE_ARN }}
42+
with:
43+
app-id: ${{ vars.GH_ORG_APP_ID }}
44+
gitleaks-app-id: ${{ vars.GH_ORG_GITLEAKS_APP_ID }}
45+
aws-region: ${{ vars.AWS_REGION }}
46+
frontend-s3-bucket: ${{ needs.resolve-env.outputs.frontend_s3_bucket }}
47+
cloudfront-distribution-id: ${{ needs.resolve-env.outputs.cloudfront_distribution_id }}

‎.github/workflows/default_workflow.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
branches: [main]
6+
7+
jobs:
8+
release:
9+
uses: ./.github/workflows/release-please.yml
10+
with:
11+
release-type: simple
12+
target-branch: main
13+
app-id: ${{ vars.GH_ORG_APP_ID }}
14+
secrets:
15+
GH_ORG_PRIVATE_KEY: ${{ secrets.GH_ORG_PRIVATE_KEY }}

‎.github/workflows/frontend_build_deploy_s3.yml‎

Lines changed: 33 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,18 @@ on:
99
type: string
1010
required: true
1111
description: "environment to deploy to, used for selecting correct AWS credentials and CloudFront distribution based on environment specific secrets and variables"
12+
aws-region:
13+
type: string
14+
required: true
15+
description: "AWS region for deployment and AWS CLI commands"
16+
frontend-s3-bucket:
17+
type: string
18+
required: true
19+
description: "S3 bucket name for frontend deployment"
20+
cloudfront-distribution-id:
21+
type: string
22+
required: true
23+
description: "CloudFront distribution ID for cache invalidation"
1224
secrets:
1325
AWS_OIDC_ROLE_ARN:
1426
description: "OIDC role ARN for AWS credentials"
@@ -24,8 +36,11 @@ jobs:
2436
runs-on: ubuntu-latest
2537
environment: ${{ inputs.environment }}
2638
timeout-minutes: 5
27-
# todo activate once requried
28-
#FONTAWESOME_PACKAGE_TOKEN: ${{ secrets.FONTAWESOME_PACKAGE_TOKEN }}
39+
env:
40+
AWS_REGION: ${{ inputs.aws-region }}
41+
FRONTEND_S3_BUCKET: ${{ inputs.frontend-s3-bucket }}
42+
CLOUDFRONT_DISTRIBUTION_ID: ${{ inputs.cloudfront-distribution-id }}
43+
2944
permissions:
3045
id-token: write
3146
contents: read
@@ -59,17 +74,28 @@ jobs:
5974
# todo maybe adjust with env specific config eg: pnpm build -- --configuration=${{ steps.resolve-inputs.outputs.configuration }}
6075
run: pnpm build
6176

77+
- name: Validate deployment inputs
78+
env:
79+
VERSION: ${{ inputs.version }}
80+
run: |
81+
set -euo pipefail
82+
83+
[[ "$VERSION" =~ ^[0-9]+(\.[0-9]+){2}([.-][0-9A-Za-z]+)*$ ]] || { echo "Invalid version"; exit 1; }
84+
[[ "$AWS_REGION" =~ ^[a-z]{2}-[a-z]+-[0-9]+$ ]] || { echo "Invalid AWS region"; exit 1; }
85+
[[ "$FRONTEND_S3_BUCKET" =~ ^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$ ]] || { echo "Invalid S3 bucket"; exit 1; }
86+
[[ "$CLOUDFRONT_DISTRIBUTION_ID" =~ ^[A-Z0-9]{10,32}$ ]] || { echo "Invalid CloudFront distribution ID"; exit 1; }
87+
6288
- name: Configure AWS credentials (OIDC)
6389
uses: aws-actions/configure-aws-credentials@v4
6490
with:
6591
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
66-
aws-region: ${{ vars.AWS_REGION }}
92+
aws-region: ${{ env.AWS_REGION }}
6793

6894
- name: Assume deployment role
6995
uses: aws-actions/configure-aws-credentials@v4
7096
with:
7197
role-to-assume: ${{ secrets.AWS_DEPLOYMENT_ROLE_ARN }}
72-
aws-region: ${{ vars.AWS_REGION }}
98+
aws-region: ${{ env.AWS_REGION }}
7399
role-chaining: true
74100
role-skip-session-tagging: true
75101

@@ -79,21 +105,17 @@ jobs:
79105
run: |
80106
set -euo pipefail
81107
82-
# Allowlist validation (adjust to your conventions)
83-
[[ "$VERSION" =~ ^[0-9]+(\.[0-9]+){2}([.-][0-9A-Za-z]+)*$ ]] || { echo "Invalid version"; exit 1; }
84-
85-
86108
echo "Deploying version: v${VERSION}"
87109
88-
aws s3 sync "dist/atlas-agate-frontend/browser/" "s3://${{vars.FRONTEND_S3_BUCKET}}/" \
110+
aws s3 sync "dist/atlas-agate-frontend/browser/" "s3://${FRONTEND_S3_BUCKET}/" \
89111
--region "$AWS_REGION" \
90112
--delete
91113
92114
- name: Invalidate CloudFront cache
93115
run: |
94-
echo "Creating CloudFront invalidation for distribution: ${{ vars.CLOUDFRONT_DISTRIBUTION_ID }}"
116+
echo "Creating CloudFront invalidation for distribution: ${CLOUDFRONT_DISTRIBUTION_ID}"
95117
aws cloudfront create-invalidation \
96-
--distribution-id ${{ vars.CLOUDFRONT_DISTRIBUTION_ID }} \
118+
--distribution-id "$CLOUDFRONT_DISTRIBUTION_ID" \
97119
--paths "/*"
98120
99121
- name: Display deployment URL

‎.github/workflows/frontend_unit_test_sonarqube.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,6 @@ jobs:
1111
timeout-minutes: 10
1212
env:
1313
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
14-
#env:
15-
#todo activate once needed
16-
#FONTAWESOME_PACKAGE_TOKEN: ${{ secrets.FONTAWESOME_PACKAGE_TOKEN }}
1714
steps:
1815
- name: Checkout
1916
uses: actions/checkout@v6

‎.github/workflows/frontend_workflow.yml‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,31 @@ on:
1010
workflow_call:
1111
inputs:
1212
app-id:
13-
description: "GitHub App ID used for downstream workflows"
13+
description: "GitHub App ID used for downstream workflows (like semantic versioning), must have write permissions to the repo"
14+
required: true
15+
type: string
16+
gitleaks-app-id:
17+
description: "GitHub App ID used by gitleaks to authenticate with the GitHub API (must have read permissions to the repo and prs"
18+
required: true
19+
type: string
20+
aws-region:
21+
description: "AWS region for deployment"
22+
required: true
23+
type: string
24+
frontend-s3-bucket:
25+
description: "S3 bucket name for frontend deployment"
26+
required: true
27+
type: string
28+
cloudfront-distribution-id:
29+
description: "CloudFront distribution ID for cache invalidation"
1430
required: true
1531
type: string
1632
secrets:
1733
GH_ORG_PRIVATE_KEY:
18-
description: "GitHub App private key used for downstream workflows"
34+
description: "GitHub App private key matching the app-id inputs"
1935
required: true
2036
GH_ORG_GITLEAKS_PRIVATE_KEY:
21-
description: "GitHub App private key used for gitleaks token"
37+
description: "GitHub App private key matching the gitleaks-app-id input, used for gitleaks authentication"
2238
required: true
2339
LICENSE_KEY_GITLEAKS:
2440
description: "Gitleaks license key"
@@ -45,6 +61,8 @@ jobs:
4561
secrets:
4662
GH_ORG_GITLEAKS_PRIVATE_KEY: ${{ secrets.GH_ORG_GITLEAKS_PRIVATE_KEY }}
4763
LICENSE_KEY_GITLEAKS: ${{ secrets.LICENSE_KEY_GITLEAKS }}
64+
with:
65+
gitleaks-app-id: ${{ inputs.gitleaks-app-id }}
4866

4967
vulnerability-scan:
5068
name: '.'
@@ -53,7 +71,7 @@ jobs:
5371

5472
unit-test-sonarqube:
5573
name: '.'
56-
uses: frontend_unit_test_sonarqube.yml
74+
uses: ./.github/workflows/frontend_unit_test_sonarqube.yml
5775
needs: [ vulnerability-scan, gitleaks ]
5876
secrets:
5977
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -79,6 +97,9 @@ jobs:
7997
with:
8098
version: ${{ needs.semantic-release.outputs.version }}
8199
environment: ${{ github.ref == 'refs/heads/develop' && 'develop' || 'integration' }}
100+
aws-region: ${{ inputs.aws-region }}
101+
frontend-s3-bucket: ${{ inputs.frontend-s3-bucket }}
102+
cloudfront-distribution-id: ${{ inputs.cloudfront-distribution-id }}
82103

83104
merge-main-develop:
84105
name: '.'
@@ -87,3 +108,5 @@ jobs:
87108
needs: [ semantic-release ]
88109
secrets:
89110
GH_ORG_PRIVATE_KEY: ${{ secrets.GH_ORG_PRIVATE_KEY }}
111+
with:
112+
app-id: ${{ inputs.app-id }}

‎.github/workflows/gitleaks.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
on:
22
workflow_call:
3+
inputs:
4+
gitleaks-app-id:
5+
description: "GitHub App ID used by gitleaks to authenticate with the GitHub API (must have read permissions to the repo and prs)"
6+
required: true
7+
type: string
38
secrets:
49
GH_ORG_GITLEAKS_PRIVATE_KEY:
5-
description: "GitHub App private key used for gitleaks token"
10+
description: "GitHub App private key used for the gitleaks-app-id"
611
required: true
712
LICENSE_KEY_GITLEAKS:
813
description: "Gitleaks license key"
@@ -28,7 +33,7 @@ jobs:
2833
- uses: actions/create-github-app-token@v2
2934
id: app-token
3035
with:
31-
app-id: ${{ vars.GH_ORG_GITLEAKS_APP_ID }}
36+
app-id: ${{ inputs.gitleaks-app-id }}
3237
private-key: ${{ secrets.GH_ORG_GITLEAKS_PRIVATE_KEY }}
3338

3439
- name: Run Gitleaks Scan

‎.github/workflows/merge_main_develop.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
on:
22
workflow_call:
3+
inputs:
4+
app-id:
5+
description: "GitHub App ID used to create merge commit , must have write permissions to the repo"
6+
required: true
7+
type: string
38
secrets:
49
GH_ORG_PRIVATE_KEY:
5-
description: "GitHub App private key used to create the merge token"
10+
description: "GitHub App private key of the app specified in app-id, used to create the merge token"
611
required: true
712

813
jobs:
@@ -14,7 +19,7 @@ jobs:
1419
- uses: actions/create-github-app-token@v2
1520
id: app-token
1621
with:
17-
app-id: ${{ vars.GH_ORG_APP_ID }}
22+
app-id: ${{ inputs.app-id }}
1823
private-key: ${{ secrets.GH_ORG_PRIVATE_KEY }}
1924

2025
- name: Set up Git user for GitHub App

‎.github/workflows/release-please.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
release-type:
5+
description: "Release Please release type (node, java, go, python, etc.)"
6+
required: false
7+
type: string
8+
default: node
9+
target-branch:
10+
description: "Branch to open release PRs against (usually main)"
11+
required: false
12+
type: string
13+
default: main
14+
config-file:
15+
description: "Optional Release Please config file path"
16+
required: false
17+
type: string
18+
default: ""
19+
manifest-file:
20+
description: "Optional Release Please manifest file path"
21+
required: false
22+
type: string
23+
default: ""
24+
app-id:
25+
description: "GitHub App ID used to create the release token"
26+
required: true
27+
type: string
28+
secrets:
29+
GH_ORG_PRIVATE_KEY:
30+
description: "GitHub App private key used to create the release token"
31+
required: true
32+
33+
permissions:
34+
contents: write
35+
pull-requests: write
36+
37+
jobs:
38+
39+
release-please:
40+
runs-on: ubuntu-latest
41+
steps:
42+
- uses: actions/create-github-app-token@v2
43+
id: app-token
44+
env:
45+
GH_ORG_APP_ID: ${{ inputs.app-id }}
46+
GH_ORG_PRIVATE_KEY: ${{ secrets.GH_ORG_PRIVATE_KEY }}
47+
with:
48+
app-id: ${{ env.GH_ORG_APP_ID }}
49+
private-key: ${{ env.GH_ORG_PRIVATE_KEY }}
50+
51+
- name: Release Please
52+
id: rp
53+
uses: googleapis/release-please-action@v4
54+
with:
55+
# Use provided token if present, otherwise default to GITHUB_TOKEN
56+
token: ${{ steps.app-token.outputs.token }}
57+
release-type: ${{ inputs.release-type }}
58+
target-branch: ${{ inputs.target-branch }}
59+
60+
# Only pass these when set (empty string is fine; action ignores missing files if not used)
61+
config-file: ${{ inputs.config-file }}
62+
manifest-file: ${{ inputs.manifest-file }}
63+
64+
- name: Output summary
65+
if: ${{ always() }}
66+
run: |
67+
echo "release_created=${{ steps.rp.outputs.release_created }}"
68+
echo "pr_created=${{ steps.rp.outputs.pr_created }}"
69+
echo "tag_name=${{ steps.rp.outputs.tag_name }}"

‎.github/workflows/sample_frontend_default_workflow.yml‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎.github/workflows/semantic_release.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,4 +56,14 @@ jobs:
5656
id: semantic-release
5757
env:
5858
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
59-
run: pnpm --package=semantic-release@24.2.0 --package=@semantic-release/git@10.0.1 --package=@semantic-release/changelog@6.0.3 --package=@semantic-release/github@11.0.2 --package=@semantic-release/exec@7.0.3 --package=@semantic-release/commit-analyzer@13.0.1 --package=@semantic-release/release-notes-generator@14.0.3 --package=conventional-changelog-conventionalcommits@8.0.0 --package=@semantic-release/exec@7.0.3 dlx semantic-release
59+
run: |
60+
pnpm dlx \
61+
--package=semantic-release@25.0.3 \
62+
--package=@semantic-release/git@^10.0.1 \
63+
--package=@semantic-release/changelog@6.0.3 \
64+
--package=@semantic-release/github@12.0.6 \
65+
--package=@semantic-release/exec@7.1.0 \
66+
--package=@semantic-release/commit-analyzer@13.0.1 \
67+
--package=@semantic-release/release-notes-generator@14.1.0 \
68+
--package=conventional-changelog-conventionalcommits@9.2.0 \
69+
semantic-release

0 commit comments

Comments
 (0)