Skip to content

Commit 5edef55

Browse files
author
Shaun Persad
authored
Merge pull request #538 from cloudflare/staging
Release new actions
2 parents 0d08b8b + 9f5352b commit 5edef55

28 files changed

+1145
-500
lines changed

‎.github/actions/setup/action.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: "Setup Environment"
2+
description: "Performs the repo setup including cloning, dependency installation, and node setup."
3+
4+
runs:
5+
using: "composite"
6+
steps:
7+
- uses: actions/checkout@v4
8+
9+
- name: Cache turbo build setup
10+
uses: actions/cache@v4
11+
with:
12+
path: .turbo
13+
key: ${{ runner.os }}-turbo-${{ github.sha }}
14+
restore-keys: |
15+
${{ runner.os }}-turbo-
16+
17+
- name: Install pnpm
18+
uses: pnpm/action-setup@v4
19+
20+
- name: Use Node.js
21+
uses: actions/setup-node@v4
22+
with:
23+
node-version: "20.x"
24+
cache: "pnpm"
25+
26+
- name: Install dependencies
27+
run: pnpm install --frozen-lockfile --child-concurrency=10
28+
shell: bash

‎.github/dependabot.yml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,94 @@ updates:
1010
- "**/*"
1111
target-branch: "staging"
1212
schedule:
13+
# just in time for on-call handoff
1314
interval: "weekly"
15+
day: "monday"
16+
time: "09:00"
17+
timezone: "America/New_York"
18+
groups:
19+
# consolidates dependabot PRs into a single grouped PR
20+
non-breaking-wrangler-updates:
21+
applies-to: version-updates
22+
patterns:
23+
- "wrangler"
24+
update-types:
25+
- "minor"
26+
- "patch"
27+
breaking-wrangler-updates:
28+
applies-to: version-updates
29+
patterns:
30+
- "wrangler"
31+
update-types:
32+
- "major"
33+
non-breaking-vite-updates:
34+
applies-to: version-updates
35+
patterns:
36+
- "vite"
37+
- "vitest"
38+
- "@cloudflare/vite*"
39+
update-types:
40+
- "minor"
41+
- "patch"
42+
breaking-vite-updates:
43+
applies-to: version-updates
44+
patterns:
45+
- "vite"
46+
- "vitest"
47+
- "@cloudflare/vite*"
48+
update-types:
49+
- "major"
50+
non-breaking-typescript-updates:
51+
applies-to: version-updates
52+
patterns:
53+
- "typescript"
54+
update-types:
55+
- "minor"
56+
- "patch"
57+
breaking-typescript-updates:
58+
applies-to: version-updates
59+
patterns:
60+
- "typescript"
61+
update-types:
62+
- "major"
63+
non-breaking-eslint-updates:
64+
applies-to: version-updates
65+
patterns:
66+
- "eslint*"
67+
update-types:
68+
- "minor"
69+
- "patch"
70+
breaking-eslint-updates:
71+
applies-to: version-updates
72+
patterns:
73+
- "eslint*"
74+
update-types:
75+
- "major"
76+
non-breaking-react-updates:
77+
applies-to: version-updates
78+
patterns:
79+
- "react"
80+
- "react-dom"
81+
update-types:
82+
- "minor"
83+
- "patch"
84+
breaking-react-updates:
85+
applies-to: version-updates
86+
patterns:
87+
- "react"
88+
- "react-dom"
89+
update-types:
90+
- "major"
91+
non-breaking-astro-updates:
92+
applies-to: version-updates
93+
patterns:
94+
- "@astro/*"
95+
update-types:
96+
- "minor"
97+
- "patch"
98+
breaking-astro-updates:
99+
applies-to: version-updates
100+
patterns:
101+
- "astro/*"
102+
update-types:
103+
- "major"

‎.github/workflows/branches.yaml‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎.github/workflows/main.yaml‎

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,26 +5,19 @@ on:
55
branches: ["main"]
66

77
jobs:
8-
check-and-deploy:
8+
check-and-deploy-main:
99
name: Check and Deploy
1010
runs-on: ubuntu-latest
1111
timeout-minutes: 20
12-
concurrency: templates-check-and-deploy
12+
concurrency: templates-check-and-deploy-main
1313
env:
1414
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
1515
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
1616
TEMPLATES_API_CLIENT_ID: ${{ secrets.TEMPLATES_API_CLIENT_ID }}
1717
TEMPLATES_API_CLIENT_SECRET: ${{ secrets.TEMPLATES_API_CLIENT_SECRET }}
1818
steps:
1919
- uses: actions/checkout@v4
20-
- name: Install pnpm
21-
uses: pnpm/action-setup@v4
22-
- name: Use Node.js
23-
uses: actions/setup-node@v4
24-
with:
25-
node-version: "20.x"
26-
cache: "pnpm"
27-
- run: pnpm install --frozen-lockfile
28-
- run: pnpm -w check:ci
29-
- run: pnpm run deploy
30-
- run: pnpm run upload
20+
- uses: ./.github/actions/setup
21+
- run: pnpm -w check
22+
- run: pnpm -w test
23+
- run: pnpm -w deploy

‎.github/workflows/pull-request-dont-block-previews.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# runs additional checks that can block the PR, but still allow preview links to be generated
2+
name: "Pull Request Supplemental Checks"
3+
4+
on:
5+
pull_request: # this action runs in an untrusted but secure context with no secrets
6+
types:
7+
- opened
8+
- reopened
9+
- synchronize
10+
11+
jobs:
12+
supplemental-check:
13+
runs-on: ubuntu-latest
14+
timeout-minutes: 10
15+
concurrency:
16+
group: ${{ github.workflow }}-${{ github.ref }}-check
17+
cancel-in-progress: true
18+
steps:
19+
- uses: actions/checkout@v4
20+
- uses: ./.github/actions/setup
21+
22+
- name: Validate live demo links
23+
run: pnpm -w validate-live-demo-links
24+
25+
- name: Validate Deploy to Cloudflare buttons
26+
run: pnpm -w validate-d2c-buttons

‎.github/workflows/pull-request-workflow-run.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: "Pull Request Workflow Run"
2+
3+
on:
4+
workflow_run: # this action runs in a trusted context, but passed info from the "Pull Request" untrusted workflow
5+
workflows: ["Pull Request"]
6+
types:
7+
- completed
8+
9+
permissions:
10+
pull-requests: write
11+
12+
env:
13+
PR_DIR: "_pr"
14+
PR_ZIP: "_pr.zip"
15+
PREVIEW_DIR: "_preview-templates"
16+
17+
jobs:
18+
preview:
19+
runs-on: ubuntu-latest
20+
if: ${{ github.event.workflow_run.conclusion == 'success' }}
21+
env:
22+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
23+
TEMPLATES_API_CLIENT_ID: ${{ secrets.TEMPLATES_API_CLIENT_ID }}
24+
TEMPLATES_API_CLIENT_SECRET: ${{ secrets.TEMPLATES_API_CLIENT_SECRET }}
25+
steps:
26+
- uses: actions/checkout@v4
27+
- uses: ./.github/actions/setup
28+
29+
- name: "Download pull request info"
30+
uses: actions/github-script@v7
31+
with:
32+
script: |
33+
var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
34+
owner: context.repo.owner,
35+
repo: context.repo.repo,
36+
run_id: ${{github.event.workflow_run.id }},
37+
});
38+
var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
39+
return artifact.name == "pr"
40+
})[0];
41+
var download = await github.rest.actions.downloadArtifact({
42+
owner: context.repo.owner,
43+
repo: context.repo.repo,
44+
artifact_id: matchArtifact.id,
45+
archive_format: 'zip',
46+
});
47+
var fs = require('fs');
48+
var path = require('path');
49+
fs.writeFileSync(path.join('${{github.workspace}}', process.env.PR_ZIP), Buffer.from(download.data));
50+
51+
- name: "Load PR info into environment variables"
52+
run: mkdir $PR_DIR && unzip $PR_ZIP -d $PR_DIR && cat $PR_DIR/env >> $GITHUB_ENV
53+
#
54+
# Note: Checking out the source of the PR means checking out untrusted code.
55+
# We shouldn't run any tests or package installs past this point.
56+
# Simply checking out to fetch the files is reasonable, however.
57+
# https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
58+
#
59+
- uses: actions/checkout@v4
60+
with:
61+
repository: ${{ env.PR_REPOSITORY }}
62+
ref: ${{ env.PR_REF }}
63+
path: ${{ env.PREVIEW_DIR }}
64+
persist-credentials: "false"
65+
66+
- name: "Make preview"
67+
run: |
68+
pnpm -w preview $PREVIEW_DIR \
69+
--repoFullName $PR_REPOSITORY \
70+
--branch $PR_REF \
71+
--pr $PR_ID

‎.github/workflows/pull-request.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: "Pull Request"
2+
3+
on:
4+
pull_request: # this action runs in an untrusted but secure context with no secrets
5+
types:
6+
- opened
7+
- reopened
8+
- synchronize
9+
10+
jobs:
11+
check:
12+
runs-on: ubuntu-latest
13+
timeout-minutes: 10
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}-check
16+
cancel-in-progress: true
17+
steps:
18+
- uses: actions/checkout@v4
19+
- uses: ./.github/actions/setup
20+
21+
- name: Run checks
22+
run: pnpm -w check
23+
24+
- name: Run tests
25+
run: pnpm -w test
26+
27+
- name: Save PR info # extract the info we need to run in the trusted context later
28+
run: |
29+
mkdir -p ./pr
30+
echo PR_ID=${{ github.event.number }} >> ./pr/env
31+
echo PR_REPOSITORY=${{ github.event.pull_request.head.repo.full_name }} >> ./pr/env
32+
echo PR_SHA=${{ github.event.pull_request.head.sha }} >> ./pr/env
33+
echo PR_REF=${{ github.event.pull_request.head.ref }} >> ./pr/env
34+
35+
- name: Upload PR info
36+
uses: actions/upload-artifact@v4
37+
with:
38+
name: pr
39+
path: pr/

‎.github/workflows/release.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: "Release"
2+
3+
on:
4+
release:
5+
types:
6+
- released
7+
8+
jobs:
9+
upload:
10+
runs-on: ubuntu-latest
11+
timeout-minutes: 10
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}-upload
14+
cancel-in-progress: true
15+
steps:
16+
- uses: actions/checkout@v4
17+
- uses: ./.github/actions/setup
18+
19+
- name: Make templates live and publicly accessible in the dash
20+
run: |
21+
pnpm run upload . \
22+
--repoFullName ${{ github.repository }} \
23+
--branch ${{ github.ref_name }}

‎.github/workflows/staging.yaml‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,25 +5,24 @@ on:
55
branches: ["staging"]
66

77
jobs:
8-
check-and-deploy:
9-
name: Check and Deploy
8+
check-and-upload-staging:
9+
name: Check and Upload
1010
runs-on: ubuntu-latest
1111
timeout-minutes: 20
12-
concurrency: templates-check-and-deploy
12+
concurrency: templates-check-and-upload-staging
1313
env:
1414
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
1515
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
1616
TEMPLATES_API_CLIENT_ID: ${{ secrets.TEMPLATES_API_CLIENT_ID }}
1717
TEMPLATES_API_CLIENT_SECRET: ${{ secrets.TEMPLATES_API_CLIENT_SECRET }}
1818
steps:
1919
- uses: actions/checkout@v4
20-
- name: Install pnpm
21-
uses: pnpm/action-setup@v4
22-
- name: Use Node.js
23-
uses: actions/setup-node@v4
24-
with:
25-
node-version: "20.x"
26-
cache: "pnpm"
27-
- run: pnpm install --frozen-lockfile
28-
- run: pnpm -w check:ci
29-
- run: pnpm run upload --staging
20+
- uses: ./.github/actions/setup
21+
22+
- run: pnpm -w check
23+
- run: pnpm -w test
24+
- run: |
25+
pnpm run upload . \
26+
--staging \
27+
--repoFullName ${{ github.repository }} \
28+
--branch ${{ github.ref_name }}

0 commit comments

Comments
 (0)