Merge pull request #2848 from rainlanguage/arda/market-data-webapp #1041
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ## | |
| ## SECURITY MODEL FOR VERCEL PRODUCTION DEPLOYS (READ BEFORE EDITING) | |
| ## | |
| ## This workflow runs on main pushes in this repository: | |
| ## - The wrapper (checkout, nix, caches, build, Vercel pull + deploy, security | |
| ## hardening) lives in the rainix `rainix-vercel.yaml` reusable workflow; this | |
| ## file is a thin caller that selects the production environment and maps | |
| ## secrets. | |
| ## - Secrets are passed only to the Vercel CLI steps inside the reusable | |
| ## workflow, never to the build step. | |
| ## | |
| ## WARNING: Changing any of the following may break the security model: | |
| ## - Triggers (the main push + webapp paths). | |
| ## - The reusable workflow ref / inputs. | |
| ## If you modify this file, re-validate these invariants (and those in rainix). | |
| name: GitHub Actions Vercel Production Deployment | |
| on: | |
| push: | |
| branches: | |
| - main | |
| # Only redeploy prod when something webapp-relevant changed (see | |
| # vercel-preview.yaml for the rationale) — a sol-only main merge shouldn't | |
| # rebuild + redeploy the webapp. | |
| paths: | |
| - 'packages/**' | |
| - 'crates/**' | |
| - 'package.json' | |
| - 'package-lock.json' | |
| - 'flake.nix' | |
| - 'flake.lock' | |
| - 'script/vercel-build.sh' | |
| - '.github/workflows/vercel-prod.yaml' | |
| jobs: | |
| production: | |
| uses: rainlanguage/rainix/.github/workflows/rainix-vercel.yaml@main | |
| with: | |
| environment: production | |
| production: true | |
| # Pin the canary Vercel CLI version for the deploy. | |
| vercel-version: canary | |
| secrets: | |
| VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} | |
| VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} | |
| VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID_V6 }} | |
| WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID }} | |
| CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} | |
| TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }} | |
| # The npm-package blacklist check is intentionally kept out of the reusable | |
| # Vercel workflow (it's a repo-specific policy gate, not part of the deploy | |
| # wrapper), so it runs here as a separate job. The action needs an installed | |
| # dependency tree (it runs `npm ls --all`), so install workspace deps first; | |
| # no wasm/webapp build is required just to inspect the tree. | |
| npm-blacklist: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: nixbuild/nix-quick-install-action@v30 | |
| with: | |
| nix_conf: | | |
| keep-env-derivations = true | |
| keep-outputs = true | |
| - uses: cachix/cachix-action@v15 | |
| continue-on-error: true | |
| with: | |
| name: rainlanguage | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| useDaemon: false | |
| - name: Restore and save Nix store | |
| uses: nix-community/cache-nix-action@v7 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-linux: 8G | |
| - name: Install npm dependencies | |
| run: nix develop .#wasm-shell -c npm install --no-check | |
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | |
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | |
| with: | |
| working-directory: packages/raindex | |
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | |
| with: | |
| working-directory: packages/ui-components |