Skip to content

Commit 21c9ec1

Browse files
ancheetahancheetah
authored
Merge pull request #551 from ForgeRock/SDKS-4448-update-publish
SDKS-4448: Update CI/CD
2 parents 6d1ae39 + 9bf7370 commit 21c9ec1

File tree

8 files changed

+710
-61
lines changed

8 files changed

+710
-61
lines changed

‎.github/actions/setup-publish/action.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
name: Setup publish
2+
description: Setup steps for publishing packages
3+
4+
inputs:
5+
branch:
6+
required: true
7+
8+
runs:
9+
using: 'composite'
10+
steps:
11+
- name: Checkout repository
12+
uses: actions/checkout@v4
13+
with:
14+
fetch-depth: 0
15+
ref: ${{ inputs.branch }}
16+
17+
- name: Install pnpm
18+
uses: pnpm/action-setup@v4
19+
with:
20+
run_install: false # don't install any packages yet
21+
22+
- name: Install Node.js
23+
uses: actions/setup-node@v4
24+
id: cache
25+
with:
26+
node-version: '.node-version'
27+
cache: 'pnpm' # package manager for caching
28+
registry-url: 'https://registry.npmjs.org'
29+
30+
# Update npm to latest for provenance
31+
- name: Update npm
32+
run: npm install -g npm@latest
33+
34+
- name: Install dependencies from lockfile
35+
run: pnpm install --frozen-lockfile
36+
37+
# Allocate nx tasks across multiple machines/agents in the cloud
38+
# The "--stop-agents-after" is optional, but allows idle agents to shut down once the "e2e-ci" targets have been requested
39+
# https://nx.dev/docs/features/ci-features/distribute-task-execution
40+
- name: Enable distribution of nx tasks to cloud agents
41+
run: pnpm dlx nx-cloud start-ci-run --distribute-on="5 linux-medium-js" --stop-agents-after="e2e-ci" --with-env-vars="CODECOV_TOKEN"
42+
env:
43+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
44+
45+
# https://github.com/microsoft/playwright/issues/7249#issuecomment-1256878540
46+
- name: Cache Playwright browsers
47+
uses: actions/cache@v4
48+
with:
49+
path: ~/.cache/ms-playwright
50+
key: ${{ runner.os }}-playwright-${{ hashFiles('**/pnpm-lock.yaml') }}
51+
restore-keys: |
52+
${{ runner.os }}-playwright-
53+
54+
- name: Install Playwright browsers
55+
run: pnpm exec playwright install
56+
57+
- name: Derive SHAs for `nx affected`
58+
uses: nrwl/nx-set-shas@v4
59+
with:
60+
main-branch-name: master
61+
62+
- name: Run build, lint, test, and e2e for projects changed
63+
run: pnpm exec nx affected -t build lint test e2e-ci --agents
64+
65+
- name: Save Playwright test results
66+
uses: actions/upload-artifact@v4
67+
if: ${{ !cancelled() }}
68+
with:
69+
name: playwright-report
70+
path: |
71+
./dist/.playwright/**
72+
./dist/**
73+
retention-days: 30
74+
75+
- name: Ensure builds for all packages before publishing
76+
run: pnpm exec nx run-many -t build --no-agents # --no-agents to run in CI without distributing to agents

‎.github/workflows/ci-fork.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: ForgeRock Fork Pull Request CI
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: read
8+
actions: read
9+
10+
concurrency:
11+
group: pr-${{ github.event.pull_request.number }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
pr:
16+
# Only run for forks
17+
if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
18+
runs-on: ubuntu-latest
19+
timeout-minutes: 20
20+
21+
steps:
22+
- uses: actions/checkout@v4
23+
with:
24+
# head commit is fine; the default merge ref also works on pull_request
25+
ref: ${{ github.event.pull_request.head.sha }}
26+
fetch-depth: 0
27+
28+
- uses: pnpm/action-setup@v4
29+
with:
30+
run_install: false
31+
32+
- uses: actions/setup-node@v4
33+
with:
34+
node-version-file: '.node-version'
35+
cache: 'pnpm'
36+
cache-dependency-path: '**/pnpm-lock.yaml'
37+
38+
- run: pnpm install --frozen-lockfile
39+
40+
# Restore-only cache to avoid save attempts/noise on forks
41+
- name: Restore Playwright browsers cache
42+
uses: actions/cache/restore@v4
43+
with:
44+
path: ~/.cache/ms-playwright
45+
key: ${{ runner.os }}-playwright-${{ hashFiles('**/pnpm-lock.yaml') }}
46+
restore-keys: |
47+
${{ runner.os }}-playwright-
48+
49+
- run: pnpm exec playwright install --with-deps
50+
51+
- uses: nrwl/nx-set-shas@v4
52+
53+
# Needed so nx affected can diff against main
54+
- run: git branch --track main origin/main || true
55+
56+
- run: pnpm nx format:check
57+
- run: pnpm nx affected -t build typecheck lint test e2e-ci

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ env:
77
NX_CLOUD_DISTRIBUTED_EXECUTION: true
88
jobs:
99
pr:
10+
if: ${{github.event.pull_request.head.repo.full_name == github.repository}}
1011
runs-on: ubuntu-latest
1112
steps:
1213
- uses: actions/checkout@v4

‎.github/workflows/publish.yml‎

Lines changed: 91 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -4,86 +4,76 @@ on:
44
branches:
55
- master
66
- develop
7+
workflow_dispatch:
8+
inputs:
9+
snapshot_tag:
10+
description: 'changesets snapshot tag (beta/canary)'
11+
required: false
12+
default: 'beta'
13+
type: string
14+
npm_tag:
15+
description: 'npm tag for publishing snapshot'
16+
required: false
17+
default: 'beta'
18+
type: string
19+
npm_access:
20+
description: 'access level for publishing snapshot to npm'
21+
required: false
22+
default: 'public'
23+
type: choice
24+
options:
25+
- public
26+
- restricted
727
env:
828
NX_CLOUD_ENCRYPTION_KEY: ${{ secrets.NX_CLOUD_ENCRYPTION_KEY }}
929
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
10-
NX_CLOUD_DISTRIBUTED_EXECUTION: true
11-
PNPM_CACHE_FOLDER: .pnpm-store
12-
NPM_ACCESS_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
1330
HUSKY: 0
31+
CI: true
1432

1533
jobs:
34+
# On push to develop/master, create or update release PR or publish to npm
1635
publish-or-pr:
36+
if: github.event_name == 'push'
37+
name: Create/update release PR or publish to npm
1738
permissions:
1839
contents: write # to create release (changesets/action)
1940
issues: write # to post issue comments (changesets/action)
2041
pull-requests: write # to create pull request (changesets/action)
21-
id-token: write # give id token write for provenance
42+
id-token: write # OIDC for provenance if npm publish happens here
2243
runs-on: ubuntu-latest
2344
steps:
24-
- uses: actions/checkout@v4
45+
- name: Setup publish
46+
uses: ./.github/actions/setup-publish
2547
with:
26-
fetch-depth: 0
27-
- uses: pnpm/action-setup@v4
28-
with:
29-
run_install: false
30-
- uses: actions/setup-node@v4
31-
id: cache
32-
with:
33-
node-version: '20.10.0'
34-
cache: 'pnpm'
35-
36-
- run: pnpm install --frozen-lockfile
37-
38-
# This line enables distribution
39-
# The "--stop-agents-after" is optional, but allows idle agents to shut down once the "e2e-ci" targets have been requested
40-
- run: pnpm dlx nx-cloud start-ci-run --distribute-on="5 linux-medium-js" --stop-agents-after="e2e-ci" --verbose
41-
42-
- run: pnpm exec playwright install
43-
44-
- uses: nrwl/nx-set-shas@v4
45-
with:
46-
main-branch-name: master
48+
branch: ${{ github.ref_name }}
4749

48-
- name: setup pnpm config
49-
run: pnpm config set store-dir $PNPM_CACHE_FOLDER
50-
51-
- run: pnpm exec nx affected -t build lint test e2e-ci --verbose
52-
53-
- uses: actions/upload-artifact@v4
54-
if: ${{ !cancelled() }}
55-
with:
56-
name: playwright-report
57-
path: |
58-
./dist/.playwright/**
59-
./dist/**
60-
retention-days: 30
61-
62-
# make sure we have a build.
63-
- run: pnpm exec nx run-many -t build
64-
env:
65-
NX_CLOUD_DISTRIBUTED_EXECUTION: false
66-
67-
- run: git status
68-
- name: publish
50+
# This action creates a release pull request with all of
51+
# the package versions and changelogs updated. When there
52+
# are new changesets on your configured baseBranch, the PR will
53+
# be updated. When you're ready, you can merge the release PR
54+
# and the action will publish to npm for you.
55+
# https://github.com/changesets/action
56+
- name: Create/update release PR or publish to npm
6957
uses: changesets/action@v1
7058
id: changesets
7159
with:
72-
publish: pnpm ci:release
73-
version: pnpm ci:version
74-
title: Release PR
75-
branch: master
76-
commit: 'chore: version-packages'
60+
publish: pnpm ci:release # command to tag and publish packages
61+
version: pnpm ci:version # command to update version, edit changelog, read and delete changesets
62+
title: Release PR # title for the release PR
63+
commit: 'chore: version-packages' # the commit message to use
7764
setupGitUser: true
7865
env:
79-
# See https://github.com/changesets/action/issues/147
80-
HOME: ${{ github.workspace }}
66+
HOME: ${{ github.workspace }} # See https://github.com/changesets/action/issues/147
8167
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8268
NPM_CONFIG_PROVENANCE: 'true'
8369
NPM_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
8470

85-
- name: rebase develop with main on publish
86-
if: ${{ steps.changesets.outputs.published == 'true' }}
71+
- name: Publish previews to Stackblitz on PR
72+
if: steps.changesets.outputs.published == 'false'
73+
run: pnpm pkg-pr-new publish './packages/*' --packageManager=pnpm --comment=off
74+
75+
- name: Rebase develop with master on publish
76+
if: steps.changesets.outputs.published == 'true'
8777
run: |
8878
git restore .
8979
git checkout master
@@ -95,10 +85,52 @@ jobs:
9585
git rebase master
9686
git push -f
9787
env:
98-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
99-
NPM_CONFIG_PROVENANCE: true
88+
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
89+
90+
- name: Send GitHub Action data to a Slack workflow
91+
if: steps.changesets.outputs.published == 'true'
92+
uses: slackapi/[email protected]
93+
with:
94+
payload-delimiter: '_'
95+
webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
96+
webhook-type: webhook-trigger
97+
payload: |
98+
text: ${{ steps.changesets.outputs.publishedPackages }}
10099
101-
- uses: codecov/codecov-action@v5
100+
- name: Run code coverage
101+
uses: codecov/codecov-action@v5
102102
with:
103103
files: ./packages/**/coverage/*.xml
104104
token: ${{ secrets.CODECOV_TOKEN }}
105+
106+
snapshot:
107+
# On manual trigger of GH action, publish a snapshot release to npm
108+
if: github.event_name == 'workflow_dispatch'
109+
name: Publish snapshot/beta release to npm
110+
permissions:
111+
contents: read
112+
id-token: write # OIDC for provenance when npm publish happens
113+
runs-on: ubuntu-latest
114+
steps:
115+
- name: Setup publish
116+
uses: ./.github/actions/setup-publish
117+
with:
118+
branch: ${{ github.ref_name }}
119+
120+
- name: Version packages for snapshot
121+
run: pnpm changeset version --snapshot ${{ inputs.snapshot_tag }}
122+
env:
123+
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
124+
125+
- name: Publish packages snapshot with npm_tag
126+
run: pnpm publish -r --tag ${{ inputs.npm_tag }} --no-git-checks --access ${{ inputs.npm_access }}
127+
128+
- name: Send GitHub Action data to a Slack workflow
129+
if: steps.changesets.outputs.published == 'true'
130+
uses: slackapi/[email protected]
131+
with:
132+
payload-delimiter: '_'
133+
webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
134+
webhook-type: webhook-trigger
135+
payload: |
136+
text: ${{ steps.changesets.outputs.publishedPackages }}

‎.node-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v20
1+
20

‎contributing_docs/releases.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,3 +95,7 @@ We provide verdaccio two ways:
9595
topological graph.
9696

9797
- Publishing to a hosted private registry: Please message @ryanbas21 on slack.
98+
99+
## Publishing a beta
100+
101+
You can trigger a beta publish manually via the `publish.yml` GitHub action. In GitHub, select the `Actions` tab then the `Publish` workflow. Then select the `Run workflow` dropdown on the right-hand side. Select the branch you want to release in the `Use workflow from` dropdown, then fill out the beta release options. Click `Run workflow` and the action will automatically release the changeset snapshot to npm.

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@
9393
"mkcert": "^3.2.0",
9494
"npm-cli-login": "^1.0.0",
9595
"nx": "20.3.3",
96+
"pkg-pr-new": "^0.0.60",
9697
"playwright": "^1.47.2",
9798
"prettier": "^3.2.5",
9899
"pretty-quick": "^4.0.0",

0 commit comments

Comments
 (0)