From 92fd2e040ef6dc72aff43d0dbc3e5cdfe37b815c Mon Sep 17 00:00:00 2001 From: Greg Martin Date: Wed, 8 Oct 2025 10:46:00 -0400 Subject: [PATCH 1/6] build: upgrade codeql-analysis action deps and pin versions --- .github/workflows/codeql-analysis.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 059d1d2129..6cffb28e20 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -39,11 +39,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -54,7 +54,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -68,4 +68,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 From b5896a09dcedb0a200db23d040da0252431b660f Mon Sep 17 00:00:00 2001 From: Greg Martin Date: Wed, 8 Oct 2025 10:52:55 -0400 Subject: [PATCH 2/6] build: upgrade commitlint action deps and pin versions --- .github/workflows/commitlint.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index c8979fe40b..95b6c845f0 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -6,16 +6,16 @@ jobs: if: github.actor != 'dependabot[bot]' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 with: fetch-depth: 0 - - uses: actions/setup-node@v3 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' - run: yarn install --immutable - - uses: wagoid/commitlint-github-action@v5 + - uses: wagoid/commitlint-github-action@9763196e10f27aef304c9b8b660d31d97fce0f99 # v5.5.1 env: NODE_PATH: ${{ github.workspace }}/node_modules From 802c8da687b48739fedba246b13234847dc46266 Mon Sep 17 00:00:00 2001 From: Greg Martin Date: Wed, 8 Oct 2025 10:55:03 -0400 Subject: [PATCH 3/6] build: upgrade pr-build action deps and pin versions --- .github/workflows/pr-build.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml index 9f7210bb25..3c2403b62a 100644 --- a/.github/workflows/pr-build.yml +++ b/.github/workflows/pr-build.yml @@ -26,15 +26,15 @@ jobs: steps: - name: Checkout Code - uses: actions/checkout@v3 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 with: fetch-depth: 0 - name: Derive appropriate SHAs for base and head for `nx affected` commands - uses: nrwl/nx-set-shas@v3 + uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3 - name: Set Node Version - uses: actions/setup-node@v3 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node }} @@ -43,7 +43,7 @@ jobs: run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT - name: Restore yarn cache - uses: actions/cache@v3 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 id: yarn-cache with: path: ${{ steps.yarn-cache-dir-path.outputs.dir }} @@ -61,6 +61,7 @@ jobs: run: yarn build - name: Build Docs + if: ${{ matrix.node == 22 }} run: yarn build:storybook - name: Lint From 73c7525f6aaf4d490e8854a6fad50f785d09f70c Mon Sep 17 00:00:00 2001 From: Greg Martin Date: Wed, 8 Oct 2025 13:45:46 -0400 Subject: [PATCH 4/6] build: upgrade deploy github action deps and pin versions --- .github/workflows/deploy.yml | 131 ++++++++++++++++++++++++----------- 1 file changed, 92 insertions(+), 39 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 01ff78efd2..b3783b19f1 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -9,21 +9,22 @@ on: jobs: setup: - if: "!contains(github.event.head_commit.message, 'skip ci')" + if: "${{!contains(github.event.head_commit.message, 'skip ci') && !contains(github.event.head_commit.message, 'Release: Version Updates')}}" runs-on: ubuntu-latest + permissions: + actions: read steps: - name: Checkout Code - uses: actions/checkout@v3 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 with: - token: ${{ secrets.BOT_TOKEN }} fetch-depth: 0 ref: 'main' - name: Derive appropriate SHAs for base and head for `nx affected` commands - uses: nrwl/nx-set-shas@v3 + uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3 - name: Set Node Version - uses: actions/setup-node@v3 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 @@ -33,7 +34,7 @@ jobs: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT - name: Restore yarn cache - uses: actions/cache@v3 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 id: yarn-cache with: path: ${{ steps.yarn-cache-dir-path.outputs.dir }} @@ -50,22 +51,26 @@ jobs: - name: Unit Test Affected Code run: yarn test:affected - release: + publish: + if: "${{!contains(github.event.head_commit.message, 'skip ci') && !contains(github.event.head_commit.message, 'Release: Version Updates')}}" needs: [setup] runs-on: ubuntu-latest + permissions: + contents: write # Required for git push and creating tags + pull-requests: write # Required for creating pull requests steps: - name: Checkout Code - uses: actions/checkout@v3 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 with: - token: ${{ secrets.BOT_TOKEN }} + token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 ref: 'main' - name: Derive appropriate SHAs for base and head for `nx affected` commands - uses: nrwl/nx-set-shas@v3 + uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3 - name: Set Node Version - uses: actions/setup-node@v3 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 @@ -75,7 +80,7 @@ jobs: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT - name: Restore yarn cache - uses: actions/cache@v3 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 id: yarn-cache with: path: ${{ steps.yarn-cache-dir-path.outputs.dir }} @@ -89,36 +94,84 @@ jobs: - name: Build Packages run: yarn build - # TODO: ngx-deploy-npm? Or continue to leverage nx + yarn npm publish command? - - name: Release + - name: Setup Publish Config run: | yarn config set npmAuthToken "${{ secrets.NPM_TOKEN }}" - git config --global user.email ${{ secrets.GH_EMAIL }} - git config --global user.name ${{ secrets.GH_USER }} - yarn version:affected - yarn publish:affected - git push && git push --tags + git config user.email ${{ secrets.GH_EMAIL }} + git config user.name ${{ secrets.GH_USER }} + # Reset .yarnrc.yml to prevent committing + git checkout -- .yarnrc.yml + + - name: Version Packages + run: | + yarn nx affected --target version --parallel=1 + + - name: Check for Version Changes + id: changes + run: | + git status + git diff --name-only + # Check for changes excluding .yarnrc.yml + if git diff --quiet HEAD -- ':!.yarnrc.yml'; then + echo "has_changes=false" >> $GITHUB_OUTPUT + echo "No version changes detected (excluding .yarnrc.yml)" + else + echo "has_changes=true" >> $GITHUB_OUTPUT + echo "Version changes detected (excluding .yarnrc.yml)" + fi + echo "Output set to: $(cat $GITHUB_OUTPUT | grep has_changes)" + + - name: Publish + if: steps.changes.outputs.has_changes == 'true' + run: | + yarn nx affected --target publish --parallel=1 + + - name: Create Release PR + if: steps.changes.outputs.has_changes == 'true' + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + echo "Creating PR because changes detected: ${{ steps.changes.outputs.has_changes }}" + git push origin --delete release/version-updates || true + git checkout -b release/version-updates + git push origin release/version-updates + git push origin --tags + gh pr create --title "Release: Version Updates" --body "Automated release PR with version updates and package publications." --base master --head release/version-updates + + deploy-docs: + if: "${{!contains(github.event.head_commit.message, 'skip ci') && !contains(github.event.head_commit.message, 'Release: Version Updates')}}" + needs: [publish] + runs-on: ubuntu-latest + permissions: + pages: write + id-token: write + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + steps: + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + with: + fetch-depth: 0 + ref: 'master' + + - name: Set Node Version + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + with: + node-version: 22 + cache: 'yarn' + cache-dependency-path: 'yarn.lock' + + - name: Install Dependencies + run: yarn install --immutable - name: Build Docs - run: yarn build:storybook:ci + run: yarn build:docs - - name: Deploy Docs - uses: crazy-max/ghaction-github-pages@v3 + - name: Upload Pages Artifact + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: - target_branch: gh-pages - build_dir: dist/storybook - commit_message: deployed docs [skip ci] - committer: ${{ secrets.GH_USER }} ${{ secrets.GH_EMAIL }} - jekyll: false - keep_history: true - env: - GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }} - - # - name: Deploy Docs (using same deploy action as preview) - # uses: JamesIves/github-pages-deploy-action@v4 - # with: - # branch: gh-pages - # folder: dist/storybook - # commit-message: deployed docs [skip ci] - # force: false - # clean-exclude: pr-preview + path: docusaurus/build + + - name: Deploy to GitHub Pages + id: deployment + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 From 6c5dfb36fecedea92bbd3094986edc74aead9c0d Mon Sep 17 00:00:00 2001 From: Greg Martin Date: Wed, 8 Oct 2025 13:53:02 -0400 Subject: [PATCH 5/6] build: upgrade repo metrics github action deps and pin versions --- .github/workflows/repo-metrics.yml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/workflows/repo-metrics.yml b/.github/workflows/repo-metrics.yml index 9d629c218e..50ae12c0b5 100644 --- a/.github/workflows/repo-metrics.yml +++ b/.github/workflows/repo-metrics.yml @@ -3,9 +3,16 @@ on: workflow_dispatch jobs: Repo-Metrics-Report: runs-on: ubuntu-latest + environment: metrics + if: github.actor != 'dependabot[bot]' + permissions: + pull-requests: read + env: + OWNER: ${{ github.repository_owner }} + REPO: ${{ github.event.repository.name }} steps: - name: Check out the repository to the runner - uses: actions/checkout@v4 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 with: fetch-depth: 0 - name: Install Dependencies @@ -15,8 +22,6 @@ jobs: - name: Get Merged PRs from the last two weeks env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - OWNER: ${{ github.repository_owner }} - REPO: ${{ github.event.repository.name }} run: | gh api graphql -f query=' query($owner: String!, $repo: String!) { @@ -48,7 +53,7 @@ jobs: ) | { total_prs: .total_prs, - average_hours: (.total_hours / .total_prs) + average_hours: (if .total_prs > 0 then (.total_hours / .total_prs) else "N/A - No PRs found" end) } | "PR Metrics Summary: Total PRs: \(.total_prs) @@ -62,5 +67,5 @@ jobs: ' coverage/coverage-final.json >> metrics.txt - name: Print Repo Metrics Report run: | - echo "${{ github.repository_owner }} ${{ github.event.repository.name }} Repo Metrics" + echo "$OWNER $REPO Repo Metrics" cat metrics.txt From 271061931b3089504eb04fa950f5e263dd16c63d Mon Sep 17 00:00:00 2001 From: Greg Martin Date: Wed, 8 Oct 2025 14:08:46 -0400 Subject: [PATCH 6/6] build: upgrade preview github action deps and pin versions --- .github/workflows/preview.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index 0def32791e..b263379f9a 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -17,15 +17,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Code - uses: actions/checkout@v3 + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 with: fetch-depth: 0 - name: Derive appropriate SHAs for base and head for `nx affected` commands - uses: nrwl/nx-set-shas@v3 + uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3 - name: Set Node Version - uses: actions/setup-node@v3 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 @@ -35,7 +35,7 @@ jobs: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT - name: Restore yarn cache - uses: actions/cache@v3 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 id: yarn-cache with: path: ${{ steps.yarn-cache-dir-path.outputs.dir }} @@ -53,7 +53,7 @@ jobs: run: yarn build:storybook:ci - name: Deploy preview - uses: rossjrw/pr-preview-action@v1 + uses: rossjrw/pr-preview-action@9f77b1d057b494e662c50b8ca40ecc63f21e0887 with: source-dir: dist/storybook preview-branch: gh-pages