Build/update GitHub actions

.github/workflows/codeql-analysis.yml

@@ -39,11 +39,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5

.github/workflows/commitlint.yml

@@ -6,16 +6,16 @@ jobs:
     if: github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
 
       - run: yarn install --immutable
 
-      - uses: wagoid/commitlint-github-action@v5
+      - uses: wagoid/commitlint-github-action@9763196e10f27aef304c9b8b660d31d97fce0f99 # v5.5.1
         env:
           NODE_PATH: ${{ github.workspace }}/node_modules

.github/workflows/deploy.yml

@@ -9,21 +9,22 @@ on:
 
 jobs:
   setup:
-    if: "!contains(github.event.head_commit.message, 'skip ci')"
+    if: "${{!contains(github.event.head_commit.message, 'skip ci') && !contains(github.event.head_commit.message, 'Release: Version Updates')}}"
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          token: ${{ secrets.BOT_TOKEN }}
           fetch-depth: 0
           ref: 'main'
 
       - name: Derive appropriate SHAs for base and head for `nx affected` commands
-        uses: nrwl/nx-set-shas@v3
+        uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3
 
       - name: Set Node Version
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
 
@@ -33,7 +34,7 @@ jobs:
           echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
       - name: Restore yarn cache
-        uses: actions/cache@v3
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         id: yarn-cache
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
@@ -50,22 +51,26 @@ jobs:
       - name: Unit Test Affected Code
         run: yarn test:affected
 
-  release:
+  publish:
+    if: "${{!contains(github.event.head_commit.message, 'skip ci') && !contains(github.event.head_commit.message, 'Release: Version Updates')}}"
     needs: [setup]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required for git push and creating tags
+      pull-requests: write # Required for creating pull requests
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          token: ${{ secrets.BOT_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
           ref: 'main'
 
       - name: Derive appropriate SHAs for base and head for `nx affected` commands
-        uses: nrwl/nx-set-shas@v3
+        uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3
 
       - name: Set Node Version
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
 
@@ -75,7 +80,7 @@ jobs:
           echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
       - name: Restore yarn cache
-        uses: actions/cache@v3
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         id: yarn-cache
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
@@ -89,36 +94,84 @@ jobs:
       - name: Build Packages
         run: yarn build
 
-      # TODO: ngx-deploy-npm? Or continue to leverage nx + yarn npm publish command?
-      - name: Release
+      - name: Setup Publish Config
         run: |
           yarn config set npmAuthToken "${{ secrets.NPM_TOKEN }}"
-          git config --global user.email ${{ secrets.GH_EMAIL }}
-          git config --global user.name ${{ secrets.GH_USER }}
-          yarn version:affected
-          yarn publish:affected
-          git push && git push --tags
+          git config user.email ${{ secrets.GH_EMAIL }}
+          git config user.name ${{ secrets.GH_USER }}
+          # Reset .yarnrc.yml to prevent committing
+          git checkout -- .yarnrc.yml
+
+      - name: Version Packages
+        run: |
+          yarn nx affected --target version --parallel=1
+
+      - name: Check for Version Changes
+        id: changes
+        run: |
+          git status
+          git diff --name-only
+          # Check for changes excluding .yarnrc.yml
+          if git diff --quiet HEAD -- ':!.yarnrc.yml'; then
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+            echo "No version changes detected (excluding .yarnrc.yml)"
+          else
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+            echo "Version changes detected (excluding .yarnrc.yml)"
+          fi
+          echo "Output set to: $(cat $GITHUB_OUTPUT | grep has_changes)"
+
+      - name: Publish
+        if: steps.changes.outputs.has_changes == 'true'
+        run: |
+          yarn nx affected --target publish --parallel=1
+
+      - name: Create Release PR
+        if: steps.changes.outputs.has_changes == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "Creating PR because changes detected: ${{ steps.changes.outputs.has_changes }}"
+          git push origin --delete release/version-updates || true
+          git checkout -b release/version-updates
+          git push origin release/version-updates
+          git push origin --tags
+          gh pr create --title "Release: Version Updates" --body "Automated release PR with version updates and package publications." --base master --head release/version-updates
+
+  deploy-docs:
+    if: "${{!contains(github.event.head_commit.message, 'skip ci') && !contains(github.event.head_commit.message, 'Release: Version Updates')}}"
+    needs: [publish]
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          ref: 'master'
+
+      - name: Set Node Version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: 'yarn'
+          cache-dependency-path: 'yarn.lock'
+
+      - name: Install Dependencies
+        run: yarn install --immutable
 
       - name: Build Docs
-        run: yarn build:storybook:ci
+        run: yarn build:docs
 
-      - name: Deploy Docs
-        uses: crazy-max/ghaction-github-pages@v3
+      - name: Upload Pages Artifact
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
-          target_branch: gh-pages
-          build_dir: dist/storybook
-          commit_message: deployed docs [skip ci]
-          committer: ${{ secrets.GH_USER }} ${{ secrets.GH_EMAIL }}
-          jekyll: false
-          keep_history: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
-
-      # - name: Deploy Docs (using same deploy action as preview)
-      #   uses: JamesIves/github-pages-deploy-action@v4
-      #   with:
-      #     branch: gh-pages
-      #     folder: dist/storybook
-      #     commit-message: deployed docs [skip ci]
-      #     force: false
-      #     clean-exclude: pr-preview
+          path: docusaurus/build
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/pr-build.yml

@@ -26,15 +26,15 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 
       - name: Derive appropriate SHAs for base and head for `nx affected` commands
-        uses: nrwl/nx-set-shas@v3
+        uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3
 
       - name: Set Node Version
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ matrix.node }}
 
@@ -43,7 +43,7 @@ jobs:
         run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
       - name: Restore yarn cache
-        uses: actions/cache@v3
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         id: yarn-cache
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
@@ -61,6 +61,7 @@ jobs:
         run: yarn build
 
       - name: Build Docs
+        if: ${{ matrix.node == 22 }}
         run: yarn build:storybook
 
       - name: Lint

.github/workflows/preview.yml

@@ -17,15 +17,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 
       - name: Derive appropriate SHAs for base and head for `nx affected` commands
-        uses: nrwl/nx-set-shas@v3
+        uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3
 
       - name: Set Node Version
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
 
@@ -35,7 +35,7 @@ jobs:
           echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
       - name: Restore yarn cache
-        uses: actions/cache@v3
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         id: yarn-cache
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
@@ -53,7 +53,7 @@ jobs:
         run: yarn build:storybook:ci
 
       - name: Deploy preview
-        uses: rossjrw/pr-preview-action@v1
+        uses: rossjrw/pr-preview-action@9f77b1d057b494e662c50b8ca40ecc63f21e0887
         with:
           source-dir: dist/storybook
           preview-branch: gh-pages

.github/workflows/repo-metrics.yml

@@ -3,9 +3,16 @@ on: workflow_dispatch
 jobs:
   Repo-Metrics-Report:
     runs-on: ubuntu-latest
+    environment: metrics
+    if: github.actor != 'dependabot[bot]'
+    permissions:
+      pull-requests: read
+    env:
+      OWNER: ${{ github.repository_owner }}
+      REPO: ${{ github.event.repository.name }}
     steps:
       - name: Check out the repository to the runner
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
       - name: Install Dependencies
@@ -15,8 +22,6 @@ jobs:
       - name: Get Merged PRs from the last two weeks
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OWNER: ${{ github.repository_owner }}
-          REPO: ${{ github.event.repository.name }}
         run: |
           gh api graphql -f query='
             query($owner: String!, $repo: String!) {
@@ -48,7 +53,7 @@ jobs:
             ) |
             {
               total_prs: .total_prs,
-              average_hours: (.total_hours / .total_prs)
+              average_hours: (if .total_prs > 0 then (.total_hours / .total_prs) else "N/A - No PRs found" end)
             } |
             "PR Metrics Summary:
             Total PRs: \(.total_prs)
@@ -62,5 +67,5 @@ jobs:
           ' coverage/coverage-final.json >> metrics.txt
       - name: Print Repo Metrics Report
         run: |
-          echo "${{ github.repository_owner }} ${{ github.event.repository.name }} Repo Metrics"
+          echo "$OWNER $REPO Repo Metrics"
           cat metrics.txt