|
| 1 | +# Copyright Red Hat, Inc. |
| 2 | +# |
| 3 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +# you may not use this file except in compliance with the License. |
| 5 | +# You may obtain a copy of the License at |
| 6 | +# |
| 7 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +# |
| 9 | +# Unless required by applicable law or agreed to in writing, software |
| 10 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +# See the License for the specific language governing permissions and |
| 13 | +# limitations under the License. |
| 14 | + |
| 15 | +# This script exists as a clone of pr.yaml, minus the python testing that was added in 1.9 |
| 16 | +# This file can be deleted once 1.10 is live as 1.8 will be EOL. |
| 17 | + |
| 18 | +name: PR |
| 19 | + |
| 20 | +on: |
| 21 | + pull_request_target: |
| 22 | + types: [opened, synchronize, reopened, ready_for_review] |
| 23 | + branches: |
| 24 | + - release-1.7 |
| 25 | + - release-1.8 |
| 26 | + |
| 27 | +env: |
| 28 | + TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }} |
| 29 | + TURBO_SCM_HEAD: ${{ github.sha }} |
| 30 | + |
| 31 | +concurrency: |
| 32 | + group: ${{ github.workflow }}-${{ github.event.number || github.event.pull_request.head.ref }} |
| 33 | + cancel-in-progress: true |
| 34 | + |
| 35 | +jobs: |
| 36 | + check-commit-author: |
| 37 | + # This job is used to check if the commit author is an active member of the rhdh team. |
| 38 | + # It is used to determine if the PR should be run with the internal or external environment. |
| 39 | + # The job is run on the main branch to ensure that the action is not tampered with. |
| 40 | + runs-on: ubuntu-latest |
| 41 | + outputs: |
| 42 | + is_active_team_member: ${{ steps.team-check.outputs.is_active_member }} |
| 43 | + steps: |
| 44 | + - name: Generate GitHub App Token |
| 45 | + id: app-token |
| 46 | + uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4 |
| 47 | + with: |
| 48 | + app-id: ${{ secrets.RHDH_GITHUB_APP_ID }} |
| 49 | + private-key: ${{ secrets.RHDH_GITHUB_APP_PRIVATE_KEY }} |
| 50 | + - name: Checkout main branch for secure version of check-author action |
| 51 | + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 |
| 52 | + with: |
| 53 | + fetch-depth: 1 |
| 54 | + ref: main # Always use main branch for security-critical action |
| 55 | + persist-credentials: false |
| 56 | + - name: Check if commit author is an active member of the team |
| 57 | + id: team-check |
| 58 | + uses: ./.github/actions/check-author |
| 59 | + with: |
| 60 | + author: ${{ github.actor }} |
| 61 | + organization: redhat-developer |
| 62 | + team: rhdh |
| 63 | + gh_token: ${{ steps.app-token.outputs.token }} |
| 64 | + whitelisted_authors: '["openshift-cherrypick-robot"]' |
| 65 | + |
| 66 | + authorize: |
| 67 | + # The 'external' environment is configured with the maintainers team as required reviewers. |
| 68 | + # All the subsequent jobs in this workflow 'need' this job, which will require manual approval for PRs coming from external forks. |
| 69 | + # Use 'internal' environment if the author is in the team OR if it's an internal PR (not from a fork) |
| 70 | + # see list of approvers in OWNERS file |
| 71 | + environment: |
| 72 | + ${{ (needs.check-commit-author.outputs.is_active_team_member == 'true' || github.event.pull_request.head.repo.full_name == github.repository) && 'internal' || 'external' }} |
| 73 | + runs-on: ubuntu-latest |
| 74 | + needs: check-commit-author |
| 75 | + steps: |
| 76 | + - name: Check if internal PR |
| 77 | + id: check |
| 78 | + run: | |
| 79 | + if [[ "${{ needs.check-commit-author.outputs.is_active_team_member }}" == "true" ]]; then |
| 80 | + echo "✓ Commit author is in rhdh team - using internal environment" |
| 81 | + elif [[ "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then |
| 82 | + echo "✓ Internal PR (not from fork) - using internal environment" |
| 83 | + else |
| 84 | + echo "✓ External PR from fork from non-rhdh team member - using external environment for security" |
| 85 | + fi |
| 86 | + build: |
| 87 | + name: Build with Node.js ${{ matrix.node-version }} |
| 88 | + runs-on: ubuntu-latest |
| 89 | + strategy: |
| 90 | + matrix: |
| 91 | + node-version: [22] |
| 92 | + needs: authorize |
| 93 | + steps: |
| 94 | + - name: Checkout |
| 95 | + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 |
| 96 | + with: |
| 97 | + fetch-depth: 0 |
| 98 | + ref: ${{ github.event.pull_request.head.sha }} |
| 99 | + |
| 100 | + - name: Check Image and Relevant Changes |
| 101 | + id: check-image |
| 102 | + uses: ./.github/actions/check-image-and-changes |
| 103 | + |
| 104 | + - name: Setup Node.js |
| 105 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 106 | + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 |
| 107 | + with: |
| 108 | + node-version: ${{ matrix.node-version }} |
| 109 | + registry-url: "https://registry.npmjs.org" |
| 110 | + |
| 111 | + - name: Setup local Turbo cache |
| 112 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 113 | + uses: dtinth/setup-github-actions-caching-for-turbo@cc723b4600e40a6b8815b65701d8614b91e2669e # v1 |
| 114 | + |
| 115 | + - name: Use app-config.example.yaml |
| 116 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 117 | + run: rm app-config.yaml && mv app-config.example.yaml app-config.yaml |
| 118 | + |
| 119 | + - name: Install dependencies |
| 120 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 121 | + uses: backstage/actions/yarn-install@b3c1841fd69e1658ac631afafd0fb140a2309024 # v0.6.17 |
| 122 | + with: |
| 123 | + cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} |
| 124 | + |
| 125 | + - name: Build packages |
| 126 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 127 | + run: yarn run build --continue --affected |
| 128 | + |
| 129 | + test: |
| 130 | + name: Test with Node.js ${{ matrix.node-version }} |
| 131 | + runs-on: ubuntu-latest |
| 132 | + strategy: |
| 133 | + matrix: |
| 134 | + node-version: [22] |
| 135 | + needs: authorize |
| 136 | + steps: |
| 137 | + - name: Checkout |
| 138 | + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 |
| 139 | + with: |
| 140 | + fetch-depth: 0 |
| 141 | + ref: ${{ github.event.pull_request.head.sha }} |
| 142 | + |
| 143 | + - name: Check Image and Relevant Changes |
| 144 | + id: check-image |
| 145 | + uses: ./.github/actions/check-image-and-changes |
| 146 | + |
| 147 | + - name: Setup Node.js |
| 148 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 149 | + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 |
| 150 | + with: |
| 151 | + node-version: ${{ matrix.node-version }} |
| 152 | + registry-url: "https://registry.npmjs.org" |
| 153 | + |
| 154 | + - name: Setup local Turbo cache |
| 155 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 156 | + uses: dtinth/setup-github-actions-caching-for-turbo@cc723b4600e40a6b8815b65701d8614b91e2669e # v1 |
| 157 | + |
| 158 | + - name: Use app-config.example.yaml |
| 159 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 160 | + run: rm app-config.yaml && mv app-config.example.yaml app-config.yaml |
| 161 | + |
| 162 | + - name: Install dependencies |
| 163 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 164 | + uses: backstage/actions/yarn-install@b3c1841fd69e1658ac631afafd0fb140a2309024 # v0.6.17 |
| 165 | + with: |
| 166 | + cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }} |
| 167 | + |
| 168 | + - name: Run prettier |
| 169 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 170 | + run: yarn prettier:check --continue --affected |
| 171 | + |
| 172 | + - name: Run lint |
| 173 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 174 | + run: yarn run lint:check --continue --affected |
| 175 | + |
| 176 | + - name: Run monorepo tools |
| 177 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 178 | + run: yarn run monorepo:check |
| 179 | + |
| 180 | + - name: Regenerate dockerfiles |
| 181 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 182 | + run: | |
| 183 | + yarn run build:dockerfile; if [[ $(git diff --name-only | grep Dockerfile || true) != "" ]]; then \ |
| 184 | + echo "ERROR: Workspace is dirty! Must run 'yarn build:dockerfile' and commit changes!"; exit 1; \ |
| 185 | + fi |
| 186 | +
|
| 187 | + - name: Run tests |
| 188 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 189 | + run: yarn run test --continue --affected |
| 190 | + |
| 191 | + - name: Change directory to dynamic-plugins |
| 192 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 193 | + run: cd ./dynamic-plugins |
| 194 | + |
| 195 | + - name: Install dynamic plugin dependencies |
| 196 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 197 | + run: yarn install |
| 198 | + |
| 199 | + - name: Test the dynamic plugin wrappers |
| 200 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 201 | + run: yarn test --continue --affected |
| 202 | + |
| 203 | + - name: Export the dynamic plugin wrappers |
| 204 | + if: ${{ steps.check-image.outputs.is_skipped != 'true' }} |
| 205 | + run: yarn export-dynamic --continue --affected |
0 commit comments