support-dotcom-components/.github/workflows/dotcom-components.yml at main · guardian/support-dotcom-components · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: Build dotcom-components

on:
    pull_request:
        branches:
            - '**'
    push:
        branches:
            - main

jobs:
    dotcom-components:
        if: >-
            (github.event.pull_request.head.repo.owner.login == 'guardian' ||
              github.event_name == 'push')
        # Required by actions-assume-aws-role
        permissions:
            id-token: write
            contents: read
            pull-requests: write # Required for riff-raff action

        name: dotcom-components
        runs-on: ubuntu-latest
        steps:
            - name: Checkout repo
              uses: actions/checkout@v7.0.1

            - run: npm install --global corepack@0.31.0
              shell: bash

            - run: corepack enable
              shell: bash

            - name: Use Node.js
              uses: actions/setup-node@v7.0.0
              with:
                  node-version-file: '.tool-versions'
                  cache: 'pnpm'

            - name: Test + build
              run: |
                  pnpm install
                  pnpm lint
                  pnpm prettier:check
                  pnpm tsc
                  pnpm test

                  NODE_ENV=production pnpm build-server

            - name: cdk
              working-directory: ./cdk
              run: |
                  pnpm install
                  pnpm lint
                  pnpm prettier:check
                  pnpm test
                  pnpm synth

            - name: riffraff
              uses: guardian/actions-riff-raff@v4.3.6
              with:
                  projectName: support::dotcom-components
                  roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
                  githubToken: ${{ secrets.GITHUB_TOKEN }}
                  configPath: riff-raff.yaml
                  buildNumberOffset: 4000
                  contentDirectories: |
                      dotcom-components-cloudformation:
                        - cdk/cdk.out/sdc-CODE.template.json
                        - cdk/cdk.out/sdc-PROD.template.json
                      dotcom-components:
                        - server-dist/server.js

    release:
        name: Release
        needs: [dotcom-components]
        if: github.ref == 'refs/heads/main'
        runs-on: ubuntu-latest
        permissions:
            contents: write # in order to write labels to main branch?
            pull-requests: write # to be able to comment on released pull requests
            id-token: write # to enable use of OIDC for npm provenance
        steps:
            - name: Checkout
              uses: actions/checkout@v7.0.1
              with:
                  fetch-depth: 0
                  persist-credentials: false

            - run: npm install --global corepack@0.31.0
              shell: bash

            - run: corepack enable
              shell: bash

            - name: Setup Node
              uses: actions/setup-node@v7.0.0
              with:
                  node-version-file: '.tool-versions'
                  cache: 'pnpm'
                  registry-url: 'https://registry.npmjs.org'

            - name: Install npm 11 for OIDC trusted publishing
              run: npx -y npm@11.16.0 install --global npm@11.16.0

            - name: Strip _authToken from .npmrc (let OIDC kick in)
              run: |
                  npmrc="${NPM_CONFIG_USERCONFIG:-$HOME/.npmrc}"
                  sed -i '/_authToken/d' "$npmrc"

            - name: Build
              run: |
                  pnpm install
                  pnpm build-dotcom
                  pnpm build-dotcom-types

            - name: Release
              uses: changesets/action@v2.1.1
              with:
                  publish-script: pnpm changeset publish
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}