Merge pull request #37397 from MetaMask/release/13.8.0

release: 13.8.0

Author: gauthierpetetin

.github/workflows/fitness-functions.yml

@@ -336,6 +336,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       INFURA_PROJECT_ID: ${{ secrets.INFURA_PROJECT_ID }}
       GOOGLE_PROD_CLIENT_ID: 00000000000
       APPLE_PROD_CLIENT_ID: 00000000000
@@ -345,7 +346,8 @@ jobs:
       APPLE_EXPERIMENTAL_CLIENT_ID: 00000000000
       GOOGLE_FLASK_CLIENT_ID: 00000000000
       APPLE_FLASK_CLIENT_ID: 00000000000
-
+    outputs:
+      lavamoat-policy-changed: ${{ steps.lavamoat-policy-changed.outputs.lavamoat-policy-changed }}
     steps:
       - name: Checkout and setup environment
         uses: MetaMask/action-checkout-and-setup@v1
@@ -354,15 +356,47 @@ jobs:
           skip-allow-scripts: true
           use-yarn-hydrate: true
 
+      - name: Download changed-files artifact
+        if: ${{ env.BRANCH != 'main' }}
+        id: download-changed-files
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: changed-files
+          path: ./changed-files/
+
+      # if the changed-files artifact does not exist, we get the diff
+      - run: yarn tsx .github/scripts/git-diff-default-branch.ts
+        if: ${{ steps.download-changed-files.outcome == 'failure' }}
+
+      - name: See if lavamoat policy files have changed
+        id: lavamoat-policy-changed
+        run: |
+          # if 'changed-files/changed-files.json' exists, check if it contains any files named policy.json or policy-override.json
+          if [ -f "changed-files/changed-files.json" ]; then
+            if grep -q -e 'policy.json' -e 'policy-override.json' changed-files/changed-files.json; then
+              echo "Lavamoat policy file changes detected."
+              echo "lavamoat-policy-changed=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "No Lavamoat policy file changes detected."
+              echo "lavamoat-policy-changed=false" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "Cannot find 'changed-files.json', assuming that Lavamoat policy files have changed."
+            echo "lavamoat-policy-changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Download artifact 'build-dist-browserify'
+        if: ${{ steps.lavamoat-policy-changed.outputs.lavamoat-policy-changed == 'true' }}
         uses: actions/download-artifact@v4
         with:
           name: build-dist-browserify
 
       - run: ./.github/scripts/create-lavamoat-viz.sh
+        if: ${{ steps.lavamoat-policy-changed.outputs.lavamoat-policy-changed == 'true' }}
 
       - name: Upload 'build-viz' to S3
-        if: ${{ vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET }}
+        if: ${{ steps.lavamoat-policy-changed.outputs.lavamoat-policy-changed == 'true' && vars.AWS_REGION && vars.AWS_IAM_ROLE && vars.AWS_S3_BUCKET }}
         uses: metamask/github-tools/.github/actions/upload-s3@1233659b3850eb84824d7375e2e0c58eb237701d
         with:
           aws-region: ${{ vars.AWS_REGION }}
@@ -372,6 +406,7 @@ jobs:
 
   publish-prerelease:
     name: Publish prerelease
+    if: ${{ github.event_name != 'merge_group' }} # Skip this job for the Merge Queue
     needs:
       - build-dist-browserify
       - build-dist-mv2-browserify
@@ -390,6 +425,8 @@ jobs:
       - build-source-map-explorer
       - build-lavamoat-viz
     uses: ./.github/workflows/publish-prerelease.yml
+    with:
+      lavamoat-policy-changed: ${{ needs.build-lavamoat-viz.outputs.lavamoat-policy-changed == 'true' }}
     secrets:
       PR_COMMENT_TOKEN: ${{ secrets.PR_COMMENT_TOKEN }}
 

.github/workflows/main.yml

@@ -5,6 +5,11 @@ on:
     secrets:
       PR_COMMENT_TOKEN:
         required: true
+    inputs:
+      lavamoat-policy-changed:
+        description: 'Whether the Lavamoat policy files have changed'
+        required: true
+        type: boolean
 
 jobs:
   publish-prerelease:
@@ -25,6 +30,7 @@ jobs:
       MERGE_BASE_COMMIT_HASH: '' # placeholder so that we have autocomplete and logs
       CLOUDFRONT_REPO_URL: ${{ vars.AWS_CLOUDFRONT_URL }}/${{ github.event.repository.name }}
       HOST_URL: ${{ vars.AWS_CLOUDFRONT_URL }}/${{ github.event.repository.name }}/${{ github.run_id }}
+      LAVAMOAT_POLICY_CHANGED: ${{ inputs.lavamoat-policy-changed }}
     steps:
       - name: Checkout and setup high risk environment
         uses: MetaMask/action-checkout-and-setup@v1

.github/workflows/publish-prerelease.yml

@@ -16,6 +16,7 @@ jobs:
         uses: MetaMask/action-checkout-and-setup@v1
         with:
           is-high-risk-environment: false
+          fetch-depth: 0 # This is needed to checkout all branches
           skip-allow-scripts: true
           use-yarn-hydrate: true
 
@@ -62,3 +63,16 @@ jobs:
               echo "::error::Working tree dirty."
               exit 1
           fi
+
+      - name: Run fitness functions
+        if: ${{ !cancelled() && github.event_name == 'pull_request'}}
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          # The following command generates a diff of changes between the common
+          # ancestor of $BASE_REF and HEAD, and the current commit (HEAD), for
+          # files in the current directory and its subdirectories. The output is
+          # then saved to a file called "diff".
+          git diff "$(git merge-base "origin/$BASE_REF" HEAD)" HEAD -- . > ./diff
+
+          yarn fitness-functions ci ./diff

.github/workflows/repository-health-checks.yml

@@ -14,6 +14,7 @@ env:
 
 jobs:
   benchmarks:
+    if: ${{ github.event_name != 'merge_group' }} # Skip this job for the Merge Queue
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     strategy:

.github/workflows/run-benchmarks.yml

@@ -73,7 +73,7 @@ jobs:
           use-yarn-hydrate: true
 
       - name: test:integration:coverage
-        run: yarn test:integration:coverage
+        run: yarn test:integration:coverage --silent
 
       - name: Rename coverage
         run: mv coverage/integration/coverage-final.json coverage/integration/coverage-integration.json

.github/workflows/run-tests.yml

@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
-npm run fitness-functions -- "pre-commit-hook"
+yarn fitness-functions pre-commit-hook