Skip to content

Commit e293fb7

Browse files
collins-wnahimterrazas
collins-w
and
nahimterrazas
authored
ci: Add the release and security workflows (#6)
* ci: Add the release and security workflows * chore: update the pinned node version * chore: update the pnpm-lock file * chore: test the release drafter action * chore: test the release drafter action * chore: update the release drafter * chore: add nx to run tests * feat: update the changeset release process * chore: add a publish script * chore: trigger release workflow * chore: trigger release workflow * chore: add the missing prepare actions * chore: update the PAT * chore: update the PAT * Revert "feat: update the changeset release process" This reverts commit 2836632. * Revert "chore: add a publish script" This reverts commit 72baf2f. * chore: integrate github app * chore: test github app * feat: automate the release process using changesets * fix: fix the workflow synatx error * fix: add GH app authentication * fix: fix the workflow syntax error * fix: fix GH app authentication * fix: test GH app authentication * fix: add GH app authentication in prepare action * fix: add runs-on on prepare action * fix: fix composite action * fix: fix composite action * fix: authenticate state and start steps * fix: authenticate state and start steps * fix: authenticate state and start steps * fix: authenticate state and start steps * fix: authenticate state and start steps * fix: update the input token * fix: add missing packages * fix: add missing packages * chore: test start of rc * chore: test start of rc release * chore: test start of rc release * chore: add the missing pull-requests: write permission * chore: make version_tag optional for n ow * chore: test the RC release flow * 🤖 chore: Push the release candidate change * chore: test the RC release flow * chore: test the RC release flow * chore: test sign commits using action * chore: test sign commits using action * chore: fix sign commits using action * chore: clean up the gh PR creation action * chore: test the gh app token step * chore: introduce a merge back step from develop to main branch after a release * chore: remove the release drafter to favor populating the release using changelog.md file * chore: update package.json scripts * chore: trigger build * chore: trigger build * chore: pin action versions * chore: debug startup failure * chore: debug startup failure * chore: fix startup failure * chore: fix startup failure * chore: fix startup failure * chore: fix startup failure * chore: update the sbom needs * chore: update the the gapp token * chore: fix workflow * chore: fix workflow * chore: set skip-token-revoke to truthy * chore: debug gapp job * chore: do away with a separate gapp token job. We can revisit later * chore: do away with a separate gapp token job * chore: install prerequisites * chore: comment out provenance as the repo is private * chore: clean up and remove reyrn of workflows * chore: refactor release strategy to use release branches * chore: fix sbom step dependency * chore: trigger build * chore: trigger build to test * chore: trigger build to test * chore: trigger build to test * chore: trigger build to test * chore: trigger build to test * chore: trigger build to test * chore: clean up workflow * chore: remove the version.yml workflow file as it's no longer needed * chore: test signing using gapp * chore: test slsa provenance * chore: test sbom * chore: test provenance * chore: fix eslint command * chore: update slsa node version * chore: add the missing build script * chore: add the missing nx-test-skip-cache script * chore: add a step to create a temo-dir for provenance * chore: add sbom provenance dep * chore: allow PR details in the changelog file * chore: remove the test branch * chore: pin versions and use gap token on all actions * chore: comment out codeql until we go public and fix node version in prepare action * chore: test sbom * chore: test sbom * chore: test sbom upload to a gh release * chore: test sbom upload to a gh release * chore: allow upload of sbom to a release * feat: Xample cancel transaction (#7) * chore: disable the dependency review workflow until the repo goes public * chore: remove docker scan step as the project is not dockerised * chore: update the CI workflow to use pinned SHA on the actions * chore: send build status to slack * chore: add a release workflow diagram * chore: remove the test changelog file * chore: add a release workflow diagram * chore: pin slsa version * chore: unpin slsa version * chore: pin slsa version * chore: add CLA * chore: disable cla until we go public * chore: enable cla --------- Co-authored-by: collins-w <collins-w@users.noreply.github.com> Co-authored-by: nahimterrazas <nahim.terrazas@openzeppelin.com>
1 parent 0ee4bdc commit e293fb7

File tree

16 files changed

+2639
-1303
lines changed

16 files changed

+2639
-1303
lines changed

‎.changeset/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Changesets
2+
3+
Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
4+
with multi-package repos, or single-package repos to help you version and publish your code. You can
5+
find the full documentation for it [in our repository](https://github.com/changesets/changesets)
6+
7+
We have a quick list of common questions to get you started engaging with this project in
8+
[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

‎.changeset/config.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"$schema": "https://unpkg.com/@changesets/config@2.3.0/schema.json",
3+
"changelog": [
4+
"@changesets/changelog-github",
5+
{
6+
"repo": "OpenZeppelin/openzeppelin-relayer-sdk"
7+
}
8+
],
9+
"commit": false,
10+
"access": "restricted",
11+
"baseBranch": "main"
12+
}

‎.github/actions/prepare/action.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
name: Pre-requisites
3+
description: |
4+
Setup Pre-requisites
5+
6+
inputs:
7+
token:
8+
required: true
9+
10+
runs:
11+
using: composite
12+
steps:
13+
- name: Checkout Repo
14+
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.5.4
15+
with:
16+
token: ${{ inputs.token }}
17+
persist-credentials: true
18+
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda #v4.1.0
19+
with:
20+
version: 9
21+
run_install: false
22+
23+
- name: Use node@22
24+
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
25+
with:
26+
node-version: 22.14.0
27+
cache: 'pnpm'
28+
29+
- name: Install dependencies
30+
run: |
31+
pnpm install-deps
32+
shell: bash

‎.github/workflows/ci.yaml‎

Lines changed: 7 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,17 @@ jobs:
1111
steps:
1212
# Checkout the repository
1313
- name: Checkout Code
14-
uses: actions/checkout@v4
14+
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.5.4
1515

1616
# Set up Node.js
1717
- name: Setup Node.js
1818
uses: actions/setup-node@v4
1919
with:
20-
node-version: '22' # Use the latest LTS version for stability
20+
node-version: '22.14.0'
2121

2222
# Cache pnpm dependencies
2323
- name: Cache pnpm dependencies
24-
uses: actions/cache@v4
24+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
2525
with:
2626
path: |
2727
~/.pnpm-store
@@ -49,17 +49,17 @@ jobs:
4949
steps:
5050
# Checkout the repository
5151
- name: Checkout Code
52-
uses: actions/checkout@v4
52+
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.5.4
5353

5454
# Set up Node.js
5555
- name: Setup Node.js
56-
uses: actions/setup-node@v4
56+
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
5757
with:
58-
node-version: '22' # Use the latest LTS version for stability
58+
node-version: '22.14.0'
5959

6060
# Restore pnpm dependencies from cache
6161
- name: Restore pnpm dependencies from cache
62-
uses: actions/cache@v4
62+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
6363
with:
6464
path: |
6565
~/.pnpm-store
@@ -83,32 +83,3 @@ jobs:
8383
# Run tests
8484
- name: Run tests
8585
run: pnpm test
86-
87-
docker-scan:
88-
runs-on: ubuntu-latest
89-
needs: build-and-test
90-
91-
steps:
92-
# Checkout the repository
93-
- name: Checkout Code
94-
uses: actions/checkout@v4
95-
96-
- name: Set up Docker Buildx
97-
uses: docker/setup-buildx-action@v3
98-
99-
- name: Build local container
100-
uses: docker/build-push-action@v6
101-
with:
102-
tags: oss-dev:${{ github.sha }}
103-
push: false
104-
load: true
105-
file: Dockerfile.development
106-
platforms: linux/amd64
107-
108-
- name: Scan image
109-
uses: anchore/scan-action@v5
110-
with:
111-
image: oss-dev:${{ github.sha }}
112-
fail-build: true
113-
severity-cutoff: high
114-
output-format: table

‎.github/workflows/cla.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: "CLA Assistant"
2+
on:
3+
issue_comment:
4+
types: [created]
5+
pull_request_target:
6+
types: [opened,closed,synchronize]
7+
8+
permissions:
9+
actions: write
10+
contents: write
11+
pull-requests: write
12+
statuses: write
13+
14+
jobs:
15+
CLAAssistant:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1.11.7
19+
id: gh-app-token
20+
with:
21+
app-id: ${{ vars.GH_APP_ID }}
22+
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
23+
24+
- name: Harden the runner (Audit all outbound calls)
25+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
26+
with:
27+
egress-policy: audit
28+
29+
- name: Checkout Private Repo for Allowlist
30+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
31+
with:
32+
repository: OpenZeppelin/cla-sigs
33+
token: ${{ steps.gh-app-token.outputs.token }}
34+
sparse-checkout: |
35+
allowlist.txt
36+
sparse-checkout-cone-mode: false
37+
38+
- name: Read Allowlist File
39+
id: read_allowlist
40+
run: |
41+
ALLOWLIST=$(cat allowlist.txt)
42+
echo "allowlist=$ALLOWLIST" >> $GITHUB_OUTPUT
43+
44+
- name: "CLA Assistant"
45+
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I confirm that I have read and hereby agree to the OpenZeppelin Contributor License Agreement') || github.event_name == 'pull_request_target'
46+
uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 #v2.6.1
47+
env:
48+
GITHUB_TOKEN: ${{ steps.gh-app-token.outputs.token }}
49+
PERSONAL_ACCESS_TOKEN: ${{ steps.gh-app-token.outputs.token }}
50+
with:
51+
path-to-signatures: 'signatures/${{ github.event.repository.name }}/v1_cla.json'
52+
path-to-document: 'https://github.com/OpenZeppelin/cla-assistant/blob/main/openzeppelin_2025_cla.md'
53+
branch: 'main'
54+
allowlist: ${{ steps.read_allowlist.outputs.allowlist }}
55+
remote-organization-name: 'OpenZeppelin'
56+
remote-repository-name: 'cla-sigs'
57+
custom-notsigned-prcomment: >
58+
Thank you for your contribution to OpenZeppelin Relayer SDK.
59+
Before being able to integrate those changes, we would like you to
60+
sign our [Contributor License Agreement](https://github.com/OpenZeppelin/cla-assistant/blob/main/openzeppelin_2025_cla.md).
61+
62+
You can sign the CLA by just posting a Pull Request Comment with the sentence below. Thanks.
63+
custom-pr-sign-comment: 'I confirm that I have read and hereby agree to the OpenZeppelin Contributor License Agreement'

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# TODO: To be uncommeted when the repo goes public
2+
# name: "CodeQL"
3+
4+
# on:
5+
# push:
6+
# branches: ["main"]
7+
# pull_request:
8+
# branches: ["main"]
9+
# schedule:
10+
# - cron: '40 12 * * 3'
11+
12+
# jobs:
13+
# analyze:
14+
# name: Code Analysis
15+
# runs-on: ubuntu-latest
16+
# permissions:
17+
# actions: read
18+
# contents: read
19+
# security-events: write
20+
21+
# strategy:
22+
# fail-fast: false
23+
# matrix:
24+
# language: ["javascript"]
25+
26+
# steps:
27+
# - name: Checkout repository
28+
# uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.5.4
29+
30+
# - name: Initialize CodeQL
31+
# uses: github/codeql-action/init@8214744c546c1e5c8f03dde8fab3a7353211988d # v3.26.7
32+
# with:
33+
# languages: ${{ matrix.language }}
34+
35+
# - name: Perform CodeQL Analysis
36+
# uses: github/codeql-action/analyze@8214744c546c1e5c8f03dde8fab3a7353211988d # v3.26.7
37+
# with:
38+
# category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
10+
## TODO: Uncomment when the repo goes public
11+
# name: 'Dependency Review'
12+
# on: [pull_request]
13+
14+
# permissions:
15+
# contents: read
16+
17+
# jobs:
18+
# dependency-review:
19+
# runs-on: ubuntu-latest
20+
# steps:
21+
# - name: Harden Runner
22+
# uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
23+
# with:
24+
# egress-policy: audit
25+
26+
# - name: 'Checkout Repository'
27+
# uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
28+
# - name: 'Dependency Review'
29+
# uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

0 commit comments

Comments
 (0)