|
| 1 | +name: Deploy |
| 2 | + |
| 3 | +############################################################################## |
| 4 | +# WARNING! |
| 5 | +# The deploy workflow (re-)uses information retrieved from the original |
| 6 | +# commit which triggered the workflow, such as the branch name, the committer, |
| 7 | +# and the commit message. |
| 8 | +# |
| 9 | +# This type of data should always be regarded as **untrusted** input and when |
| 10 | +# these `github....` variables are used directly within the `run` context, |
| 11 | +# they can lead to script injection and unintended execution of commands. |
| 12 | +# |
| 13 | +# To mitigate the risk of these type of script injection attacks, untrusted |
| 14 | +# data is first set as a step-specific interim environment variable and only |
| 15 | +# after that the environment variable (not the github variables directly) |
| 16 | +# is used in the `run` context. |
| 17 | +# |
| 18 | +# This complies with the current best practices regarding defending against |
| 19 | +# these type of attacks as per January 2022. |
| 20 | +# For more information, see: |
| 21 | +# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions |
| 22 | +############################################################################## |
| 23 | + |
| 24 | +on: |
| 25 | + push: |
| 26 | + # Trigger the workflow on select branches. |
| 27 | + branches: |
| 28 | + - trunk |
| 29 | + - 'release/**' |
| 30 | + - 'hotfix/[0-9]+.[0-9]+*' |
| 31 | + - 'feature/**' |
| 32 | + # Trigger the workflow whenever a new tag is created. |
| 33 | + tags: |
| 34 | + - '**' |
| 35 | + # Allow manually triggering the workflow. |
| 36 | + workflow_dispatch: |
| 37 | + |
| 38 | +# Cancels all previous workflow runs for the same branch that have not yet completed. |
| 39 | +concurrency: |
| 40 | + # The concurrency group contains the workflow name and the branch name. |
| 41 | + group: ${{ github.workflow }}-${{ github.ref }} |
| 42 | + cancel-in-progress: true |
| 43 | + |
| 44 | +env: |
| 45 | + DIST_ORG: 'Yoast-dist' |
| 46 | + DIST_DEFAULT_BRANCH: 'master' |
| 47 | + |
| 48 | +jobs: |
| 49 | + prepare: |
| 50 | + name: "Prepare the artifact" |
| 51 | + # Don't run on forks. |
| 52 | + if: github.repository_owner == 'Yoast' |
| 53 | + |
| 54 | + runs-on: ubuntu-latest |
| 55 | + |
| 56 | + steps: |
| 57 | + - name: Checkout code |
| 58 | + uses: actions/checkout@v3 |
| 59 | + |
| 60 | + - name: Install PHP |
| 61 | + uses: shivammathur/setup-php@v2 |
| 62 | + with: |
| 63 | + php-version: 5.6 |
| 64 | + |
| 65 | + # This action also handles the caching of the Yarn dependencies. |
| 66 | + # https://github.com/actions/setup-node |
| 67 | + - name: Set up node and enable caching of dependencies |
| 68 | + uses: actions/setup-node@v3 |
| 69 | + with: |
| 70 | + node-version: '14' |
| 71 | + cache: 'yarn' |
| 72 | + |
| 73 | + - name: "Debug info: show tooling versions" |
| 74 | + run: | |
| 75 | + php -v |
| 76 | + node --version |
| 77 | + npm --version |
| 78 | + yarn --version |
| 79 | + grunt --version |
| 80 | + git --version |
| 81 | +
|
| 82 | + # Install dependencies and handle caching in one go. |
| 83 | + # The Grunt artifact creation will run `composer install` multiple times (both no-dev as well as dev), |
| 84 | + # however, Composer packages downloaded are not cached via Grunt. |
| 85 | + # Running `composer install` ahead of time will ensure that the cache is warmed up |
| 86 | + # and available across runs of the same workflow. |
| 87 | + # @link https://github.com/marketplace/actions/install-composer-dependencies |
| 88 | + - name: Install Composer dependencies |
| 89 | + uses: ramsey/composer-install@v2 |
| 90 | + |
| 91 | + - name: Yarn install |
| 92 | + run: yarn install |
| 93 | + |
| 94 | + - name: "Grunt: set package version (tags only)" |
| 95 | + if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }} |
| 96 | + env: |
| 97 | + REF_NAME: ${{ github.ref_name }} |
| 98 | + run: grunt set-version -new-version="$REF_NAME" |
| 99 | + |
| 100 | + - name: "Grunt: update package version (tags only)" |
| 101 | + if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }} |
| 102 | + run: grunt update-version |
| 103 | + |
| 104 | + - name: "Grunt: create artifact" |
| 105 | + run: grunt artifact |
| 106 | + |
| 107 | + - name: "Copy composer.json" |
| 108 | + run: cp composer.json ./artifact |
| 109 | + |
| 110 | + - name: "Debug info: show contents of artifacts directory" |
| 111 | + run: tree -aC ./artifact |
| 112 | + |
| 113 | + - name: "Debug info: check git status" |
| 114 | + run: git status -b -v -u |
| 115 | + |
| 116 | + # Retention is normally 90 days, but this artifact is only for review |
| 117 | + # and use in the next step, so no need to keep it for more than a day. |
| 118 | + - name: Upload the artifact folder |
| 119 | + uses: actions/upload-artifact@v3 |
| 120 | + if: ${{ success() }} |
| 121 | + with: |
| 122 | + name: deploy-artifact |
| 123 | + path: ./artifact |
| 124 | + if-no-files-found: error |
| 125 | + retention-days: 1 |
| 126 | + |
| 127 | + deploy: |
| 128 | + name: "Deploy to dist" |
| 129 | + # Don't run on forks. |
| 130 | + if: github.repository_owner == 'Yoast' |
| 131 | + |
| 132 | + needs: prepare |
| 133 | + |
| 134 | + runs-on: ubuntu-latest |
| 135 | + |
| 136 | + steps: |
| 137 | + - name: "Set variable: short sha" |
| 138 | + id: set_sha |
| 139 | + env: |
| 140 | + SHA: ${{ github.sha }} |
| 141 | + run: | |
| 142 | + shortsha=$(echo "$SHA" | cut -b 1-6) |
| 143 | + echo "::set-output name=SHORTSHA::$shortsha" |
| 144 | +
|
| 145 | + - name: "Set variables: target branch, commit title" |
| 146 | + id: set_vars |
| 147 | + env: |
| 148 | + REF_NAME: ${{ github.ref_name }} |
| 149 | + run: | |
| 150 | + if [[ "${{ github.event_name }}" == 'push' && "${{ github.ref_type }}" == 'branch' && "$REF_NAME" != "${{ env.DIST_DEFAULT_BRANCH }}" ]]; then |
| 151 | + echo "::set-output name=BRANCH::$REF_NAME" |
| 152 | + echo "::set-output name=TITLE::Syncing branch $REF_NAME (sha: ${{ steps.set_sha.outputs.SHORTSHA }})" |
| 153 | + elif [[ "${{ github.event_name }}" == 'workflow_dispatch' && "$REF_NAME" != "${{ env.DIST_DEFAULT_BRANCH }}" ]]; then |
| 154 | + echo "::set-output name=BRANCH::$REF_NAME" |
| 155 | + echo "::set-output name=TITLE::Manual deploy for $REF_NAME (sha: ${{ steps.set_sha.outputs.SHORTSHA }})" |
| 156 | + else # = Pushed tag. |
| 157 | + echo "::set-output name=BRANCH::${{ env.DIST_DEFAULT_BRANCH }}" |
| 158 | + echo "::set-output name=TITLE::Release $REF_NAME" |
| 159 | + fi |
| 160 | +
|
| 161 | + - name: Checkout Yoast Dist repo |
| 162 | + uses: actions/checkout@v3 |
| 163 | + with: |
| 164 | + repository: ${{ env.DIST_ORG }}/${{ github.event.repository.name }} |
| 165 | + ref: ${{ env.DIST_DEFAULT_BRANCH }} |
| 166 | + # Personal Access Token for (push) access to the dist version of the repo. |
| 167 | + token: ${{ secrets.YOASTBOT_CI_PAT_DIST }} |
| 168 | + fetch-depth: 0 |
| 169 | + |
| 170 | + - name: "Create branch/Switch to branch" |
| 171 | + if: ${{ steps.set_vars.outputs.BRANCH != env.DIST_DEFAULT_BRANCH }} |
| 172 | + run: git checkout ${{ steps.set_vars.outputs.BRANCH }} 2>/dev/null || git checkout -b ${{ steps.set_vars.outputs.BRANCH }} |
| 173 | + |
| 174 | + # Clean out all files to make sure that deleted files will actually |
| 175 | + # be deleted when the artifact gets put in place. |
| 176 | + - name: Remove all files |
| 177 | + run: | |
| 178 | + # Enable extended pattern matching. |
| 179 | + shopt -s extglob |
| 180 | + # Remove everything, except the ".git" directory. |
| 181 | + rm -vrf !(.git/*) |
| 182 | + # Disable extended pattern matching. |
| 183 | + shopt -u extglob |
| 184 | +
|
| 185 | + # After the previous step, only the `.git` directory and its contents should remain. |
| 186 | + - name: "Debug info: show contents of root directory after cleaning" |
| 187 | + run: tree -aC . |
| 188 | + |
| 189 | + # The artifact will be unpacked into the root directory of the repository. |
| 190 | + - name: Download and unpack the prepared artifact |
| 191 | + uses: actions/download-artifact@v3 |
| 192 | + with: |
| 193 | + name: deploy-artifact |
| 194 | + |
| 195 | + # Remove the vendor directory from the artifact, composer will generate it's own autoload. |
| 196 | + - name: Remove generated vendor directory |
| 197 | + run: rm -vrf ./vendor |
| 198 | + |
| 199 | + - name: "Debug info: show contents of root directory after artifact insertion" |
| 200 | + run: tree -aC . |
| 201 | + |
| 202 | + - name: "Debug info: check git status" |
| 203 | + run: git status -b -v -u |
| 204 | + |
| 205 | + - name: Set Git config |
| 206 | + env: |
| 207 | + ACTOR: ${{ github.actor }} |
| 208 | + run: | |
| 209 | + git config user.name 'GitHub Action' |
| 210 | + git config user.email "$ACTOR@users.noreply.github.com" |
| 211 | +
|
| 212 | + - name: Stage files |
| 213 | + run: git add -A |
| 214 | + |
| 215 | + - name: "Commit the files (branch)" |
| 216 | + if: ${{ github.event_name != 'push' || github.ref_type != 'tag' }} |
| 217 | + env: |
| 218 | + COMMITTER: ${{ github.event.head_commit.committer.username }} |
| 219 | + COMMIT_MSG: ${{ github.event.head_commit.message }} |
| 220 | + COMMIT_URL: ${{ github.event.head_commit.url }} |
| 221 | + COMMIT_TIME: ${{ github.event.head_commit.timestamp }} |
| 222 | + run: | |
| 223 | + git commit --allow-empty -m "${{ steps.set_vars.outputs.TITLE }}" \ |
| 224 | + -m "Synced up to commit hash: $COMMIT_URL" \ |
| 225 | + -m "Timestamp last commit: $COMMIT_TIME" \ |
| 226 | + -m "Committer last commit: @$COMMITTER" \ |
| 227 | + -m "" \ |
| 228 | + -m "Commit message last commit:" \ |
| 229 | + -m "---------------------------" \ |
| 230 | + -m "$COMMIT_MSG" |
| 231 | +
|
| 232 | + - name: "Commit the files (release)" |
| 233 | + if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }} |
| 234 | + env: |
| 235 | + COMMITTER: ${{ github.event.head_commit.committer.username }} |
| 236 | + COMMIT_MSG: ${{ github.event.head_commit.message }} |
| 237 | + COMMIT_URL: ${{ github.event.head_commit.url }} |
| 238 | + COMMIT_TIME: ${{ github.event.head_commit.timestamp }} |
| 239 | + run: | |
| 240 | + git commit -m "${{ steps.set_vars.outputs.TITLE }}" \ |
| 241 | + -m "Commit hash for tag: $COMMIT_URL" \ |
| 242 | + -m "Timestamp for tag: $COMMIT_TIME" \ |
| 243 | + -m "Committer for tag: @$COMMITTER" \ |
| 244 | + -m "" \ |
| 245 | + -m "Commit message last commit:" \ |
| 246 | + -m "---------------------------" \ |
| 247 | + -m "$COMMIT_MSG" |
| 248 | +
|
| 249 | + - name: "Tag the commit (releases only)" |
| 250 | + if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }} |
| 251 | + env: |
| 252 | + REF_NAME: ${{ github.ref_name }} |
| 253 | + run: git tag "$REF_NAME" $(git rev-parse HEAD) |
| 254 | + |
| 255 | + - name: Push to target branch |
| 256 | + run: git push -u origin ${{ steps.set_vars.outputs.BRANCH }} --tags -v |
0 commit comments