Skip to content

Commit 15727af

Browse files
imolorheimolorhe
committed
updated workflows
1 parent ee2c0d3 commit 15727af

14 files changed

+310
-157
lines changed

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,5 @@ updates:
99
directory: "/" # Location of package manifests
1010
schedule:
1111
interval: "weekly"
12+
cooldown:
13+
default-days: 7

‎.github/workflows/__deploy-pages.yml‎

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,16 @@ on:
2121
required: false
2222
type: string
2323
default: "22"
24+
secrets:
25+
cloudflare_api_token:
26+
description: "Cloudflare API token"
27+
required: true
28+
cloudflare_account_id:
29+
description: "Cloudflare Account ID"
30+
required: true
31+
github_token:
32+
description: "GitHub token"
33+
required: true
2434
workflow_dispatch:
2535
inputs:
2636
project_name:
@@ -42,41 +52,45 @@ on:
4252
type: string
4353
default: "22"
4454

55+
permissions: {}
56+
4557
jobs:
4658
deploy:
4759
name: ${{ inputs.deployment_name }}
4860
runs-on: ubuntu-latest
4961
steps:
50-
- uses: actions/checkout@v4
62+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
63+
with:
64+
persist-credentials: false
5165

52-
- uses: pnpm/action-setup@v4
66+
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
5367

5468
- name: Use Node.js
55-
uses: actions/setup-node@v4
69+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
5670
with:
5771
node-version: ${{ inputs.node_version }}
5872
cache: "pnpm"
5973

6074
- name: Install dependencies
6175
run: pnpm i --frozen-lockfile
6276
env:
63-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
77+
GITHUB_TOKEN: ${{ secrets.github_token }}
6478
NODE_OPTIONS: "--max_old_space_size=4096"
6579

6680
- name: Bootstrap monorepo
6781
run: pnpm bootstrap
6882
env:
69-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83+
GITHUB_TOKEN: ${{ secrets.github_token }}
7084
NODE_OPTIONS: "--max_old_space_size=4096"
7185

7286
- name: Deploy to Cloudflare Pages
7387
id: deploy
74-
uses: cloudflare/wrangler-action@v3
88+
uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
7589
with:
76-
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
77-
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
90+
apiToken: ${{ secrets.cloudflare_api_token }}
91+
accountId: ${{ secrets.cloudflare_account_id }}
7892
command: pages publish "${{ inputs.dist_path }}" --project-name="${{ inputs.project_name }}"
79-
gitHubToken: ${{ secrets.GITHUB_TOKEN }}
93+
gitHubToken: ${{ secrets.github_token }}
8094

8195
- name: Output deployment URL
8296
run: |

‎.github/workflows/_deploy-sites.yml‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,16 @@ on:
3232
required: false
3333
default: true
3434
type: boolean
35+
secrets:
36+
cloudflare_api_token:
37+
description: "Cloudflare API token"
38+
required: true
39+
cloudflare_account_id:
40+
description: "Cloudflare Account ID"
41+
required: true
42+
github_token:
43+
description: "GitHub token"
44+
required: true
3545
workflow_dispatch:
3646
inputs:
3747
node_version:
@@ -64,6 +74,8 @@ on:
6474
default: true
6575
type: boolean
6676

77+
permissions: {}
78+
6779
jobs:
6880
delay:
6981
name: Delay before deployment
@@ -87,7 +99,10 @@ jobs:
8799
dist_path: "packages/altair-app/dist/browser"
88100
deployment_name: "Deploy Web App"
89101
node_version: ${{ inputs.node_version }}
90-
secrets: inherit
102+
secrets:
103+
cloudflare_api_token: ${{ secrets.cloudflare_api_token }}
104+
cloudflare_account_id: ${{ secrets.cloudflare_account_id }}
105+
github_token: ${{ secrets.github_token }}
91106

92107
deploy-docs:
93108
name: Deploy Docs
@@ -99,7 +114,10 @@ jobs:
99114
dist_path: "packages/altair-docs/.vitepress/dist"
100115
deployment_name: "Deploy Documentation"
101116
node_version: ${{ inputs.node_version }}
102-
secrets: inherit
117+
secrets:
118+
cloudflare_api_token: ${{ secrets.cloudflare_api_token }}
119+
cloudflare_account_id: ${{ secrets.cloudflare_account_id }}
120+
github_token: ${{ secrets.github_token }}
103121

104122
deploy-redirect:
105123
name: Deploy Login Redirect
@@ -111,7 +129,10 @@ jobs:
111129
dist_path: "packages/login-redirect/dist"
112130
deployment_name: "Deploy Login Redirect"
113131
node_version: ${{ inputs.node_version }}
114-
secrets: inherit
132+
secrets:
133+
cloudflare_api_token: ${{ secrets.cloudflare_api_token }}
134+
cloudflare_account_id: ${{ secrets.cloudflare_account_id }}
135+
github_token: ${{ secrets.github_token }}
115136

116137
deploy-sandbox:
117138
name: Deploy Sandbox
@@ -123,4 +144,7 @@ jobs:
123144
dist_path: "packages/altair-iframe-sandbox/dist"
124145
deployment_name: "Deploy Iframe Sandbox"
125146
node_version: ${{ inputs.node_version }}
126-
secrets: inherit
147+
secrets:
148+
cloudflare_api_token: ${{ secrets.cloudflare_api_token }}
149+
cloudflare_account_id: ${{ secrets.cloudflare_account_id }}
150+
github_token: ${{ secrets.github_token }}

‎.github/workflows/_publish-electron.yml‎

Lines changed: 86 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -4,51 +4,93 @@ on:
44
workflow_call:
55
inputs:
66
node_version:
7-
description: 'Node.js version to use'
8-
default: '22'
7+
description: "Node.js version to use"
8+
default: "22"
99
type: string
1010
build:
11-
description: 'Whether to build'
11+
description: "Whether to build"
1212
required: false
1313
default: true
1414
type: boolean
1515
publish:
16-
description: 'Whether to publish'
16+
description: "Whether to publish"
1717
required: false
1818
default: true
1919
type: boolean
2020
publish_chocolatey:
21-
description: 'Whether to publish to Chocolatey'
21+
description: "Whether to publish to Chocolatey"
2222
required: false
2323
default: true
2424
type: boolean
25+
secrets:
26+
apple_api_key:
27+
description: "Apple API key for macOS notarization"
28+
required: true
29+
apple_api_key_id:
30+
description: "Apple API key ID for macOS notarization"
31+
required: true
32+
apple_id:
33+
description: "Apple ID for macOS notarization"
34+
required: true
35+
apple_id_password:
36+
description: "Apple ID password for macOS notarization"
37+
required: true
38+
apple_team_id:
39+
description: "Apple Team ID for macOS notarization"
40+
required: true
41+
chocolatey_api_key:
42+
description: "Chocolatey API key for publishing"
43+
required: true
44+
github_token:
45+
description: "GitHub token for publishing"
46+
required: true
47+
mac_certs:
48+
description: "macOS code signing certificates (base64 encoded)"
49+
required: true
50+
mac_certs_password:
51+
description: "Password for macOS code signing certificates"
52+
required: true
53+
sentry_auth_token:
54+
description: "Sentry auth token for uploading source maps"
55+
required: true
56+
sentry_org:
57+
description: "Sentry organization"
58+
required: true
59+
sentry_project:
60+
description: "Sentry project"
61+
required: true
62+
snapcraft_store_credentials:
63+
description: "Snapcraft store credentials for Snap Store publishing"
64+
required: true
2565
outputs:
2666
# Map the workflow output(s) to job output(s)
2767
version:
28-
description: 'Built/published version from the workflow'
68+
description: "Built/published version from the workflow"
2969
value: ${{ jobs.electron.outputs.version }}
3070
workflow_dispatch:
3171
inputs:
3272
node_version:
33-
description: 'Node.js version to use'
34-
default: '22'
73+
description: "Node.js version to use"
74+
default: "22"
3575
type: string
3676
build:
37-
description: 'Whether to build'
77+
description: "Whether to build"
3878
required: false
3979
default: true
4080
type: boolean
4181
publish:
42-
description: 'Whether to publish'
82+
description: "Whether to publish"
4383
required: false
4484
default: true
4585
type: boolean
4686
publish_chocolatey:
47-
description: 'Whether to publish to Chocolatey'
87+
description: "Whether to publish to Chocolatey"
4888
required: false
4989
default: true
5090
type: boolean
5191

92+
permissions: {}
93+
5294
jobs:
5395
electron:
5496
strategy:
@@ -59,26 +101,28 @@ jobs:
59101
outputs:
60102
version: ${{ steps.getversion.outputs.version }}
61103
steps:
62-
- uses: actions/checkout@v4
63-
- uses: pnpm/action-setup@v4
104+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
105+
with:
106+
persist-credentials: false
107+
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
64108
- name: Use Node.js ${{ inputs.node_version }} on ${{ matrix.os }}
65-
uses: actions/setup-node@v4
109+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
66110
with:
67111
node-version: ${{ inputs.node_version }}
68-
cache: 'pnpm'
69-
- uses: maxim-lobanov/setup-xcode@v1
112+
cache: "pnpm"
113+
- uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
70114
if: startsWith(matrix.os, 'macos')
71115
with:
72116
xcode-version: latest-stable
73117
- run: pnpm i --frozen-lockfile
74-
- uses: nick-invision/retry@v2
118+
- uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
75119
with:
76120
timeout_minutes: 20
77121
max_attempts: 3
78122
command: pnpm build:ci
79123
# Update .npmrc file to support electron builder
80124
# https://www.electron.build/#note-for-pnpm
81-
- uses: nodef/npm-config.action@v1.0.0
125+
- uses: nodef/npm-config.action@d886ec78e341a72863181caf1c2d3c10b6a776d2 # v1.0.0
82126
with:
83127
path: .npmrc # Path to the .npmrc file
84128
reset: false
@@ -90,10 +134,10 @@ jobs:
90134
- run: pnpm deploy --filter=altair out/elx-files
91135

92136
- name: Install Snapcraft
93-
uses: samuelmeuli/action-snapcraft@v2
137+
uses: samuelmeuli/action-snapcraft@d33c176a9b784876d966f80fb1b461808edc0641 # v2.1.1
94138
if: startsWith(matrix.os, 'ubuntu')
95139
env:
96-
SNAPCRAFT_TOKEN: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
140+
SNAPCRAFT_TOKEN: ${{ secrets.snapcraft_store_credentials }}
97141

98142
- name: Prepare for app notarization
99143
if: startsWith(matrix.os, 'macos')
@@ -122,7 +166,7 @@ jobs:
122166
# disable for macos not in master branch, because code signing is skipped in pull requests
123167
if: ${{ inputs.publish || !(startsWith(matrix.os, 'macos') && github.ref != 'refs/heads/master') }}
124168
id: build-electron
125-
uses: paneron/action-electron-builder@v1.8.1
169+
uses: paneron/action-electron-builder@14b133702d1b2e9749912051c43ed62b4afe56c8 # v1.8.1
126170
with:
127171
github_token: ${{ secrets.github_token }}
128172
package_root: out/elx-files/
@@ -136,12 +180,12 @@ jobs:
136180
env:
137181
# macOS notarization API key
138182
# https://www.codiga.io/blog/notarize-sign-electron-app/
139-
APPLE_ID: ${{ secrets.APPLE_ID }}
140-
APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
141-
APPLEIDPASS: ${{ secrets.APPLE_ID_PASSWORD }}
142-
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
143-
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
144-
DEBUG: '@malept/flatpak-bundler'
183+
APPLE_ID: ${{ secrets.apple_id }}
184+
APPLE_ID_PASSWORD: ${{ secrets.apple_id_password }}
185+
APPLEIDPASS: ${{ secrets.apple_id_password }}
186+
APPLE_TEAM_ID: ${{ secrets.apple_team_id }}
187+
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.snapcraft_store_credentials }}
188+
DEBUG: "@malept/flatpak-bundler"
145189

146190
# chocolatey
147191
- name: Read VERSION file
@@ -154,11 +198,11 @@ jobs:
154198
echo "version=$(cat VERSION)" >> $GITHUB_OUTPUT
155199
- name: Add mask
156200
run: |
157-
echo "::add-mask::${{ secrets.CHOCOLATEY_API_KEY }}"
201+
echo "::add-mask::${{ secrets.chocolatey_api_key }}"
158202
- name: chocolatey pack
159203
if: startsWith(matrix.os, 'windows')
160204
continue-on-error: true
161-
uses: crazy-max/ghaction-chocolatey@v3
205+
uses: crazy-max/ghaction-chocolatey@2526f467ccbd337d307fe179959cabbeca0bc8c0 # v3.4.0
162206
with:
163207
args: pack chocolatey\altair-graphql.nuspec
164208
# - name: chocolatey install (test choco packaging)
@@ -172,39 +216,39 @@ jobs:
172216
- name: chocolatey push
173217
if: ${{ startsWith(matrix.os, 'windows') && inputs.publish_chocolatey && inputs.publish }}
174218
continue-on-error: true
175-
uses: crazy-max/ghaction-chocolatey@v3
219+
uses: crazy-max/ghaction-chocolatey@2526f467ccbd337d307fe179959cabbeca0bc8c0 # v3.4.0
176220
with:
177-
args: push altair-graphql.${{ steps.getversion.outputs.version }}.nupkg -s https://push.chocolatey.org/ -k="'${{ secrets.CHOCOLATEY_API_KEY }}'"
221+
args: push altair-graphql.${{ steps.getversion.outputs.version }}.nupkg -s https://push.chocolatey.org/ -k="'${{ secrets.chocolatey_api_key }}'"
178222

179223
- name: Upload source maps to Sentry (app)
180224
if: startsWith(matrix.os, 'ubuntu') && env.SENTRY_ORG
181-
uses: getsentry/action-release@v1
225+
uses: getsentry/action-release@a74facf8a080ecbdf1cb355f16743530d712abb7 # v1.11.0
182226
env:
183-
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
184-
SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
185-
SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
227+
SENTRY_AUTH_TOKEN: ${{ secrets.sentry_auth_token }}
228+
SENTRY_ORG: ${{ secrets.sentry_org }}
229+
SENTRY_PROJECT: ${{ secrets.sentry_project }}
186230
with:
187231
environment: ${{ inputs.publish && 'production' || '' }}
188232
sourcemaps: packages/altair-app/dist/
189233
version: ${{ inputs.publish && steps.getversion.outputs.version || '' }}
190-
url_prefix: 'altair://-'
234+
url_prefix: "altair://-"
191235
finalize: false
192236
- name: Upload source maps to Sentry (electron)
193237
if: startsWith(matrix.os, 'ubuntu') && env.SENTRY_ORG
194-
uses: getsentry/action-release@v1
238+
uses: getsentry/action-release@a74facf8a080ecbdf1cb355f16743530d712abb7 # v1.11.0
195239
env:
196-
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
197-
SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
198-
SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
240+
SENTRY_AUTH_TOKEN: ${{ secrets.sentry_auth_token }}
241+
SENTRY_ORG: ${{ secrets.sentry_org }}
242+
SENTRY_PROJECT: ${{ secrets.sentry_project }}
199243
with:
200244
environment: ${{ inputs.publish && 'production' || '' }}
201245
sourcemaps: out/elx-files/dist/
202246
version: ${{ inputs.publish && steps.getversion.outputs.version || '' }}
203-
url_prefix: 'app:///dist'
247+
url_prefix: "app:///dist"
204248

205249
- name: Upload electron builds
206250
if: always()
207-
uses: actions/upload-artifact@v4
251+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
208252
with:
209253
name: electron-builds-${{ matrix.os }}
210254
path: out/elx-files/out/**

0 commit comments

Comments
 (0)