Merge remote-tracking branch 'origin/main' into allow-second-token-integration-tests

Author: Pijukatel

.github/workflows/check-execute-workflow-dist.yaml

@@ -0,0 +1,44 @@
+name: Check and Update dist in js actions
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'execute-workflow/**'
+
+permissions:
+  contents: write
+
+jobs:
+  check-and-update-dist:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+          cache-dependency-path: execute-workflow/package-lock.json
+
+      - name: Install dependencies
+        working-directory: execute-workflow
+        run: npm ci
+
+      - name: Rebuild dist
+        working-directory: execute-workflow
+        run: npm run build
+
+      - name: Commit and push if changed
+        uses: EndBug/add-and-commit@v9
+        with:
+          author_name: Apify Release Bot
+          author_email: noreply@apify.com
+          message: "chore: rebuild execute-workflow dist [skip ci]"
+          add: 'execute-workflow/dist/'

.github/workflows/create_changelog.yaml

@@ -58,7 +58,7 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-arm64
     steps:
       - name: get changelog
         id: changelog

.github/workflows/deploy_cloudformation.yaml

@@ -88,6 +88,9 @@ on:
       slackToken:
         description: Slack API token
         required: false
+      secretParameters:
+        description: Secret parameters (plaint text or file) for cloudformation template. Limited security, scoped per CF stack.
+        required: false
 
 jobs:
   deploy:
@@ -192,7 +195,9 @@ jobs:
           fi
 
           OPTIONAL_PARAMETERS=""
-          if [ "${{ inputs.parameters }}" != "" ]; then
+          if [ "${{ inputs.parameters }}" != "" ] && [ "${{ secrets.secretParameters }}" != "" ]; then
+              OPTIONAL_PARAMETERS="${OPTIONAL_PARAMETERS} --parameter-overrides ${{ inputs.parameters }} ${{ secrets.secretParameters }}"
+          elif [ "${{ inputs.parameters }}" != "" ] && [ "${{ secrets.secretParameters }}" == "" ]; then
               OPTIONAL_PARAMETERS="${OPTIONAL_PARAMETERS} --parameter-overrides ${{ inputs.parameters }}"
           fi
           if [ "${{ inputs.capabilities }}" != "" ]; then

.github/workflows/invalidate_cloudfront.yaml

@@ -52,7 +52,7 @@ on:
 
 jobs:
   invalidate:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-arm64
     steps:
       - name: assume IAM role
         uses: aws-actions/configure-aws-credentials@v4
@@ -62,11 +62,11 @@ jobs:
           aws-region: ${{ inputs.awsRegion }}
           role-to-assume: ${{ inputs.awsRoleArn }}
           role-duration-seconds: ${{ inputs.awsSessionDuration }}
-          
+
           # This parameter is needed otherwise this action is trying to tag session
           # which does not work for cross-account assume
           role-skip-session-tagging: true
-      
+
       - name: invalidate
         run: |
           echo ">>> Invalidating path ${{ inputs.path }} of distribution ${{ inputs.distributionId }}"

.github/workflows/lint_cloudformation.yaml

@@ -21,7 +21,7 @@ env:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-arm64
     steps:
       - name: clone repository
         uses: actions/checkout@v4

.github/workflows/lint_gh_actions.yaml

@@ -14,7 +14,7 @@ env:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-arm64
     steps:
       - name: clone repository
         uses: actions/checkout@v4

.github/workflows/lint_helmfile.yaml

@@ -26,11 +26,11 @@ on:
 
 env:
   # renovate: datasource=github-releases depName=helmfile/helmfile
-  HELMFILE_VERSION: v0.164.0
+  HELMFILE_VERSION: v0.171.0
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-arm64
     steps:
       - name: clone repository
         uses: actions/checkout@v4
@@ -39,7 +39,7 @@ jobs:
         run: |
           HELMFILE_VERSION_WITHOUT_PREFIX=${HELMFILE_VERSION:1}
           mkdir -p $HOME/.local/bin
-          curl -fsSL -o helmfile.tar.gz https://github.com/helmfile/helmfile/releases/download/${{ env.HELMFILE_VERSION }}/helmfile_${HELMFILE_VERSION_WITHOUT_PREFIX}_linux_amd64.tar.gz
+          curl -fsSL -o helmfile.tar.gz https://github.com/helmfile/helmfile/releases/download/${{ env.HELMFILE_VERSION }}/helmfile_${HELMFILE_VERSION_WITHOUT_PREFIX}_linux_arm64.tar.gz
           tar -C $HOME/.local/bin/ -xf ./helmfile.tar.gz
           chmod +x $HOME/.local/bin/helmfile
           echo "$HOME/.local/bin" >> $GITHUB_PATH

.github/workflows/local_lint_gh_actions.yaml

@@ -13,4 +13,6 @@ jobs:
   lint:
     uses: ./.github/workflows/lint_gh_actions.yaml
     with:
-      extraArgs: -ignore 'property "aws_.+" is not defined in .+'
+      extraArgs: >
+        -ignore 'label "ubuntu-22.04-arm64" is unknown. .+'
+        -ignore 'property "aws_.+" is not defined in .+'

.github/workflows/open_pull_request.yaml

@@ -26,7 +26,7 @@ on:
 jobs:
   # TODO: these steps could be separate wf
   open-pull-request:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-arm64
     steps:
       - name: open release pull-request
         uses: apify/release-pr-action@v3.2.0

.github/workflows/pull_request_toolkit.yaml

@@ -11,9 +11,9 @@ concurrency: # This is to make sure that it's executed only for the most recent
 
 jobs:
   apify-pr-toolkit:
-    # Commented out as it sometimes happens that once PR was in a draft the workflows are not being run later on.  
+    # Commented out as it sometimes happens that once PR was in a draft the workflows are not being run later on.
     # if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-arm64
     steps:
       - name: run pull-request-toolkit action
         uses: apify/pull-request-toolkit-action@main