Skip to content

Commit 9b8a0cc

Browse files
sgammonsgammon
committed
chore: devops configs and workflows
Signed-off-by: Sam Gammon <[email protected]>
1 parent 8bd6435 commit 9b8a0cc

File tree

6 files changed

+345
-0
lines changed

6 files changed

+345
-0
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
*.* @sgammon

‎.github/dependabot.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
version: 2
2+
updates:
3+
# Maintain dependencies for GitHub Actions
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
target-branch: "main"
7+
schedule:
8+
interval: "daily"
9+
assignees:
10+
- "sgammon"
11+
12+
# Maintain dependencies for npm
13+
- package-ecosystem: "npm"
14+
directory: "/"
15+
target-branch: "main"
16+
schedule:
17+
interval: "weekly"
18+
assignees:
19+
- "sgammon"
20+
21+
# Maintain dependencies for Gradle
22+
- package-ecosystem: "gradle"
23+
directory: "/"
24+
target-branch: "main"
25+
schedule:
26+
interval: "weekly"
27+
assignees:
28+
- "sgammon"
29+
30+
# Maintain dependencies for Docker
31+
- package-ecosystem: "docker"
32+
directory: "/"
33+
target-branch: "main"
34+
schedule:
35+
interval: "weekly"
36+
assignees:
37+
- "sgammon"

‎.github/dependency-review-config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
license-check: true
2+
vulnerability-check: true
3+
fail-on-severity: "high"
4+
5+
allow-ghsas: []

‎.github/workflows/module.build.yml‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
---
2+
name: "Build"
3+
4+
"on":
5+
workflow_dispatch:
6+
inputs:
7+
## Runner to use
8+
runner:
9+
description: "Runner"
10+
type: string
11+
default: "ubuntu-latest"
12+
13+
## Whether to build native targets
14+
native:
15+
description: "Native"
16+
type: boolean
17+
default: true
18+
19+
## Whether to build iOS targets
20+
ios:
21+
description: "iOS"
22+
type: boolean
23+
default: true
24+
25+
workflow_call:
26+
inputs:
27+
runner:
28+
description: "Runner"
29+
type: string
30+
default: "ubuntu-latest"
31+
label:
32+
description: "Label"
33+
type: string
34+
default: "Ubuntu"
35+
native:
36+
description: "Native"
37+
type: boolean
38+
default: true
39+
ios:
40+
description: "iOS"
41+
type: boolean
42+
default: true
43+
44+
secrets:
45+
## Secrets: Buildless API key
46+
BUILDLESS_APIKEY:
47+
required: false
48+
49+
env:
50+
BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
51+
PNPM_VERSION: ${{ vars.PNPM_VERSION || '8.7.5' }}
52+
NODE_VERSION: ${{ vars.NODE_VERSION || '20.2.0' }}
53+
54+
jobs:
55+
build:
56+
name: "Build"
57+
runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
58+
steps:
59+
- name: Harden Runner
60+
uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
61+
with:
62+
egress-policy: audit
63+
- name: "Setup: Checkout"
64+
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
65+
with:
66+
fetch-depth: 0
67+
- name: "Setup: PNPM"
68+
uses: pnpm/action-setup@v2
69+
with:
70+
version: ${{ env.PNPM_VERSION }}
71+
- name: "Setup: Node"
72+
uses: buildjet/setup-node@v3
73+
with:
74+
node-version: ${{ env.NODE_VERSION }}
75+
cache: "pnpm"
76+
- name: "Setup: Install Packages (Frozen)"
77+
run: pnpm install --frozen-lockfile
78+
if: |
79+
(
80+
github.event_name != 'pull_request' || (
81+
!contains(github.ref, 'deps/') &&
82+
!contains(github.ref, 'dependabot/') &&
83+
!contains(github.ref, 'renovate/') &&
84+
!contains(github.event.pull_request.labels.*.name, 'dependencies') &&
85+
!contains(github.event.head_commit.message, 'ci:unlock-deps')
86+
))
87+
- name: "Setup: Install Packages (Update)"
88+
run: pnpm install --no-frozen-lockfile
89+
if: |
90+
(
91+
github.event_name == 'pull_request' && contains(github.ref, 'deps/') ||
92+
github.event_name == 'pull_request' && contains(github.ref, 'dependabot/') ||
93+
github.event_name == 'pull_request' && contains(github.ref, 'renovate/') ||
94+
github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'dependencies') ||
95+
contains(github.event.head_commit.message, 'ci:unlock-deps')
96+
)
97+
- name: "Build: Web"
98+
shell: bash
99+
env:
100+
CI: true
101+
run: pnpm run build
102+
103+
build-ios:
104+
name: "Build: iOS"
105+
if: inputs.ios && inputs.native
106+
runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
107+
steps:
108+
- name: Harden Runner
109+
uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
110+
with:
111+
egress-policy: audit
112+
- name: "Setup: Checkout"
113+
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
114+
with:
115+
fetch-depth: 0
116+
- name: "Setup: PNPM"
117+
uses: pnpm/action-setup@v2
118+
with:
119+
version: ${{ env.PNPM_VERSION }}
120+
- name: "Setup: Node"
121+
uses: buildjet/setup-node@v3
122+
with:
123+
node-version: ${{ env.NODE_VERSION }}
124+
cache: "pnpm"
125+
- name: "Setup: Install Packages (Frozen)"
126+
run: pnpm install --frozen-lockfile
127+
if: |
128+
(
129+
github.event_name != 'pull_request' || (
130+
!contains(github.ref, 'deps/') &&
131+
!contains(github.ref, 'dependabot/') &&
132+
!contains(github.ref, 'renovate/') &&
133+
!contains(github.event.pull_request.labels.*.name, 'dependencies') &&
134+
!contains(github.event.head_commit.message, 'ci:unlock-deps')
135+
))
136+
- name: "Setup: Install Packages (Update)"
137+
run: pnpm install --no-frozen-lockfile
138+
if: |
139+
(
140+
github.event_name == 'pull_request' && contains(github.ref, 'deps/') ||
141+
github.event_name == 'pull_request' && contains(github.ref, 'dependabot/') ||
142+
github.event_name == 'pull_request' && contains(github.ref, 'renovate/') ||
143+
github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'dependencies') ||
144+
contains(github.event.head_commit.message, 'ci:unlock-deps')
145+
)
146+
- name: "Build: iOS"
147+
shell: bash
148+
env:
149+
CI: true
150+
run: pnpm run build:ios
151+
152+
build-android:
153+
name: "Build: Android"
154+
if: inputs.native
155+
runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
156+
steps:
157+
- name: Harden Runner
158+
uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
159+
with:
160+
egress-policy: audit
161+
- name: "Setup: Checkout"
162+
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
163+
with:
164+
fetch-depth: 0
165+
- name: "Setup: PNPM"
166+
uses: pnpm/action-setup@v2
167+
with:
168+
version: ${{ env.PNPM_VERSION }}
169+
- name: "Setup: Node"
170+
uses: buildjet/setup-node@v3
171+
with:
172+
node-version: ${{ env.NODE_VERSION }}
173+
cache: "pnpm"
174+
- name: "Setup: Install Packages (Frozen)"
175+
run: pnpm install --frozen-lockfile
176+
if: |
177+
(
178+
github.event_name != 'pull_request' || (
179+
!contains(github.ref, 'deps/') &&
180+
!contains(github.ref, 'dependabot/') &&
181+
!contains(github.ref, 'renovate/') &&
182+
!contains(github.event.pull_request.labels.*.name, 'dependencies') &&
183+
!contains(github.event.head_commit.message, 'ci:unlock-deps')
184+
))
185+
- name: "Setup: Install Packages (Update)"
186+
run: pnpm install --no-frozen-lockfile
187+
if: |
188+
(
189+
github.event_name == 'pull_request' && contains(github.ref, 'deps/') ||
190+
github.event_name == 'pull_request' && contains(github.ref, 'dependabot/') ||
191+
github.event_name == 'pull_request' && contains(github.ref, 'renovate/') ||
192+
github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'dependencies') ||
193+
contains(github.event.head_commit.message, 'ci:unlock-deps')
194+
)
195+
- name: "Build: Android"
196+
shell: bash
197+
env:
198+
CI: true
199+
run: pnpm run build:android

‎.github/workflows/on.pr.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
name: "PR"
3+
4+
"on":
5+
## Run on PR filings
6+
pull_request:
7+
paths:
8+
- apps/**/*.*
9+
- packages/**/*.*
10+
- pnpm-lock.yaml
11+
- package.json
12+
- .github/workflows/*.yml
13+
14+
## Run on PR queue check requests
15+
merge_group: {}
16+
17+
concurrency:
18+
# Cancel previous actions from the same PR: https://stackoverflow.com/a/72408109
19+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
20+
cancel-in-progress: true
21+
22+
permissions:
23+
contents: read
24+
25+
jobs:
26+
dependency-review:
27+
name: "Dependency Review"
28+
runs-on: ubuntu-latest
29+
steps:
30+
- name: Harden Runner
31+
uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
32+
with:
33+
egress-policy: audit
34+
- name: "Checkout Repository"
35+
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
36+
- name: "Dependency Review"
37+
uses: actions/dependency-review-action@f6fff72a3217f580d5afd49a46826795305b63c7 # v3.0.8
38+
with:
39+
config-file: "./.github/dependency-review-config.yml"
40+
41+
test:
42+
name: "Tests: ${{ matrix.label }}"
43+
uses: ./.github/workflows/module.build.yml
44+
strategy:
45+
fail-fast: false
46+
matrix:
47+
runner: [ubuntu-latest]
48+
label: ["Ubuntu"]
49+
include:
50+
# Bazel 7
51+
- runner: ubuntu-latest
52+
label: Ubuntu
53+
- runner: macos-latest
54+
label: macOS
55+
- runner: windows-2022
56+
label: Windows
57+
58+
secrets: inherit
59+
with:
60+
runner: ${{ matrix.runner }}
61+
label: ${{ matrix.label }}

‎.github/workflows/on.push.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
name: "CI"
3+
4+
"on":
5+
## Run on push
6+
push:
7+
paths:
8+
- apps/**/*.*
9+
- packages/**/*.*
10+
- pnpm-lock.yaml
11+
- package.json
12+
- .github/workflows/*.yml
13+
14+
concurrency:
15+
# Cancel previous actions from the same PR: https://stackoverflow.com/a/72408109
16+
group: ${{ github.workflow }}-${{ github.ref }}
17+
cancel-in-progress: true
18+
19+
permissions:
20+
contents: read
21+
22+
jobs:
23+
build:
24+
name: "Build: ${{ matrix.label }}"
25+
uses: ./.github/workflows/module.build.yml
26+
strategy:
27+
fail-fast: false
28+
matrix:
29+
runner: [ubuntu-latest]
30+
label: ["Ubuntu"]
31+
include:
32+
- runner: ubuntu-latest
33+
label: Ubuntu
34+
- runner: macos-latest
35+
label: macOS
36+
- runner: windows-2022
37+
label: Windows
38+
39+
secrets: inherit
40+
with:
41+
runner: ${{ matrix.runner }}
42+
label: ${{ matrix.label }}

0 commit comments

Comments
 (0)