ecosystem/.github/workflows/_build.yml at febdc6165a245fa1047594d6e95e7b559a6b0811 · openecosystems/ecosystem · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: _build
on:
  workflow_call:
    inputs:
      go_version:
        required: false
        type: string
      go-version:
        required: false
        type: string
        default: stable
      go-version-file:
        required: false
        type: string
      working-directory:
        required: false
        type: string
      goreleaser_key:
        required: false
        type: string
    secrets:
      gh_pat:
        required: false
      goreleaser_key:
        required: true
      codecov_token:
        required: true
permissions:
  contents: write
  pull-requests: write
jobs:
#  vulnerability:
#    runs-on: ubuntu-latest
#    env:
#      GH_PAT: ${{ secrets.gh_pat }}
#    steps:
#      - name: Checkout code
#        uses: actions/checkout@v4
#        with:
#          fetch-depth: 0
#      - run: |
#          git config --global url."https://${{ secrets.gh_pat }}@github.com/openecosystems".insteadOf "https://github.com/openecosystems"
#        if: env.GH_PAT != null
#      - uses: actions/setup-go@v5
#        with:
#          go-version: stable
#          cache: true
#          check-latest: true
#      - uses: pnpm/action-setup@v4
#        with:
#          version: 9
#      - uses: actions/setup-node@v4
#        with:
#          node-version: 20
#          cache: 'pnpm'
#      - run: pnpm install --frozen-lockfile
#      - uses: nrwl/nx-set-shas@v4
#      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
#      - run: pnpm exec nx affected -t vulnerability --base=${{ env.NX_BASE }} --head=${{ env.NX_HEAD }}
  build:
    strategy:
      matrix:
        os: [ ubuntu-latest ]
    runs-on: ${{ matrix.os }}
    env:
      GO111MODULE: "on"
      GH_PAT: ${{ secrets.gh_pat }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GORELEASER_KEY: ${{ secrets.goreleaser_key }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9

      - run: pnpm dlx nx-cloud start-ci-run --distribute-on=".nx/workflows/distribution-config.yaml" --stop-agents-after="distribute" --with-env-vars="GORELEASER_KEY,GITHUB_TOKEN"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_KEY: ${{ secrets.goreleaser_key }}

      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - name: Install node dependencies
        run: pnpm install --frozen-lockfile

      - name: Set Shas
        uses: nrwl/nx-set-shas@v4

      - name: Run NX
        #run: pnpm exec nx affected -t lint build --exclude="apps-clients-public-cli-v2alpha-oeco" --base=${{ env.NX_BASE }} --head=${{ env.NX_HEAD }}
        run: pnpm exec nx affected -t build --exclude='*,!tag:type:sdk' --base=${{ env.NX_BASE }} --head=${{ env.NX_HEAD }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_KEY: ${{ secrets.goreleaser_key }}

#      - name: Merge coverage reports
#        run: |
#          mkdir -p ./coverage
#          find ./coverage -name "coverage.txt" -exec cat {} + > ./coverage/coverage.txt
#
#      - name: Upload results to Codecov
#        uses: codecov/codecov-action@v5
#        with:
#          token: ${{ secrets.codecov_token }}
#          slug: openecosystems/ecosystem
#          files: "./coverage/coverage.txt"

  dependabot:
    #needs: [ build, vulnerability ]
    needs: [ build ]
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: write
    if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'}}
    steps:
      - id: metadata
        uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7 # v2.3.0
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - run: |
          gh pr review --approve "$PR_URL"
          gh pr merge --squash "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}