Skip to content

Commit 40e8086

Browse files
grdsdevclaude
grdsdev
and
claude
committed
feat(ci): add Phase 5 - Additional improvements
This commit implements Phase 5 of the workflow improvements plan: 1. **Extract Release Command to Script** - Created `.github/scripts/trigger-package-releases.sh` script - Extracted complex melos command from release-tag.yml - Added error handling and logging to the script - Made script executable and self-documenting - Improved maintainability by separating logic from workflow 2. **Enhanced Error Handling for Release Workflows** - Added step IDs to track success/failure of each step - Added workflow summaries to release-tag.yml showing: - Overall status (success/failure) - Commit message and ref information - Added workflow summaries to release-publish.yml showing: - Pub.dev publishing status - GitHub release creation status - Overall package release status - Summaries help quickly identify which step failed 3. **Dependency Vulnerability Scanning** - Created new `dependency-scan.yml` workflow - Runs weekly on Mondays at 9:00 UTC - Triggers on pubspec.yaml/pubspec.lock changes - Can be manually triggered via workflow_dispatch - Generates two reports: - Outdated dependencies report (dart pub outdated) - Security audit report (checks for vulnerabilities) - Uploads reports as artifacts with 30-day retention - Generates formatted summary in GitHub Actions UI - Helps proactively identify security issues These improvements enhance reliability, maintainability, and security of the CI/CD pipeline. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
1 parent 8ff46ff commit 40e8086

File tree

4 files changed

+253
-5
lines changed

4 files changed

+253
-5
lines changed

‎.github/scripts/trigger-package-releases.sh‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/bin/bash
2+
set -e
3+
4+
# Script to trigger release-publish workflows for all unpublished packages
5+
# This script is used by the release-tag workflow after tags are created
6+
7+
echo "Starting package release workflow triggers..."
8+
9+
# Check if GH_TOKEN is set
10+
if [ -z "$GH_TOKEN" ]; then
11+
echo "Error: GH_TOKEN environment variable is not set"
12+
exit 1
13+
fi
14+
15+
# Counter for tracking
16+
TOTAL_PACKAGES=0
17+
SUCCESS_COUNT=0
18+
FAILED_PACKAGES=()
19+
20+
# Run melos exec to trigger workflows for each package
21+
# --no-published: Only unpublished packages
22+
# --no-private: Exclude private packages
23+
# --order-dependents: Process in dependency order
24+
# -c 1: Run one at a time (concurrency 1)
25+
echo "Triggering workflows for unpublished packages..."
26+
melos exec \
27+
-c 1 \
28+
--no-published \
29+
--no-private \
30+
--order-dependents \
31+
-- bash -c '
32+
PACKAGE_NAME="${MELOS_PACKAGE_NAME}"
33+
PACKAGE_VERSION="${MELOS_PACKAGE_VERSION}"
34+
REF="${PACKAGE_NAME}-v${PACKAGE_VERSION}"
35+
36+
echo "----------------------------------------"
37+
echo "Processing: $PACKAGE_NAME v$PACKAGE_VERSION"
38+
echo "Ref: $REF"
39+
40+
if gh workflow run release-publish.yml --ref "$REF"; then
41+
echo "✓ Successfully triggered workflow for $PACKAGE_NAME"
42+
exit 0
43+
else
44+
echo "✗ Failed to trigger workflow for $PACKAGE_NAME"
45+
exit 1
46+
fi
47+
' || {
48+
echo "Error: Some package workflows failed to trigger"
49+
exit 1
50+
}
51+
52+
echo "----------------------------------------"
53+
echo "All package release workflows triggered successfully!"

‎.github/workflows/dependency-scan.yml‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
name: Dependency Vulnerability Scan
2+
3+
on:
4+
schedule:
5+
# Run weekly on Mondays at 9:00 UTC
6+
- cron: '0 9 * * 1'
7+
workflow_dispatch:
8+
pull_request:
9+
paths:
10+
- '**/pubspec.yaml'
11+
- '**/pubspec.lock'
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
contents: read
19+
security-events: write
20+
issues: write
21+
22+
jobs:
23+
scan-dependencies:
24+
name: Scan Dependencies for Vulnerabilities
25+
runs-on: ubuntu-latest
26+
timeout-minutes: 15
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@v4
31+
32+
- name: Setup Dart
33+
uses: dart-lang/setup-dart@v1
34+
with:
35+
sdk: stable
36+
37+
- name: Setup Flutter
38+
uses: subosito/flutter-action@v2
39+
with:
40+
cache: true
41+
42+
- name: Install Melos
43+
run: dart pub global activate melos
44+
45+
- name: Bootstrap workspace
46+
run: melos bootstrap
47+
48+
- name: Check for outdated dependencies
49+
id: outdated
50+
continue-on-error: true
51+
run: |
52+
echo "## Outdated Dependencies Report" > outdated_report.md
53+
echo "" >> outdated_report.md
54+
55+
# Check each package for outdated dependencies
56+
for package in packages/*/pubspec.yaml; do
57+
package_dir=$(dirname "$package")
58+
package_name=$(basename "$package_dir")
59+
60+
echo "### Package: $package_name" >> outdated_report.md
61+
echo "" >> outdated_report.md
62+
63+
cd "$package_dir"
64+
if dart pub outdated --json > outdated.json 2>/dev/null; then
65+
# Parse and format the outdated dependencies
66+
if [ -s outdated.json ]; then
67+
echo "\`\`\`" >> ../../outdated_report.md
68+
dart pub outdated >> ../../outdated_report.md 2>&1 || true
69+
echo "\`\`\`" >> ../../outdated_report.md
70+
else
71+
echo "✅ All dependencies are up to date" >> ../../outdated_report.md
72+
fi
73+
else
74+
echo "⚠️ Could not check dependencies" >> ../../outdated_report.md
75+
fi
76+
echo "" >> ../../outdated_report.md
77+
cd ../..
78+
done
79+
80+
- name: Run Dart dependency audit
81+
id: audit
82+
continue-on-error: true
83+
run: |
84+
echo "## Security Audit Report" > audit_report.md
85+
echo "" >> audit_report.md
86+
87+
# Check each package for security vulnerabilities
88+
for package in packages/*/pubspec.yaml; do
89+
package_dir=$(dirname "$package")
90+
package_name=$(basename "$package_dir")
91+
92+
echo "### Package: $package_name" >> audit_report.md
93+
echo "" >> audit_report.md
94+
95+
cd "$package_dir"
96+
# Note: Using `dart pub get` with vulnerability checking
97+
# Dart SDK has built-in vulnerability database
98+
if dart pub get 2>&1 | grep -i "vulnerabilit" > /dev/null; then
99+
echo "⚠️ Potential vulnerabilities detected:" >> ../../audit_report.md
100+
echo "\`\`\`" >> ../../audit_report.md
101+
dart pub get 2>&1 | grep -A 5 -i "vulnerabilit" >> ../../audit_report.md || true
102+
echo "\`\`\`" >> ../../audit_report.md
103+
else
104+
echo "✅ No known vulnerabilities detected" >> ../../audit_report.md
105+
fi
106+
echo "" >> ../../audit_report.md
107+
cd ../..
108+
done
109+
110+
- name: Generate workflow summary
111+
if: always()
112+
run: |
113+
echo "## Dependency Vulnerability Scan Summary" >> $GITHUB_STEP_SUMMARY
114+
echo "" >> $GITHUB_STEP_SUMMARY
115+
echo "**Scan Date:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY
116+
echo "**Repository:** ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
117+
echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
118+
echo "" >> $GITHUB_STEP_SUMMARY
119+
120+
# Add outdated dependencies report
121+
if [ -f outdated_report.md ]; then
122+
cat outdated_report.md >> $GITHUB_STEP_SUMMARY
123+
echo "" >> $GITHUB_STEP_SUMMARY
124+
fi
125+
126+
# Add audit report
127+
if [ -f audit_report.md ]; then
128+
cat audit_report.md >> $GITHUB_STEP_SUMMARY
129+
echo "" >> $GITHUB_STEP_SUMMARY
130+
fi
131+
132+
# Overall status
133+
if [ "${{ steps.audit.outcome }}" == "success" ] && [ "${{ steps.outdated.outcome }}" == "success" ]; then
134+
echo "---" >> $GITHUB_STEP_SUMMARY
135+
echo "✅ **Status:** Scan completed successfully" >> $GITHUB_STEP_SUMMARY
136+
else
137+
echo "---" >> $GITHUB_STEP_SUMMARY
138+
echo "⚠️ **Status:** Scan completed with warnings" >> $GITHUB_STEP_SUMMARY
139+
fi
140+
141+
- name: Upload reports
142+
if: always()
143+
uses: actions/upload-artifact@v4
144+
with:
145+
name: dependency-scan-reports-${{ github.run_number }}
146+
path: |
147+
outdated_report.md
148+
audit_report.md
149+
retention-days: 30

‎.github/workflows/release-publish.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,13 @@ jobs:
2727
cache: true
2828

2929
- name: Publish to pub.dev
30+
id: publish
3031
uses: bluefireteam/melos-action@v3
3132
with:
3233
publish: true
3334

3435
- name: Create GitHub Release
36+
id: create_release
3537
uses: softprops/action-gh-release@v1
3638
with:
3739
tag_name: ${{ github.ref_name }}
@@ -49,3 +51,30 @@ jobs:
4951
prerelease: false
5052
env:
5153
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
54+
55+
- name: Generate workflow summary
56+
if: always()
57+
run: |
58+
echo "## Package Release Summary" >> $GITHUB_STEP_SUMMARY
59+
echo "" >> $GITHUB_STEP_SUMMARY
60+
echo "**Package:** \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
61+
echo "" >> $GITHUB_STEP_SUMMARY
62+
63+
if [ "${{ steps.publish.outcome }}" == "success" ]; then
64+
echo "✅ **Pub.dev Publishing:** Success" >> $GITHUB_STEP_SUMMARY
65+
else
66+
echo "❌ **Pub.dev Publishing:** Failed" >> $GITHUB_STEP_SUMMARY
67+
fi
68+
69+
if [ "${{ steps.create_release.outcome }}" == "success" ]; then
70+
echo "✅ **GitHub Release:** Success" >> $GITHUB_STEP_SUMMARY
71+
else
72+
echo "❌ **GitHub Release:** Failed" >> $GITHUB_STEP_SUMMARY
73+
fi
74+
75+
echo "" >> $GITHUB_STEP_SUMMARY
76+
if [ "${{ steps.publish.outcome }}" == "success" ] && [ "${{ steps.create_release.outcome }}" == "success" ]; then
77+
echo "🎉 Package published successfully!" >> $GITHUB_STEP_SUMMARY
78+
else
79+
echo "⚠️ Some steps failed. Please review the logs above." >> $GITHUB_STEP_SUMMARY
80+
fi

‎.github/workflows/release-tag.yml‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,26 @@ jobs:
3939
uses: bluefireteam/melos-action@v3
4040
with:
4141
tag: true
42-
- run: |
43-
melos exec -c 1 --no-published --no-private --order-dependents -- \
44-
gh workflow run release-publish.yml \
45-
--ref \$MELOS_PACKAGE_NAME-v\$MELOS_PACKAGE_VERSION
42+
43+
- name: Trigger package release workflows
44+
id: trigger_releases
45+
run: .github/scripts/trigger-package-releases.sh
4646
env:
47-
GH_TOKEN: ${{ steps.app-token.outputs.token }}
47+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
48+
49+
- name: Generate workflow summary
50+
if: always()
51+
run: |
52+
echo "## Release Tag Workflow Summary" >> $GITHUB_STEP_SUMMARY
53+
echo "" >> $GITHUB_STEP_SUMMARY
54+
if [ "${{ steps.trigger_releases.outcome }}" == "success" ]; then
55+
echo "✅ **Status:** All package release workflows triggered successfully" >> $GITHUB_STEP_SUMMARY
56+
else
57+
echo "❌ **Status:** Failed to trigger some package release workflows" >> $GITHUB_STEP_SUMMARY
58+
echo "" >> $GITHUB_STEP_SUMMARY
59+
echo "**Error Details:**" >> $GITHUB_STEP_SUMMARY
60+
echo "Please check the logs for the 'Trigger package release workflows' step for more information." >> $GITHUB_STEP_SUMMARY
61+
fi
62+
echo "" >> $GITHUB_STEP_SUMMARY
63+
echo "**Commit:** ${{ github.event.head_commit.message }}" >> $GITHUB_STEP_SUMMARY
64+
echo "**Ref:** ${{ github.ref }}" >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)