Skip to content

Commit e613306

Browse files
elliot-huffmanelliot-huffman
committed
Migrate to TBD
Used ObjectID Converter as template for workflows. Update actions versions. Introduce parallelization where possible to reduce CI/CD runtimes. Standardize workflow file names.
1 parent 2caf9bb commit e613306

9 files changed

Lines changed: 402 additions & 226 deletions

File tree

‎.github/workflows/Build.yml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Display Name of the workflow
2+
name: Build - Production
3+
4+
# Event listeners for when the job should start execution
5+
on:
6+
# Allows you to run this workflow manually from the Actions tab
7+
workflow_dispatch:
8+
9+
# Run the build checks on every change
10+
push:
11+
branches: [main]
12+
pull_request:
13+
branches: [main]
14+
15+
# Allow this workflow to be called from another workflow
16+
workflow_call:
17+
inputs:
18+
correlationId:
19+
description: 'Correlates the origin job with the child instance since process start does not return an ID.'
20+
type: string
21+
required: false
22+
outputs:
23+
packageName:
24+
description: 'The name of the generated NPM package.'
25+
value: ${{ jobs.Build-Prod.outputs.packageName }}
26+
27+
# Define each session of execution that should be executed
28+
jobs:
29+
# Execution session that calculates the metadata for the build and makes it available to downstream jobs through outputs
30+
Metadata:
31+
# Human friendly name of the job
32+
name: Calculate - Metadata
33+
34+
# Grant the required permissions to run the job
35+
permissions:
36+
contents: read
37+
38+
# Execute the workflow
39+
uses: ./.github/workflows/Metadata.yml
40+
41+
# Execution session that builds the artifacts that are used for deployment
42+
Build-Prod:
43+
# Display name of the job
44+
name: Build - Development Utilities
45+
46+
# Configures the filter for which operating system that should be used when selecting runners
47+
runs-on: ubuntu-latest
48+
49+
# Ensure dependant jobs have completed before running this job
50+
needs: [Metadata]
51+
52+
# Sets the scopes available to the github_token injected to the GH Actions runner
53+
permissions:
54+
attestations: write
55+
contents: read
56+
id-token: write
57+
packages: write
58+
59+
# Content that can be reused across multiple workflows to avoid duplication of code and logic
60+
outputs:
61+
packageName: ${{ steps.generate-package.outputs.package-file }}
62+
63+
# Set of steps to execute to build and capture the static HTML
64+
steps:
65+
# Used to uniquely identify the specific call to correlate the calling entity with the cross repo build
66+
- name: ${{ github.event.inputs.correlationId }}
67+
id: correlationId
68+
background: true
69+
run: echo run identifier ${{ inputs.correlationId }}
70+
71+
# Grab the source code from the repo
72+
- name: Checkout Files from Repo
73+
background: true
74+
uses: actions/checkout@v7
75+
76+
# Enable Node.JS in the build environment
77+
- name: Install - Node.JS Runtime
78+
uses: actions/setup-node@v6
79+
background: true
80+
with:
81+
node-version: 24
82+
registry-url: https://npm.pkg.github.com
83+
scope: software-hardware-integration-lab
84+
85+
# Set up the socket firewall binary
86+
- name: Install - Socket Firewall
87+
uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f
88+
background: true
89+
with:
90+
mode: firewall-free
91+
92+
# Bring job back to sync execution by awaiting for all async jobs to finish before continuing
93+
- name: Steps - Convert Back To Synchronous Execution - Environment Setup
94+
wait-all: true
95+
96+
# Update the NPM CLI to the latest available version
97+
- name: Update NPM CLI
98+
run: sfw npm install -g npm
99+
100+
# Installs the dependencies for building the project
101+
- name: Install - Dependencies
102+
run: sfw npm ci
103+
104+
# Cryptographically attest that packages haven't been tampered where supported
105+
- name: Attest Dependency Provenance
106+
run: npm audit signatures
107+
108+
# Update the version of SHIELD being uploaded to have a different version number to avoid SDG version conflict
109+
- name: Tattoo Version - Experimental Channel
110+
if: ${{ needs.Metadata.outputs.channel != 'stable' }}
111+
run: npm version --no-commit-hooks --no-git-tag-version "${{ needs.Metadata.outputs.version }}-${{ needs.Metadata.outputs.channel }}.${{ needs.Metadata.outputs.shortSha }}"
112+
113+
# Compile the project
114+
- name: Build the Project
115+
run: npm run-script build:Prod
116+
117+
# Publish the artifact to NPM with attestation
118+
- name: Upload Package to NPM Registry
119+
env:
120+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
121+
run: npm publish --tag ${{ needs.Metadata.outputs.channel }}
122+
123+
# Generate the NPM package for beta and stable publishing, if required
124+
- name: Generate NPM Package
125+
id: generate-package
126+
run: echo "package-file=$(npm pack --ignore-scripts)" >> "$GITHUB_OUTPUT"
127+
128+
# Create an attestation for the generated NPM package to ensure integrity and authenticity
129+
- name: Attest NPM Package
130+
uses: actions/attest@v4
131+
with:
132+
subject-path: ${{ steps.generate-package.outputs.package-file }}
133+
134+
# Upload the compiled HTML as an artifact for future consumption
135+
- name: Upload a Build Artifact
136+
uses: actions/upload-artifact@v7
137+
with:
138+
name: NPM-Package
139+
if-no-files-found: error
140+
path: ${{ steps.generate-package.outputs.package-file }}

‎.github/workflows/Deploy.yml‎

Lines changed: 0 additions & 147 deletions
This file was deleted.

‎.github/workflows/Metadata.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# Display Name of the workflow
2+
name: Calculate - Metadata
3+
4+
# Event listeners for when the job should start execution
5+
on:
6+
# Allows you to run this workflow manually from the Actions tab
7+
workflow_dispatch:
8+
9+
# Allow this workflow to be called from another workflow
10+
workflow_call:
11+
inputs:
12+
correlationId:
13+
description: 'Correlates the origin job with the child instance since process start does not return an ID.'
14+
type: string
15+
required: false
16+
outputs:
17+
channel:
18+
description: 'The channel that the build should be published to.'
19+
value: ${{ jobs.Deploy-Metadata.outputs.channel }}
20+
environment:
21+
description: 'The GitHub Environment that the build should use.'
22+
value: ${{ jobs.Deploy-Metadata.outputs.environment }}
23+
shortSha:
24+
description: 'The first 7 characters of the SHA hash that represents the current commit that the build is operating off of.'
25+
value: ${{ jobs.Deploy-Metadata.outputs.shortSha }}
26+
version:
27+
description: 'The version of the project that is being built.'
28+
value: ${{ jobs.Deploy-Metadata.outputs.version }}
29+
30+
# Define each session of execution that should be executed
31+
jobs:
32+
# Calculates the tag and channel metadata based on the event that triggered the workflow, and making that data available to downstream jobs through outputs.
33+
Deploy-Metadata:
34+
# Human friendly display name for the job
35+
name: Calculate - Metadata
36+
37+
# Operating system that the job will run on
38+
runs-on: ubuntu-slim
39+
40+
# Sets the scopes available to the github_token injected to the GH Actions runner
41+
permissions:
42+
# Read the files in the repository to be able to compute the version from the package.json.
43+
contents: read
44+
45+
# Set of data that will be made available to downstream jobs.
46+
outputs:
47+
channel: ${{ steps.computedChannel.outputs.channel }}
48+
environment: ${{ steps.computedGitHubEnvironment.outputs.environment }}
49+
shortSha: ${{ steps.shortSha.outputs.shortSha }}
50+
version: ${{ steps.computedVersion.outputs.version }}
51+
52+
# Set of actions to perform for this execution sandbox
53+
steps:
54+
# Download the source code
55+
- name: Checkout Files from Repo
56+
uses: actions/checkout@v7
57+
58+
# Extract the project version from the package.json
59+
- name: Extract Project Version
60+
id: computedVersion
61+
background: true
62+
run: echo "version=$(npm pkg get version --workspaces=false | tr -d \")" >> "$GITHUB_OUTPUT"
63+
64+
# Set the experimental tag to indicate if it is an Alpha or Beta build
65+
- name: Compute Channel
66+
id: computedChannel
67+
background: true
68+
run: |
69+
if [ "${{ github.event_name }}" = "release" ] && [ "${{ github.event.release.prerelease }}" = "true" ]; then
70+
echo "channel=beta" >> "$GITHUB_OUTPUT"
71+
elif [ "${{ github.event_name }}" = "release" ]; then
72+
echo "channel=stable" >> "$GITHUB_OUTPUT"
73+
else
74+
echo "channel=alpha" >> "$GITHUB_OUTPUT"
75+
fi
76+
77+
# Compute the GitHub Environment to be used by the deployment
78+
- name: Compute GitHub Environment
79+
id: computedGitHubEnvironment
80+
background: true
81+
run: |
82+
if [ "${{ github.event_name }}" = "release" ]; then
83+
echo "environment=Azure-Privileged" >> "$GITHUB_OUTPUT"
84+
else
85+
echo "environment=Azure-Alpha" >> "$GITHUB_OUTPUT"
86+
fi
87+
88+
# Get the first 7 chars of the SHA hash that represents the current commit that the build is operating off of.
89+
- name: Compute Short SHA - Experimental Channel
90+
id: shortSha
91+
background: true
92+
run: echo "shortSha=$(echo ${{ github.sha }} | head -c 7)" >> "$GITHUB_OUTPUT"
93+
94+
# Bring job back to sync execution by awaiting for all async jobs to finish before continuing
95+
- name: Steps - Convert Back To Synchronous Execution
96+
wait-all: true

0 commit comments

Comments
 (0)