Skip to content
This repository was archived by the owner on Oct 16, 2025. It is now read-only.

Commit 0e8f1b8

Browse files
GudahttGudahtt
authored
chore: Update publishing workflows to match module template (#337)
The publishing workflow and the `main` workflow have been updated to match the `metamask-module-template`. The build+lint+test workflow has been mostly untouched, as have other aspects of the template. This is intended just to unblock automated releases.
1 parent 88b37c0 commit 0e8f1b8

5 files changed

Lines changed: 193 additions & 29 deletions

File tree

.github/workflows/build-test.yml renamed to .github/workflows/build-lint-test.yml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
name: Build, Lint, and Test
22

33
on:
4-
push:
5-
branches: [main]
6-
pull_request:
4+
workflow_call:
75

86
jobs:
97
build-lint-test:

‎.github/workflows/main.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Main
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
8+
jobs:
9+
check-workflows:
10+
name: Check workflows
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout and setup environment
14+
uses: MetaMask/action-checkout-and-setup@v1
15+
with:
16+
is-high-risk-environment: false
17+
- name: Download actionlint
18+
id: download-actionlint
19+
run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/7fdc9630cc360ea1a469eed64ac6d78caeda1234/scripts/download-actionlint.bash) 1.6.23
20+
shell: bash
21+
- name: Check workflow files
22+
run: ${{ steps.download-actionlint.outputs.executable }} -color
23+
shell: bash
24+
25+
analyse-code:
26+
name: Code scanner
27+
needs: check-workflows
28+
uses: ./.github/workflows/security-code-scanner.yml
29+
permissions:
30+
actions: read
31+
contents: read
32+
security-events: write
33+
secrets:
34+
SECURITY_SCAN_METRICS_TOKEN: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
35+
APPSEC_BOT_SLACK_WEBHOOK: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}
36+
37+
build-lint-test:
38+
name: Build, lint, and test
39+
uses: ./.github/workflows/build-lint-test.yml
40+
41+
all-jobs-completed:
42+
name: All jobs completed
43+
runs-on: ubuntu-latest
44+
needs:
45+
- check-workflows
46+
- analyse-code
47+
- build-lint-test
48+
outputs:
49+
PASSED: ${{ steps.set-output.outputs.PASSED }}
50+
steps:
51+
- name: Set PASSED output
52+
id: set-output
53+
run: echo "PASSED=true" >> "$GITHUB_OUTPUT"
54+
55+
all-jobs-pass:
56+
name: All jobs pass
57+
if: ${{ always() }}
58+
runs-on: ubuntu-latest
59+
needs: all-jobs-completed
60+
steps:
61+
- name: Check that all jobs have passed
62+
run: |
63+
passed="${{ needs.all-jobs-completed.outputs.PASSED }}"
64+
if [[ $passed != "true" ]]; then
65+
exit 1
66+
fi
67+
68+
is-release:
69+
# Filtering by `push` events ensures that we only release from the `main` branch, which is a
70+
# requirement for our npm publishing environment.
71+
# The commit author should always be 'github-actions' for releases created by the
72+
# 'create-release-pr' workflow, so we filter by that as well to prevent accidentally
73+
# triggering a release.
74+
if: github.event_name == 'push' && startsWith(github.event.head_commit.author.name, 'github-actions')
75+
needs: all-jobs-pass
76+
outputs:
77+
IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
78+
runs-on: ubuntu-latest
79+
steps:
80+
- uses: MetaMask/action-is-release@v1
81+
id: is-release
82+
83+
publish-release:
84+
needs: is-release
85+
if: needs.is-release.outputs.IS_RELEASE == 'true'
86+
name: Publish release
87+
permissions:
88+
contents: write
89+
uses: ./.github/workflows/publish-release.yml
90+
secrets:
91+
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
92+
PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }}
93+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

‎.github/workflows/publish-release.yml‎

Lines changed: 67 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,80 @@
11
name: Publish Release
22

33
on:
4-
pull_request:
5-
types: [closed]
6-
4+
workflow_call:
5+
secrets:
6+
NPM_TOKEN:
7+
required: true
8+
SLACK_WEBHOOK_URL:
9+
required: true
10+
PUBLISH_DOCS_TOKEN:
11+
required: true
712
jobs:
813
publish-release:
914
permissions:
1015
contents: write
11-
if: |
12-
github.event.pull_request.merged == true &&
13-
startsWith(github.event.pull_request.head.ref, 'release/')
1416
runs-on: ubuntu-latest
1517
steps:
16-
- uses: actions/checkout@v4
18+
- name: Checkout and setup environment
19+
uses: MetaMask/action-checkout-and-setup@v1
1720
with:
21+
is-high-risk-environment: true
1822
ref: ${{ github.sha }}
19-
- name: Install Corepack via Node
20-
uses: actions/setup-node@v4
21-
with:
22-
node-version-file: '.nvmrc'
23-
- name: Install Yarn
24-
run: corepack enable
25-
- name: Restore Yarn cache
26-
uses: actions/setup-node@v4
27-
with:
28-
node-version-file: '.nvmrc'
29-
cache: 'yarn'
30-
- uses: MetaMask/action-publish-release@v1
23+
- uses: MetaMask/action-publish-release@v3
3124
env:
3225
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26+
- run: yarn build
27+
- name: Upload build artifacts
28+
uses: actions/upload-artifact@v4
29+
with:
30+
name: publish-release-artifacts-${{ github.sha }}
31+
retention-days: 4
32+
include-hidden-files: true
33+
path: |
34+
./dist
35+
./node_modules/.yarn-state.yml
36+
37+
publish-npm-dry-run:
38+
needs: publish-release
39+
runs-on: ubuntu-latest
40+
steps:
41+
- name: Checkout and setup environment
42+
uses: MetaMask/action-checkout-and-setup@v1
43+
with:
44+
is-high-risk-environment: true
45+
ref: ${{ github.sha }}
46+
- name: Restore build artifacts
47+
uses: actions/download-artifact@v4
48+
with:
49+
name: publish-release-artifacts-${{ github.sha }}
50+
- name: Dry Run Publish
51+
# omit npm-token token to perform dry run publish
52+
uses: MetaMask/action-npm-publish@v5
53+
with:
54+
slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
55+
subteam: S042S7RE4AE # @metamask-npm-publishers
56+
env:
57+
SKIP_PREPACK: true
58+
59+
publish-npm:
60+
needs: publish-npm-dry-run
61+
runs-on: ubuntu-latest
62+
environment: npm-publish
63+
steps:
64+
- name: Checkout and setup environment
65+
uses: MetaMask/action-checkout-and-setup@v1
66+
with:
67+
is-high-risk-environment: true
68+
ref: ${{ github.sha }}
69+
- name: Restore build artifacts
70+
uses: actions/download-artifact@v4
71+
with:
72+
name: publish-release-artifacts-${{ github.sha }}
73+
- name: Publish
74+
uses: MetaMask/action-npm-publish@v5
75+
with:
76+
# This `NPM_TOKEN` needs to be manually set per-repository.
77+
# Look in the repository settings under "Environments", and set this token in the `npm-publish` environment.
78+
npm-token: ${{ secrets.NPM_TOKEN }}
79+
env:
80+
SKIP_PREPACK: true

‎.github/workflows/security-code-scanner.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,24 @@
11
name: MetaMask Security Code Scanner
22

33
on:
4-
push:
5-
branches:
6-
- main
7-
pull_request:
8-
branches:
9-
- main
4+
workflow_call:
5+
secrets:
6+
SECURITY_SCAN_METRICS_TOKEN:
7+
required: false
8+
APPSEC_BOT_SLACK_WEBHOOK:
9+
required: false
1010
workflow_dispatch:
1111

1212
jobs:
1313
run-security-scan:
14+
name: Run security scan
1415
runs-on: ubuntu-latest
1516
permissions:
1617
actions: read
1718
contents: read
1819
security-events: write
1920
steps:
20-
- name: MetaMask Security Code Scanner
21+
- name: Analyse code
2122
uses: MetaMask/action-security-code-scanner@v1
2223
with:
2324
repo: ${{ github.repository }}

‎scripts/get.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
set -u
5+
set -o pipefail
6+
7+
if [[ ${RUNNER_DEBUG:-0} == 1 ]]; then
8+
set -x
9+
fi
10+
11+
KEY="${1}"
12+
OUTPUT="${2}"
13+
14+
if [[ -z $KEY ]]; then
15+
echo "Error: KEY not specified."
16+
exit 1
17+
fi
18+
19+
if [[ -z $OUTPUT ]]; then
20+
echo "Error: OUTPUT not specified."
21+
exit 1
22+
fi
23+
24+
echo "$OUTPUT=$(jq --raw-output "$KEY" package.json)" >> "$GITHUB_OUTPUT"

0 commit comments

Comments
 (0)