-
Notifications
You must be signed in to change notification settings - Fork 28
Test PR #322
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weβll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Test PR #322
Changes from all commits
387c7a0
1d0b3ac
8de7f42
e003524
50b2b77
3ad1dbc
bd1c5f2
efdafcd
0fdcaef
f757a5c
064881b
8ad2391
fae2a8f
133564f
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,3 @@ | ||
| packages/**/node_modules | ||
| packages/**/dist | ||
| packages/zcli-connectors/src/templates |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,56 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| name: Release to npm | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # β οΈ SAFETY MODE: This workflow is configured with --dry-run by default | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # β οΈ No packages will actually be published until you remove the --dry-run flag | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # β οΈ See line ~46 in the 'publish' job | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| push: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| branches: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - master | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| paths: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - 'lerna.json' | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - 'packages/*/package.json' | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| check-release: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| name: Check if release commit | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| outputs: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| should-publish: ${{ steps.check.outputs.should-publish }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| version: ${{ steps.check.outputs.version }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - uses: actions/checkout@v4 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| fetch-depth: 2 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - name: Check if this is a release commit | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| id: check | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| COMMIT_MSG=$(git log -1 --pretty=%B) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if echo "$COMMIT_MSG" | grep -q "chore(release): publish"; then | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "should-publish=true" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| VERSION=$(jq -r '.version' lerna.json) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "version=$VERSION" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "β Release commit detected: $VERSION" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| else | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "should-publish=false" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "βΉοΈ Not a release commit, skipping publish" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| publish: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| name: Publish packages to npm | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| needs: check-release | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if: needs.check-release.outputs.should-publish == 'true' | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # TODO: Update this path to your actual company reusable workflow location | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Example: zendesk/shared-workflows/.github/workflows/npm-publish.yml@main | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| uses: zendesk/REPLACE_WITH_ACTUAL_PATH/.github/workflows/npm-publish.yml@main | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| node_version: '20.17.0' | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # This command will be executed as: yarn workspaces foreach ... npm publish --otp $totp | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # β οΈ IMPORTANT: Remove --dry-run flag when ready for production publishing! | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| command: 'workspaces foreach --no-private --topological npm publish --dry-run --tolerate-republish' | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| commit: false | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| secrets: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| NPM_TOTP_DEVICE: ${{ secrets.NPM_TOTP_DEVICE }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+42
to
+56
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
Copilot AutofixAI 5 days ago In general, fix this by explicitly declaring a minimal The best targeted fix without changing functionality is:
Concretely, in
permissions:
contents: read
No imports or external methods are needed; this is pure YAML configuration.
Suggested changeset
1
.github/workflows/release.yml
Copilot is powered by AI and may make mistakes. Always verify output.
Refresh and try again.
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Large diffs are not rendered by default.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| nodeLinker: node-modules | ||
|
|
||
| enableGlobalCache: false | ||
|
|
||
| supportedArchitectures: | ||
| os: ["linux", "darwin", "win32"] | ||
| cpu: ["x64", "arm64"] | ||
|
|
||
| yarnPath: .yarn/releases/yarn-4.5.3.cjs |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,175 @@ | ||
| # Automated Release Setup Checklist | ||
|
|
||
| This checklist tracks the setup of the automated release process for ZCLI. | ||
|
|
||
| ## β Completed Steps | ||
|
|
||
| - [x] Migrate to Yarn Berry v4.5.3 | ||
| - [x] Add `build` script to root package.json | ||
| - [x] Create `scripts/create-release-pr.sh` | ||
| - [x] Create `.github/workflows/release.yml` | ||
| - [x] Update `scripts/release.sh` with deprecation notice | ||
| - [x] Create release process documentation | ||
|
|
||
| ## π§ TODO: Configuration Required | ||
|
|
||
| ### 1. Update Workflow Path (Required) | ||
|
|
||
| **File:** `.github/workflows/release.yml` | ||
|
|
||
| **Action:** Replace the placeholder with your actual company workflow path | ||
|
|
||
| ```yaml | ||
| # Current (line ~40): | ||
| uses: zendesk/REPLACE_WITH_ACTUAL_PATH/.github/workflows/npm-publish.yml@main | ||
|
|
||
| # Replace with actual path (ask platform team): | ||
| uses: zendesk/shared-workflows/.github/workflows/npm-publish.yml@main | ||
| ``` | ||
|
|
||
| **Who to ask:** Platform/DevOps team for the reusable workflow location | ||
|
|
||
| --- | ||
|
|
||
| ### 2. Configure GitHub Secrets (Required) | ||
|
|
||
| **Location:** Repository Settings β Secrets and variables β Actions | ||
|
|
||
| **Secrets to add:** | ||
|
|
||
| #### `NPM_TOKEN` | ||
| - **What:** npm authentication token | ||
| - **How to get:** | ||
| 1. Log into npm: https://www.npmjs.com/ | ||
| 2. Go to: Settings β Access Tokens | ||
| 3. Generate New Token β Automation | ||
| 4. Copy token (starts with `npm_`) | ||
| 5. Add to GitHub secrets | ||
|
|
||
| #### `NPM_TOTP_DEVICE` | ||
| - **What:** TOTP secret for npm 2FA (base32 encoded) | ||
| - **How to get:** | ||
| 1. Go to npm 2FA settings | ||
| 2. Disable 2FA (if enabled) | ||
| 3. Re-enable 2FA | ||
| 4. Click "Can't scan? Enter this code manually" | ||
| 5. Copy the base32 secret (e.g., `JBSWY3DPEHPK3PXP`) | ||
| 6. Add to GitHub secrets | ||
| 7. Update your authenticator app with the new secret | ||
|
|
||
| **Status:** β¬ Not configured yet | ||
|
|
||
| --- | ||
|
|
||
| ### 3. Test with Dry Run (Recommended) | ||
|
|
||
| The workflow is configured with `--dry-run` flag by default for safety. | ||
|
|
||
| **Status:** β Already configured (dry-run is the default) | ||
|
|
||
| #### Step 3a: Create test release | ||
|
|
||
| ```bash | ||
| # Create test commit with conventional commit message | ||
| git checkout -b test-release-workflow | ||
| echo "# Test" >> README.md | ||
| git add README.md | ||
| git commit -m "feat: test automated release workflow" | ||
| git push origin test-release-workflow | ||
|
|
||
| # Merge to master (or create PR and merge) | ||
| # Then run: | ||
| ./scripts/create-release-pr.sh | ||
| ``` | ||
|
|
||
| #### Step 3b: Merge and verify | ||
|
|
||
| 1. Merge the release PR | ||
| 2. Go to Actions tab: https://github.com/zendesk/zcli/actions | ||
| 3. Watch "Release to npm" workflow run | ||
| 4. Verify it completes without errors | ||
| 5. Confirm nothing was published to npm (dry-run mode) | ||
|
|
||
| **Status:** β¬ Not tested yet | ||
|
|
||
| --- | ||
|
|
||
| ### 4. Enable Production Publishing (Required) | ||
|
|
||
| After successful dry-run test, enable real publishing: | ||
|
|
||
| **File:** `.github/workflows/release.yml` | ||
|
|
||
| **Remove the `--dry-run` flag:** | ||
| ```yaml | ||
| # Change from: | ||
| command: 'workspaces foreach --no-private --topological npm publish --dry-run --tolerate-republish' | ||
|
|
||
| # To: | ||
| command: 'workspaces foreach --no-private --topological npm publish --tolerate-republish' | ||
| # ^^^^^^^^^^^ Remove this | ||
| ``` | ||
|
|
||
| **Status:** β¬ Still in dry-run mode | ||
|
|
||
| --- | ||
|
|
||
| ### 5. Update Team Documentation (Optional) | ||
|
|
||
| - [ ] Update internal wiki/confluence with new process | ||
| - [ ] Notify team about the new release workflow | ||
| - [ ] Add link to [docs/RELEASING.md](./docs/RELEASING.md) in onboarding docs | ||
|
|
||
| --- | ||
|
|
||
| ## π Documentation | ||
|
|
||
| | Document | Purpose | | ||
| |----------|---------| | ||
| | [docs/SETUP_RELEASE_WORKFLOW.md](./docs/SETUP_RELEASE_WORKFLOW.md) | Detailed setup instructions | | ||
| | [docs/RELEASING.md](./docs/RELEASING.md) | How to create releases | | ||
| | [scripts/create-release-pr.sh](./scripts/create-release-pr.sh) | Release PR creation script | | ||
| | [.github/workflows/release.yml](./.github/workflows/release.yml) | GitHub Actions workflow | | ||
|
|
||
| --- | ||
|
|
||
| ## π Quick Start (After Setup) | ||
|
|
||
| Once everything above is configured: | ||
|
|
||
| ```bash | ||
| # 1. Run the release script | ||
| ./scripts/create-release-pr.sh | ||
|
|
||
| # 2. Open the PR URL provided | ||
|
|
||
| # 3. Review and merge | ||
|
|
||
| # 4. Automated publishing happens! | ||
| ``` | ||
|
|
||
| --- | ||
|
|
||
| ## β Getting Help | ||
|
|
||
| **Questions about:** | ||
| - Reusable workflow path β Ask platform/DevOps team | ||
| - npm credentials β Ask maintainer with npm access | ||
| - Process/bugs β Open issue in this repo | ||
|
|
||
| **Common issues:** See [Troubleshooting section](./docs/SETUP_RELEASE_WORKFLOW.md#troubleshooting) in setup docs | ||
|
|
||
| --- | ||
|
|
||
| ## β Ready to Go Live? | ||
|
|
||
| Check that all items above are completed: | ||
|
|
||
| - [ ] Workflow path updated | ||
| - [ ] GitHub secrets configured | ||
| - [ ] Dry-run test passed | ||
| - [ ] Team notified | ||
|
|
||
| Once all checked, you're ready to create your first automated release! π | ||
|
|
||
| β οΈ **Remember:** The workflow is in dry-run mode by default. After testing, don't forget to remove the `--dry-run` flag to enable real publishing! |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 3 days ago
In general, the fix is to explicitly specify
permissionsfor the workflow or for each job so that theGITHUB_TOKENhas only the scopes required. For this workflow, thecheck-releasejob just needs to read repository contents (foractions/checkoutandlerna.json), socontents: readis sufficient. Thepublishjob is a reusable workflow call; its required permissions should be defined inside that reusable workflow, so this caller does not need to grant additional permissions to it.The best minimal fix without changing behavior is to add a top-level
permissions:block right under thename:(or beforeon:) that setscontents: read. This will apply to all jobs in this workflow that do not define their ownpermissions:block, covering bothcheck-releaseandpublishwithout altering their existing logic. No imports or additional methods are needed; this is purely a YAML configuration change within.github/workflows/release.yml, around lines 1β7.