Skip to content

Commit 4dd3f3d

Browse files
MrtenzFrederikBolding
Mrtenz
and
FrederikBolding
authored
Update workflows to use MetaMask/action-checkout-and-setup (#170)
This updates all workflows to use `MetaMask/action-checkout-and-setup`. --------- Co-authored-by: Frederik Bolding <[email protected]>
1 parent 30e76f2 commit 4dd3f3d

File tree

6 files changed

+76
-140
lines changed

6 files changed

+76
-140
lines changed

‎.github/workflows/build-lint-test.yml‎

Lines changed: 16 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,12 @@ jobs:
1111
matrix:
1212
node-version: [18.x, 20.x, 22.x]
1313
steps:
14-
- uses: actions/checkout@v4
15-
- name: Install Corepack via Node
16-
uses: actions/setup-node@v4
17-
with:
18-
node-version-file: '.nvmrc'
19-
- name: Install Yarn
20-
run: corepack enable
21-
- name: Install Node.js ${{ matrix.node-version }} and restore Yarn cache
22-
uses: actions/setup-node@v4
14+
- name: Checkout and setup environment
15+
uses: MetaMask/action-checkout-and-setup@v1
2316
with:
17+
is-high-risk-environment: false
2418
node-version: ${{ matrix.node-version }}
25-
cache: 'yarn'
26-
- name: Install dependencies via Yarn
27-
run: yarn --immutable
19+
cache-node-modules: ${{ matrix.node-version == '22.x' }}
2820

2921
build:
3022
name: Build
@@ -34,20 +26,11 @@ jobs:
3426
matrix:
3527
node-version: [22.x]
3628
steps:
37-
- uses: actions/checkout@v4
38-
- name: Install Corepack via Node
39-
uses: actions/setup-node@v4
40-
with:
41-
node-version-file: '.nvmrc'
42-
- name: Install Yarn
43-
run: corepack enable
44-
- name: Install Node.js ${{ matrix.node-version }} and restore Yarn cache
45-
uses: actions/setup-node@v4
29+
- name: Checkout and setup environment
30+
uses: MetaMask/action-checkout-and-setup@v1
4631
with:
32+
is-high-risk-environment: false
4733
node-version: ${{ matrix.node-version }}
48-
cache: 'yarn'
49-
- name: Install dependencies via Yarn
50-
run: yarn --immutable --immutable-cache
5134
- run: yarn build
5235
- name: Require clean working directory
5336
shell: bash
@@ -65,20 +48,11 @@ jobs:
6548
matrix:
6649
node-version: [22.x]
6750
steps:
68-
- uses: actions/checkout@v4
69-
- name: Install Corepack via Node
70-
uses: actions/setup-node@v4
71-
with:
72-
node-version-file: '.nvmrc'
73-
- name: Install Yarn
74-
run: corepack enable
75-
- name: Install Node.js ${{ matrix.node-version }} and restore Yarn cache
76-
uses: actions/setup-node@v4
51+
- name: Checkout and setup environment
52+
uses: MetaMask/action-checkout-and-setup@v1
7753
with:
54+
is-high-risk-environment: false
7855
node-version: ${{ matrix.node-version }}
79-
cache: 'yarn'
80-
- name: Install dependencies via Yarn
81-
run: yarn --immutable --immutable-cache
8256
- run: yarn lint
8357
- name: Validate RC changelog
8458
if: ${{ startsWith(github.head_ref, 'release/') }}
@@ -102,20 +76,11 @@ jobs:
10276
matrix:
10377
node-version: [18.x, 20.x, 22.x]
10478
steps:
105-
- uses: actions/checkout@v4
106-
- name: Install Corepack via Node
107-
uses: actions/setup-node@v4
108-
with:
109-
node-version-file: '.nvmrc'
110-
- name: Install Yarn
111-
run: corepack enable
112-
- name: Install Node.js ${{ matrix.node-version }} and restore Yarn cache
113-
uses: actions/setup-node@v4
79+
- name: Checkout and setup environment
80+
uses: MetaMask/action-checkout-and-setup@v1
11481
with:
82+
is-high-risk-environment: false
11583
node-version: ${{ matrix.node-version }}
116-
cache: 'yarn'
117-
- name: Install dependencies via Yarn
118-
run: yarn --immutable --immutable-cache
11984
- run: yarn test
12085
- name: Require clean working directory
12186
shell: bash
@@ -133,18 +98,11 @@ jobs:
13398
matrix:
13499
node-version: [18.x, 20.x, 22.x]
135100
steps:
136-
- uses: actions/checkout@v4
137-
- name: Install Corepack via Node
138-
uses: actions/setup-node@v4
139-
with:
140-
node-version-file: '.nvmrc'
141-
- name: Install Yarn
142-
run: corepack enable
143-
- name: Install Node.js ${{ matrix.node-version }} and restore Yarn cache
144-
uses: actions/setup-node@v4
101+
- name: Checkout and setup environment
102+
uses: MetaMask/action-checkout-and-setup@v1
145103
with:
104+
is-high-risk-environment: false
146105
node-version: ${{ matrix.node-version }}
147-
cache: 'yarn'
148106
- name: Install dependencies via Yarn
149107
run: rm yarn.lock && YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn
150108
- run: yarn test

‎.github/workflows/create-release-pr.yml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,19 +21,20 @@ jobs:
2121
contents: write
2222
pull-requests: write
2323
steps:
24-
- uses: actions/checkout@v4
24+
- name: Checkout and setup environment
25+
uses: MetaMask/action-checkout-and-setup@v1
2526
with:
26-
# This is to guarantee that the most recent tag is fetched.
27-
# This can be configured to a more reasonable value by consumers.
27+
is-high-risk-environment: true
28+
29+
# This is to guarantee that the most recent tag is fetched. This can
30+
# be configured to a more reasonable value by consumers.
2831
fetch-depth: 0
32+
2933
# We check out the specified branch, which will be used as the base
3034
# branch for all git operations and the release PR.
3135
ref: ${{ github.event.inputs.base-branch }}
32-
- name: Install Node.js
33-
uses: actions/setup-node@v4
34-
with:
35-
node-version-file: '.nvmrc'
36-
- uses: MetaMask/action-create-release-pr@v3
36+
37+
- uses: MetaMask/action-create-release-pr@v4
3738
with:
3839
release-type: ${{ github.event.inputs.release-type }}
3940
release-version: ${{ github.event.inputs.release-version }}

‎.github/workflows/main.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,10 @@ jobs:
1010
name: Check workflows
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v4
13+
- name: Checkout and setup environment
14+
uses: MetaMask/action-checkout-and-setup@v1
15+
with:
16+
is-high-risk-environment: false
1417
- name: Download actionlint
1518
id: download-actionlint
1619
run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/7fdc9630cc360ea1a469eed64ac6d78caeda1234/scripts/download-actionlint.bash) 1.6.23
@@ -19,6 +22,18 @@ jobs:
1922
run: ${{ steps.download-actionlint.outputs.executable }} -color
2023
shell: bash
2124

25+
analyse-code:
26+
name: Code scanner
27+
needs: check-workflows
28+
uses: ./.github/workflows/security-code-scanner.yml
29+
permissions:
30+
actions: read
31+
contents: read
32+
security-events: write
33+
secrets:
34+
SECURITY_SCAN_METRICS_TOKEN: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
35+
APPSEC_BOT_SLACK_WEBHOOK: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}
36+
2237
build-lint-test:
2338
name: Build, lint, and test
2439
uses: ./.github/workflows/build-lint-test.yml
@@ -28,6 +43,7 @@ jobs:
2843
runs-on: ubuntu-latest
2944
needs:
3045
- check-workflows
46+
- analyse-code
3147
- build-lint-test
3248
outputs:
3349
PASSED: ${{ steps.set-output.outputs.PASSED }}

‎.github/workflows/publish-docs.yml‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -21,20 +21,10 @@ jobs:
2121
- name: Ensure `destination_dir` is not empty
2222
if: ${{ inputs.destination_dir == '' }}
2323
run: exit 1
24-
- uses: actions/checkout@v4
25-
- name: Install Corepack via Node
26-
uses: actions/setup-node@v4
24+
- name: Checkout and setup environment
25+
uses: MetaMask/action-checkout-and-setup@v1
2726
with:
28-
node-version-file: '.nvmrc'
29-
- name: Install Yarn
30-
run: corepack enable
31-
- name: Restore Yarn cache
32-
uses: actions/setup-node@v4
33-
with:
34-
node-version-file: '.nvmrc'
35-
cache: 'yarn'
36-
- name: Install dependencies via Yarn
37-
run: yarn --immutable
27+
is-high-risk-environment: true
3828
- name: Run build script
3929
run: yarn build:docs
4030
- name: Deploy to `${{ inputs.destination_dir }}` directory of `gh-pages` branch

‎.github/workflows/publish-release.yml‎

Lines changed: 23 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -9,66 +9,47 @@ on:
99
required: true
1010
PUBLISH_DOCS_TOKEN:
1111
required: true
12-
1312
jobs:
1413
publish-release:
1514
permissions:
1615
contents: write
1716
runs-on: ubuntu-latest
1817
steps:
19-
- uses: actions/checkout@v4
18+
- name: Checkout and setup environment
19+
uses: MetaMask/action-checkout-and-setup@v1
2020
with:
21+
is-high-risk-environment: true
2122
ref: ${{ github.sha }}
22-
- name: Install Corepack via Node
23-
uses: actions/setup-node@v4
24-
with:
25-
node-version-file: '.nvmrc'
26-
- name: Install Yarn
27-
run: corepack enable
28-
- name: Restore Yarn cache
29-
uses: actions/setup-node@v4
30-
with:
31-
node-version-file: '.nvmrc'
32-
cache: 'yarn'
3323
- uses: MetaMask/action-publish-release@v3
3424
env:
3525
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36-
- uses: actions/cache@v3
26+
- run: yarn build
27+
- name: Upload build artifacts
28+
uses: actions/upload-artifact@v4
3729
with:
30+
name: publish-release-artifacts-${{ github.sha }}
31+
retention-days: 4
32+
include-hidden-files: true
3833
path: |
3934
./dist
4035
./node_modules/.yarn-state.yml
41-
key: ${{ github.sha }}
42-
- run: yarn --immutable
43-
- run: yarn build
4436
4537
publish-npm-dry-run:
4638
needs: publish-release
4739
runs-on: ubuntu-latest
4840
steps:
49-
- uses: actions/checkout@v4
41+
- name: Checkout and setup environment
42+
uses: MetaMask/action-checkout-and-setup@v1
5043
with:
44+
is-high-risk-environment: true
5145
ref: ${{ github.sha }}
52-
- name: Install Corepack via Node
53-
uses: actions/setup-node@v4
54-
with:
55-
node-version-file: '.nvmrc'
56-
- name: Install Yarn
57-
run: corepack enable
58-
- name: Restore Yarn cache
59-
uses: actions/setup-node@v4
60-
with:
61-
node-version-file: '.nvmrc'
62-
cache: 'yarn'
63-
- uses: actions/cache@v3
46+
- name: Restore build artifacts
47+
uses: actions/download-artifact@v4
6448
with:
65-
path: |
66-
./dist
67-
./node_modules/.yarn-state.yml
68-
key: ${{ github.sha }}
49+
name: publish-release-artifacts-${{ github.sha }}
6950
- name: Dry Run Publish
7051
# omit npm-token token to perform dry run publish
71-
uses: MetaMask/action-npm-publish@v4
52+
uses: MetaMask/action-npm-publish@v5
7253
with:
7354
slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
7455
subteam: S042S7RE4AE # @metamask-npm-publishers
@@ -80,28 +61,17 @@ jobs:
8061
runs-on: ubuntu-latest
8162
environment: npm-publish
8263
steps:
83-
- uses: actions/checkout@v4
64+
- name: Checkout and setup environment
65+
uses: MetaMask/action-checkout-and-setup@v1
8466
with:
67+
is-high-risk-environment: true
8568
ref: ${{ github.sha }}
86-
- name: Install Corepack via Node
87-
uses: actions/setup-node@v4
88-
with:
89-
node-version-file: '.nvmrc'
90-
- name: Install Yarn
91-
run: corepack enable
92-
- name: Restore Yarn cache
93-
uses: actions/setup-node@v4
69+
- name: Restore build artifacts
70+
uses: actions/download-artifact@v4
9471
with:
95-
node-version-file: '.nvmrc'
96-
cache: 'yarn'
97-
- uses: actions/cache@v3
98-
with:
99-
path: |
100-
./dist
101-
./node_modules/.yarn-state.yml
102-
key: ${{ github.sha }}
72+
name: publish-release-artifacts-${{ github.sha }}
10373
- name: Publish
104-
uses: MetaMask/action-npm-publish@v2
74+
uses: MetaMask/action-npm-publish@v5
10575
with:
10676
# This `NPM_TOKEN` needs to be manually set per-repository.
10777
# Look in the repository settings under "Environments", and set this token in the `npm-publish` environment.

‎.github/workflows/security-code-scanner.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,24 @@
11
name: MetaMask Security Code Scanner
22

33
on:
4-
push:
5-
branches:
6-
- main
7-
pull_request:
8-
branches:
9-
- main
4+
workflow_call:
5+
secrets:
6+
SECURITY_SCAN_METRICS_TOKEN:
7+
required: false
8+
APPSEC_BOT_SLACK_WEBHOOK:
9+
required: false
1010
workflow_dispatch:
1111

1212
jobs:
1313
run-security-scan:
14+
name: Run security scan
1415
runs-on: ubuntu-latest
1516
permissions:
1617
actions: read
1718
contents: read
1819
security-events: write
1920
steps:
20-
- name: MetaMask Security Code Scanner
21+
- name: Analyse code
2122
uses: MetaMask/action-security-code-scanner@v1
2223
with:
2324
repo: ${{ github.repository }}

0 commit comments

Comments
 (0)