From 5e6dbe3fd036551dfdb5ab55514bc102e62f2370 Mon Sep 17 00:00:00 2001
From: Mark Stacey <markjstacey@gmail.com>
Date: Fri, 20 Dec 2024 00:18:58 -0330
Subject: [PATCH] chore: Migrate LavaMoat validation to GitHub Actions

Migrate LavaMoat policy validation from CircleCI to GitHub actions. No
functional changes.

Relates to #28572
---
 .circleci/config.yml                          | 58 -------------------
 .github/workflows/main.yml                    | 15 +++++
 .../validate-lavamoat-allow-scripts.yml       | 25 ++++++++
 .../validate-lavamoat-policy-build.yml        | 25 ++++++++
 .../validate-lavamoat-policy-webapp.yml       | 28 +++++++++
 5 files changed, 93 insertions(+), 58 deletions(-)
 create mode 100644 .github/workflows/validate-lavamoat-allow-scripts.yml
 create mode 100644 .github/workflows/validate-lavamoat-policy-build.yml
 create mode 100644 .github/workflows/validate-lavamoat-policy-webapp.yml

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5598e6450cfe..4d93a7dc7cf8 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -127,16 +127,6 @@ workflows:
                 - master
           requires:
             - prep-deps
-      - validate-lavamoat-allow-scripts:
-          requires:
-            - prep-deps
-      - validate-lavamoat-policy-build:
-          requires:
-            - prep-deps
-      - validate-lavamoat-policy-webapp:
-          matrix:
-            parameters:
-              build-type: [main, beta, flask, mmi]
           requires:
             - prep-deps
       - prep-build-mmi:
@@ -282,9 +272,6 @@ workflows:
             - prep-build-flask-mv2
       - all-tests-pass:
           requires:
-            - validate-lavamoat-allow-scripts
-            - validate-lavamoat-policy-build
-            - validate-lavamoat-policy-webapp
             - test-lint
             - test-lint-shellcheck
             - test-lint-lockfile
@@ -499,51 +486,6 @@ jobs:
           at: .
       - run: yarn tsx .circleci/scripts/validate-locales-only.ts
 
-  validate-lavamoat-allow-scripts:
-    executor: node-browsers-small
-    steps:
-      - run: *shallow-git-clone-and-enable-vnc
-      - run: sudo corepack enable
-      - attach_workspace:
-          at: .
-      - run:
-          name: Validate allow-scripts config
-          command: yarn allow-scripts auto
-      - run:
-          name: Check working tree
-          command: .circleci/scripts/check-working-tree.sh
-
-  validate-lavamoat-policy-build:
-    executor: node-browsers-medium
-    steps:
-      - run: *shallow-git-clone-and-enable-vnc
-      - run: sudo corepack enable
-      - attach_workspace:
-          at: .
-      - run:
-          name: Validate LavaMoat build policy
-          command: yarn lavamoat:build:auto
-      - run:
-          name: Check working tree
-          command: .circleci/scripts/check-working-tree.sh
-
-  validate-lavamoat-policy-webapp:
-    executor: node-browsers-medium-plus
-    parameters:
-      build-type:
-        type: string
-    steps:
-      - run: *shallow-git-clone-and-enable-vnc
-      - run: sudo corepack enable
-      - attach_workspace:
-          at: .
-      - run:
-          name: Validate LavaMoat << parameters.build-type >>  policy
-          command: yarn lavamoat:webapp:auto:ci '--build-types=<< parameters.build-type >>'
-      - run:
-          name: Check working tree
-          command: .circleci/scripts/check-working-tree.sh
-
   prep-build:
     executor: node-linux-medium
     steps:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d8850502e7da..bbf8b8af7d56 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -40,6 +40,18 @@ jobs:
     name: Test deps depcheck
     uses: ./.github/workflows/test-deps-depcheck.yml
 
+  validate-lavamoat-allow-scripts:
+    name: Validate lavamoat allow scripts
+    uses: ./.github/workflows/validate-lavamoat-allow-scripts.yml
+
+  validate-lavamoat-policy-build:
+    name: Validate lavamoat policy build
+    uses: ./.github/workflows/validate-lavamoat-policy-build.yml
+
+  validate-lavamoat-policy-webapp:
+    name: Validate lavamoat policy webapp
+    uses: ./.github/workflows/validate-lavamoat-policy-webapp.yml
+
   run-tests:
     name: Run tests
     uses: ./.github/workflows/run-tests.yml
@@ -55,6 +67,9 @@ jobs:
       - check-workflows
       - test-yarn-dedupe
       - test-deps-depcheck
+      - validate-lavamoat-allow-scripts
+      - validate-lavamoat-policy-build
+      - validate-lavamoat-policy-webapp
       - run-tests
       - wait-for-circleci-workflow-status
     outputs:
diff --git a/.github/workflows/validate-lavamoat-allow-scripts.yml b/.github/workflows/validate-lavamoat-allow-scripts.yml
new file mode 100644
index 000000000000..637a2d9aeb54
--- /dev/null
+++ b/.github/workflows/validate-lavamoat-allow-scripts.yml
@@ -0,0 +1,25 @@
+name: Validate lavamoat allow scripts
+
+on:
+  workflow_call:
+
+jobs:
+  validate-lavamoat-allow-scripts:
+    name: Validate lavamoat allow scripts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup environment
+        uses: metamask/github-tools/.github/actions/setup-environment@main
+
+      - name: Validate allow-scripts config
+        run: yarn allow-scripts auto
+
+      - name: Check working tree
+        run: |
+          if ! git diff --exit-code; then
+              echo "::error::Working tree dirty."
+              exit 1
+          fi
diff --git a/.github/workflows/validate-lavamoat-policy-build.yml b/.github/workflows/validate-lavamoat-policy-build.yml
new file mode 100644
index 000000000000..d6b7326c5c4e
--- /dev/null
+++ b/.github/workflows/validate-lavamoat-policy-build.yml
@@ -0,0 +1,25 @@
+name: Validate lavamoat policy build
+
+on:
+  workflow_call:
+
+jobs:
+  validate-lavamoat-policy-build:
+    name: Validate lavamoat policy build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup environment
+        uses: metamask/github-tools/.github/actions/setup-environment@main
+
+      - name: Validate lavamoat build policy
+        run: yarn lavamoat:build:auto
+
+      - name: Check working tree
+        run: |
+          if ! git diff --exit-code; then
+              echo "::error::Working tree dirty."
+              exit 1
+          fi
diff --git a/.github/workflows/validate-lavamoat-policy-webapp.yml b/.github/workflows/validate-lavamoat-policy-webapp.yml
new file mode 100644
index 000000000000..3c31bff0a068
--- /dev/null
+++ b/.github/workflows/validate-lavamoat-policy-webapp.yml
@@ -0,0 +1,28 @@
+name: Validate lavamoat policy webapp
+
+on:
+  workflow_call:
+
+jobs:
+  validate-lavamoat-policy-webapp:
+    name: Validate lavamoat policy webapp
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        build-type: [main, beta, flask, mmi]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup environment
+        uses: metamask/github-tools/.github/actions/setup-environment@main
+
+      - name: Validate lavamoat ${{ matrix.build-type }} policy
+        run: yarn lavamoat:webapp:auto:ci --build-types=${{ matrix.build-type }}
+
+      - name: Check working tree
+        run: |
+          if ! git diff --exit-code; then
+              echo "::error::Working tree dirty."
+              exit 1
+          fi