From 653d121ed42cb2c30d698e15e31566431fdf7088 Mon Sep 17 00:00:00 2001 From: Mark Stacey Date: Fri, 20 Dec 2024 00:18:58 -0330 Subject: [PATCH 1/3] chore: Migrate LavaMoat validation to GitHub Actions Migrate LavaMoat policy validation from CircleCI to GitHub actions. No functional changes. Relates to #28572 --- .circleci/config.yml | 58 ------------------- .github/workflows/main.yml | 15 +++++ .../validate-lavamoat-allow-scripts.yml | 25 ++++++++ .../validate-lavamoat-policy-build.yml | 25 ++++++++ .../validate-lavamoat-policy-webapp.yml | 28 +++++++++ 5 files changed, 93 insertions(+), 58 deletions(-) create mode 100644 .github/workflows/validate-lavamoat-allow-scripts.yml create mode 100644 .github/workflows/validate-lavamoat-policy-build.yml create mode 100644 .github/workflows/validate-lavamoat-policy-webapp.yml diff --git a/.circleci/config.yml b/.circleci/config.yml index 60bb80eaf449..5363d667bf86 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -123,16 +123,6 @@ workflows: - master requires: - prep-deps - - validate-lavamoat-allow-scripts: - requires: - - prep-deps - - validate-lavamoat-policy-build: - requires: - - prep-deps - - validate-lavamoat-policy-webapp: - matrix: - parameters: - build-type: [main, beta, flask, mmi] requires: - prep-deps - prep-build-mmi: @@ -268,9 +258,6 @@ workflows: - prep-build-flask-mv2 - all-tests-pass: requires: - - validate-lavamoat-allow-scripts - - validate-lavamoat-policy-build - - validate-lavamoat-policy-webapp - validate-source-maps - validate-source-maps-beta - validate-source-maps-flask @@ -481,51 +468,6 @@ jobs: at: . - run: yarn tsx .circleci/scripts/validate-locales-only.ts - validate-lavamoat-allow-scripts: - executor: node-browsers-small - steps: - - run: *shallow-git-clone-and-enable-vnc - - run: sudo corepack enable - - attach_workspace: - at: . - - run: - name: Validate allow-scripts config - command: yarn allow-scripts auto - - run: - name: Check working tree - command: .circleci/scripts/check-working-tree.sh - - validate-lavamoat-policy-build: - executor: node-browsers-medium - steps: - - run: *shallow-git-clone-and-enable-vnc - - run: sudo corepack enable - - attach_workspace: - at: . - - run: - name: Validate LavaMoat build policy - command: yarn lavamoat:build:auto - - run: - name: Check working tree - command: .circleci/scripts/check-working-tree.sh - - validate-lavamoat-policy-webapp: - executor: node-browsers-medium-plus - parameters: - build-type: - type: string - steps: - - run: *shallow-git-clone-and-enable-vnc - - run: sudo corepack enable - - attach_workspace: - at: . - - run: - name: Validate LavaMoat << parameters.build-type >> policy - command: yarn lavamoat:webapp:auto:ci '--build-types=<< parameters.build-type >>' - - run: - name: Check working tree - command: .circleci/scripts/check-working-tree.sh - prep-build: executor: node-linux-medium steps: diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index ee29c54e94ac..6e5a5121f336 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -56,6 +56,18 @@ jobs: name: Test deps depcheck uses: ./.github/workflows/test-deps-depcheck.yml + validate-lavamoat-allow-scripts: + name: Validate lavamoat allow scripts + uses: ./.github/workflows/validate-lavamoat-allow-scripts.yml + + validate-lavamoat-policy-build: + name: Validate lavamoat policy build + uses: ./.github/workflows/validate-lavamoat-policy-build.yml + + validate-lavamoat-policy-webapp: + name: Validate lavamoat policy webapp + uses: ./.github/workflows/validate-lavamoat-policy-webapp.yml + run-tests: name: Run tests uses: ./.github/workflows/run-tests.yml @@ -75,6 +87,9 @@ jobs: - test-lint-lockfile - test-yarn-dedupe - test-deps-depcheck + - validate-lavamoat-allow-scripts + - validate-lavamoat-policy-build + - validate-lavamoat-policy-webapp - run-tests - wait-for-circleci-workflow-status outputs: diff --git a/.github/workflows/validate-lavamoat-allow-scripts.yml b/.github/workflows/validate-lavamoat-allow-scripts.yml new file mode 100644 index 000000000000..637a2d9aeb54 --- /dev/null +++ b/.github/workflows/validate-lavamoat-allow-scripts.yml @@ -0,0 +1,25 @@ +name: Validate lavamoat allow scripts + +on: + workflow_call: + +jobs: + validate-lavamoat-allow-scripts: + name: Validate lavamoat allow scripts + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup environment + uses: metamask/github-tools/.github/actions/setup-environment@main + + - name: Validate allow-scripts config + run: yarn allow-scripts auto + + - name: Check working tree + run: | + if ! git diff --exit-code; then + echo "::error::Working tree dirty." + exit 1 + fi diff --git a/.github/workflows/validate-lavamoat-policy-build.yml b/.github/workflows/validate-lavamoat-policy-build.yml new file mode 100644 index 000000000000..d6b7326c5c4e --- /dev/null +++ b/.github/workflows/validate-lavamoat-policy-build.yml @@ -0,0 +1,25 @@ +name: Validate lavamoat policy build + +on: + workflow_call: + +jobs: + validate-lavamoat-policy-build: + name: Validate lavamoat policy build + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup environment + uses: metamask/github-tools/.github/actions/setup-environment@main + + - name: Validate lavamoat build policy + run: yarn lavamoat:build:auto + + - name: Check working tree + run: | + if ! git diff --exit-code; then + echo "::error::Working tree dirty." + exit 1 + fi diff --git a/.github/workflows/validate-lavamoat-policy-webapp.yml b/.github/workflows/validate-lavamoat-policy-webapp.yml new file mode 100644 index 000000000000..3c31bff0a068 --- /dev/null +++ b/.github/workflows/validate-lavamoat-policy-webapp.yml @@ -0,0 +1,28 @@ +name: Validate lavamoat policy webapp + +on: + workflow_call: + +jobs: + validate-lavamoat-policy-webapp: + name: Validate lavamoat policy webapp + runs-on: ubuntu-latest + strategy: + matrix: + build-type: [main, beta, flask, mmi] + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup environment + uses: metamask/github-tools/.github/actions/setup-environment@main + + - name: Validate lavamoat ${{ matrix.build-type }} policy + run: yarn lavamoat:webapp:auto:ci --build-types=${{ matrix.build-type }} + + - name: Check working tree + run: | + if ! git diff --exit-code; then + echo "::error::Working tree dirty." + exit 1 + fi From 46954db089e71576380e162a75ca0d793be05d57 Mon Sep 17 00:00:00 2001 From: Mark Stacey Date: Fri, 20 Dec 2024 00:39:30 -0330 Subject: [PATCH 2/3] Add mock Infura project ID --- .github/workflows/validate-lavamoat-policy-build.yml | 2 ++ .github/workflows/validate-lavamoat-policy-webapp.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/validate-lavamoat-policy-build.yml b/.github/workflows/validate-lavamoat-policy-build.yml index d6b7326c5c4e..4524cc26a546 100644 --- a/.github/workflows/validate-lavamoat-policy-build.yml +++ b/.github/workflows/validate-lavamoat-policy-build.yml @@ -16,6 +16,8 @@ jobs: - name: Validate lavamoat build policy run: yarn lavamoat:build:auto + env: + INFURA_PROJECT_ID: 00000000000 - name: Check working tree run: | diff --git a/.github/workflows/validate-lavamoat-policy-webapp.yml b/.github/workflows/validate-lavamoat-policy-webapp.yml index 3c31bff0a068..37ff9ede00fc 100644 --- a/.github/workflows/validate-lavamoat-policy-webapp.yml +++ b/.github/workflows/validate-lavamoat-policy-webapp.yml @@ -19,6 +19,8 @@ jobs: - name: Validate lavamoat ${{ matrix.build-type }} policy run: yarn lavamoat:webapp:auto:ci --build-types=${{ matrix.build-type }} + env: + INFURA_PROJECT_ID: 00000000000 - name: Check working tree run: | From 5fdda051277357d4e2e3f6280d522031c065d40a Mon Sep 17 00:00:00 2001 From: Mark Stacey Date: Fri, 20 Dec 2024 15:30:25 -0330 Subject: [PATCH 3/3] Fix merge conflict --- .circleci/config.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 5363d667bf86..f800ab484ebe 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -123,8 +123,6 @@ workflows: - master requires: - prep-deps - requires: - - prep-deps - prep-build-mmi: requires: - prep-deps