Skip to content

Commit 6dc9ff9

Browse files
wwills2wwills2
committed
Merge remote-tracking branch 'origin/develop' into develop
2 parents 5d9c6c5 + 235bffe commit 6dc9ff9

7 files changed

+1591
-578
lines changed

‎.github/dependabot.yml

+18-2
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ updates:
99
interval: "weekly"
1010
day: "tuesday"
1111
open-pull-requests-limit: 10
12+
rebase-strategy: auto
1213
labels:
1314
- dependencies
1415
- go
@@ -25,18 +26,20 @@ updates:
2526
interval: "weekly"
2627
day: "tuesday"
2728
open-pull-requests-limit: 10
29+
rebase-strategy: auto
2830
labels:
2931
- dependencies
3032
- python
3133
- "Changed"
3234
reviewers: ["emlowe", "altendky"]
3335

3436
- package-ecosystem: "github-actions"
35-
directory: /
37+
directories: ["/", ".github/actions/*"]
3638
schedule:
3739
interval: "weekly"
3840
day: "tuesday"
3941
open-pull-requests-limit: 10
42+
rebase-strategy: auto
4043
labels:
4144
- dependencies
4245
- github_actions
@@ -49,8 +52,21 @@ updates:
4952
interval: "weekly"
5053
day: "tuesday"
5154
open-pull-requests-limit: 10
55+
rebase-strategy: auto
5256
labels:
5357
- dependencies
5458
- javascript
5559
- "Changed"
56-
reviewers: ["cmmarslender", "emlowe"]
60+
reviewers: ["cmmarslender", "ChiaMineJP"]
61+
62+
- package-ecosystem: cargo
63+
directory: /
64+
schedule:
65+
interval: "weekly"
66+
day: "tuesday"
67+
open-pull-requests-limit: 10
68+
rebase-strategy: auto
69+
labels:
70+
- dependencies
71+
- rust
72+
- "Changed"

‎.github/workflows/auto-release-rc.yml

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# Compares the version in package.json to tags on the repo. If the tag doesn't exist, a new tag is created, which
2+
# then triggers the normal "on tag" release automation in the build job
3+
name: Auto Tag RC
4+
5+
on:
6+
push:
7+
branches:
8+
- develop
9+
10+
concurrency:
11+
group: rc-release-check
12+
13+
jobs:
14+
release-dev:
15+
name: Release rc version
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout current branch
19+
uses: actions/checkout@v4
20+
with:
21+
# Need REPO_COMMIT token so when the tag is created, the tag automation runs
22+
token: ${{ secrets.REPO_COMMIT }}
23+
fetch-depth: 0
24+
25+
- name: Setup commit signing for ChiaAutomation
26+
uses: Chia-Network/actions/commit-sign/gpg@main
27+
with:
28+
gpg_private_key: ${{ secrets.CHIA_AUTOMATION_PRIVATE_GPG_KEY }}
29+
passphrase: ${{ secrets.CHIA_AUTOMATION_PRIVATE_GPG_PASSPHRASE }}
30+
31+
- name: Check for current version tag. Create if it doesn't exist
32+
env:
33+
GH_TOKEN: ${{ github.token }}
34+
run: |
35+
stable_version=$(gh release list --limit 1 --order desc --exclude-pre-releases --json tagName --jq ".[].tagName")
36+
echo "Latest release is $stable_version"
37+
rc_version=$(gh release list --json tagName --jq ".[] | select(.tagName | test(\"${version}-rc*\")) | .tagName")
38+
echo "Latest release candidate is $rc_version"
39+
40+
if [[ -z ${rc_version} ]]; then
41+
# Extract the major, minor, and patch versions
42+
IFS='.' read -r major minor patch <<< "$stable_version"
43+
44+
# Increment the patch version
45+
new_patch=$((patch + 1))
46+
47+
# Construct the new version string
48+
version="$major.$minor.$new_patch-rc1"
49+
50+
echo "New version: $version"
51+
52+
else
53+
# Extract the major, minor, patch, and rc parts
54+
IFS='.-' read -r major minor patch rc <<< "$rc_version"
55+
56+
# Extract just the number of the rc
57+
rc_number="${rc#rc}"
58+
59+
# Increment the rc number
60+
rc_number=$((rc_number +1))
61+
62+
# Construct the new version string
63+
version="$major.$minor.$patch-rc$rc_number"
64+
65+
echo "New version: $version"
66+
67+
fi
68+
69+
if [ $(git tag -l "$version") ]; then
70+
echo "$version tag exists, deleting..."
71+
git tag -d $version
72+
git push --delete origin $version
73+
fi
74+
echo "Tag does not exist. Creating and pushing tag"
75+
rm -f CHANGELOG.md
76+
npx conventional-changelog-cli -p angular -i CHANGELOG.md -s -r 0
77+
changes=$(npx conventional-changelog-cli -r 1 | tail -n +2)
78+
git tag $version -m "Release $version $changes"
79+
git push origin $version

‎.github/workflows/build-installers.yaml

+76-20
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,12 @@ on:
44
push:
55
tags:
66
- '**'
7-
branches:
8-
- refactor/refactor-base #remove this once rebuild is merged
97
pull_request:
108
branches:
119
- '**'
1210

1311
concurrency:
14-
# SHA is added to the end if on `main` to let all main workflows run
15-
group: ${{ github.ref }}-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref == 'refs/heads/main' && github.sha || '' }}
12+
group: ${{ github.ref }}-${{ github.workflow }}
1613
cancel-in-progress: true
1714

1815
permissions:
@@ -27,15 +24,24 @@ jobs:
2724
name: Build Mac Installer
2825
runs-on: macos-latest
2926
steps:
30-
- uses: Chia-Network/actions/clean-workspace@main
31-
3227
- name: Checkout Code
3328
uses: actions/checkout@v4
3429

3530
- name: Setup Node 20
3631
uses: actions/setup-node@v4
3732
with:
38-
node-version: '20.10'
33+
node-version: '20.16'
34+
35+
- name: Change the package.json version if an RC tag
36+
if: startsWith(github.ref, 'refs/tags/') && contains( github.ref, '-rc')
37+
shell: bash
38+
run: |
39+
echo "Github ref: $GITHUB_REF"
40+
IFS='/' read -r base directory tag <<< "$GITHUB_REF"
41+
echo "Extracted tag is $tag"
42+
43+
jq ".version = \"${tag}\"" package.json > package.tmp
44+
mv package.tmp package.json
3945
4046
- name: Install Husky
4147
run: npm install --save-dev husky
@@ -59,7 +65,7 @@ jobs:
5965
SIGNING_SECRET: "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}"
6066

6167
- name: Import Apple installer signing certificate
62-
if: steps.check_secrets.outputs.HAS_SIGNING_SECRET
68+
if: steps.check_secrets.outputs.HAS_SIGNING_SECRET && startsWith(github.ref, 'refs/tags/')
6369
uses: Apple-Actions/import-codesign-certs@v3
6470
with:
6571
p12-file-base64: ${{ secrets.APPLE_DEV_ID_APP }}
@@ -71,7 +77,7 @@ jobs:
7177
run: npm run electron:package:mac
7278

7379
- name: Notarize
74-
if: steps.check_secrets.outputs.HAS_SIGNING_SECRET
80+
if: steps.check_secrets.outputs.HAS_SIGNING_SECRET && startsWith(github.ref, 'refs/tags/')
7581
run: |
7682
DMG_FILE=$(find ${{ github.workspace }}/dist/ -type f -name '*.dmg')
7783
xcrun notarytool submit \
@@ -94,10 +100,19 @@ jobs:
94100
- name: Checkout Code
95101
uses: actions/checkout@v4
96102

97-
- name: Setup Node 20.10
103+
- name: Setup Node 20.16
98104
uses: actions/setup-node@v4
99105
with:
100-
node-version: '20.10'
106+
node-version: '20.16'
107+
108+
- name: Change the package.json version if an RC tag
109+
if: startsWith(github.ref, 'refs/tags/') && contains( github.ref, '-rc')
110+
shell: bash
111+
run: |
112+
IFS='/' read -r base directory tag <<< "$GITHUB_REF"
113+
114+
jq ".version = \"${tag}\"" package.json > package.tmp
115+
mv package.tmp package.json
101116
102117
- name: Install Husky
103118
run: npm install --save-dev husky
@@ -155,10 +170,19 @@ jobs:
155170
- name: Checkout Code
156171
uses: actions/checkout@v4
157172

158-
- name: Setup Node 20.10
173+
- name: Setup Node 20.16
159174
uses: actions/setup-node@v4
160175
with:
161-
node-version: '20.10'
176+
node-version: '20.16'
177+
178+
- name: Change the package.json version if an RC tag
179+
if: startsWith(github.ref, 'refs/tags/') && contains( github.ref, '-rc')
180+
shell: bash
181+
run: |
182+
IFS='/' read -r base directory tag <<< "$GITHUB_REF"
183+
184+
jq ".version = \"${tag}\"" package.json > package.tmp
185+
mv package.tmp package.json
162186
163187
- name: Install Husky
164188
run: npm install --save-dev husky
@@ -190,10 +214,19 @@ jobs:
190214
- name: Checkout Code
191215
uses: actions/checkout@v4
192216

193-
- name: Setup Node 20.10
217+
- name: Setup Node 20.16
194218
uses: actions/setup-node@v4
195219
with:
196-
node-version: '20.10'
220+
node-version: '20.16'
221+
222+
- name: Change the package.json version if an RC tag
223+
if: startsWith(github.ref, 'refs/tags/') && contains( github.ref, '-rc')
224+
shell: bash
225+
run: |
226+
IFS='/' read -r base directory tag <<< "$GITHUB_REF"
227+
228+
jq ".version = \"${tag}\"" package.json > package.tmp
229+
mv package.tmp package.json
197230
198231
- name: Install Husky
199232
run: npm install --save-dev husky
@@ -258,29 +291,52 @@ jobs:
258291
echo "EXE_FILE=$EXE_FILE" >>$GITHUB_ENV
259292
echo "WEB_FILE=$WEB_FILE" >>$GITHUB_ENV
260293
294+
# RC release should not be set as latest
295+
- name: Decide if release should be set as latest
296+
id: is_latest
297+
shell: bash
298+
run: |
299+
unset IS_LATEST
300+
301+
echo "Github ref is $GITHUB_REF"
302+
303+
if [[ "$GITHUB_REF" =~ "-rc" ]]; then
304+
echo "release candidate tag matched"
305+
IS_LATEST='false'
306+
IS_PRERELEASE='true'
307+
else
308+
echo "main branch release matched"
309+
IS_LATEST='true'
310+
IS_PRERELEASE='false'
311+
fi
312+
313+
echo "IS_LATEST=${IS_LATEST}" >> "$GITHUB_OUTPUT"
314+
echo "IS_PRERELEASE=${IS_PRERELEASE}" >> "$GITHUB_OUTPUT"
315+
261316
- name: Release
262-
uses: softprops/action-gh-release@v2.1.0
317+
uses: softprops/action-gh-release@v2
263318
with:
319+
prerelease: ${{steps.is_latest.outputs.IS_PRERELEASE}}
320+
make_latest: "${{steps.is_latest.outputs.IS_LATEST}}"
264321
files: |
265322
${{ env.DMG_FILE }}
266323
${{ env.DEB_FILE }}
267324
${{ env.EXE_FILE }}
268325
${{ env.WEB_FILE }}
269326
270327
- name: Get repo name
328+
if: startsWith(github.ref, 'refs/tags/') && !contains( github.ref, '-rc')
271329
id: repo-name
272330
run: |
273331
echo "REPO_NAME=$(echo "$GITHUB_REPOSITORY" | cut -d "/" -f 2)" >>$GITHUB_OUTPUT
274332
275333
- name: Get tag name
334+
if: startsWith(github.ref, 'refs/tags/') && !contains( github.ref, '-rc')
276335
id: tag-name
277336
run: |
278-
echo "TAGNAME=$(echo $GITHUB_REF | cut -d / -f 3)" >>$GITHUB_OUTPUT
279-
280-
- name: Gets JWT Token from GitHub
281-
uses: Chia-Network/actions/github/jwt@main
282337
283338
- name: Trigger apt repo update
339+
if: startsWith(github.ref, 'refs/tags/') && !contains( github.ref, '-rc')
284340
uses: Chia-Network/actions/github/glue@main
285341
with:
286342
json_data: '{"climate_tokenization_repo":"${{ steps.repo-name.outputs.REPO_NAME }}","application_name":"[\"${{ env.APP_NAME }}\"]","release_version":"${{ steps.tag-name.outputs.TAGNAME }}","add_debian_version":"true","arm64":"available"}'

‎.github/workflows/check-commit-signing.yml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: 🚨 Check commit signing
2+
3+
on:
4+
push:
5+
branches:
6+
- long_lived/**
7+
- main
8+
- release/**
9+
pull_request:
10+
branches:
11+
- "**"
12+
13+
concurrency:
14+
group: ${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow_ref, github.event.pull_request.number) || github.run_id }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
check-commit-signing:
19+
name: Check commit signing
20+
runs-on: [ubuntu-latest]
21+
timeout-minutes: 5
22+
23+
steps:
24+
- name: Checkout Code
25+
uses: actions/checkout@v4
26+
with:
27+
fetch-depth: 0
28+
29+
- uses: chia-network/actions/check-commit-signing@main

‎.github/workflows/dependency-review.yml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Managed by repo-content-updater
2+
# Dependency Review Action
3+
#
4+
# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
5+
#
6+
# Source repository: https://github.com/actions/dependency-review-action
7+
# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
8+
name: "🚨 Dependency Review"
9+
on: [pull_request]
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
dependency-review:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: "Checkout Repository"
19+
uses: actions/checkout@v4
20+
21+
- name: "Dependency Review"
22+
uses: actions/dependency-review-action@v4
23+
with:
24+
allow-dependencies-licenses: pkg:pypi/pyinstaller
25+
deny-licenses: AGPL-1.0-only, AGPL-1.0-or-later, AGPL-1.0-or-later, AGPL-3.0-or-later, GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later

0 commit comments

Comments
 (0)