Integrate shared package and pending app updates #113
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| version: 2 | ||
| updates: | ||
| - package-ecosystem: npm | ||
| directory: "/app" | ||
| schedule: | ||
| interval: daily | ||
| time: "08:00" | ||
| open-pull-requests-limit: 10 | ||
| groups: | ||
| cloudflare: | ||
| patterns: | ||
| - "@cloudflare/*" | ||
| - "wrangler" | ||
| - "hono" | ||
| testing: | ||
| patterns: | ||
| - "vitest" | ||
| - "@playwright/*" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| name: Deploy Preview | ||
|
|
||
| on: | ||
| push: | ||
| branches: [staging] | ||
| workflow_dispatch: {} | ||
|
|
||
| # Never run two preview deploys at once; let an in-flight deploy finish. | ||
| concurrency: | ||
| group: deploy-preview | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| deploy: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
|
jaywedgeworth22 marked this conversation as resolved.
|
||
| issues: write | ||
| pull-requests: write | ||
| defaults: | ||
| run: | ||
| working-directory: app | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 22 | ||
| cache: npm | ||
| cache-dependency-path: app/package-lock.json | ||
|
|
||
| - name: Configure private GitHub dependencies | ||
| env: | ||
| SHARED_PACKAGE_DEPLOY_KEY: ${{ secrets.SHARED_PACKAGE_DEPLOY_KEY }} | ||
| GH_PAT: ${{ secrets.GH_PAT }} | ||
| run: | | ||
| if [ -n "$SHARED_PACKAGE_DEPLOY_KEY" ]; then | ||
| mkdir -p "$HOME/.ssh" | ||
| printf '%s\n' "$SHARED_PACKAGE_DEPLOY_KEY" > "$HOME/.ssh/congress_trading_shared" | ||
| chmod 600 "$HOME/.ssh/congress_trading_shared" | ||
| ssh-keyscan github.com >> "$HOME/.ssh/known_hosts" | ||
| git config --global core.sshCommand "ssh -i $HOME/.ssh/congress_trading_shared -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" | ||
| git config --global url."ssh://git@github.com/".insteadOf "https://github.com/" | ||
| git config --global url."ssh://git@github.com/".insteadOf "git@github.com:" | ||
| git ls-remote ssh://git@github.com/jaywedgeworth22/congress-trading-shared.git HEAD >/dev/null | ||
| elif [ -n "$GH_PAT" ]; then | ||
| git config --global credential.helper store | ||
| printf 'https://x-access-token:%s@github.com\n' "$GH_PAT" > "$HOME/.git-credentials" | ||
| git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" | ||
| git config --global url."https://github.com/".insteadOf "git@github.com:" | ||
| git ls-remote https://github.com/jaywedgeworth22/congress-trading-shared.git HEAD >/dev/null | ||
| else | ||
| echo "::error::SHARED_PACKAGE_DEPLOY_KEY or GH_PAT with read access to jaywedgeworth22/congress-trading-shared is required for npm ci." | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Install dependencies | ||
| run: npm ci | ||
|
|
||
| - name: Build isolated preview config | ||
| run: | | ||
| cp wrangler.preview.example.toml wrangler.preview.toml | ||
| python - <<'PY' | ||
| from pathlib import Path | ||
| import os | ||
|
|
||
| path = Path("wrangler.preview.toml") | ||
| text = path.read_text() | ||
| replacements = { | ||
| "PREVIEW_D1_DATABASE_ID": os.environ["PREVIEW_D1_DATABASE_ID"], | ||
| "PREVIEW_KV_NAMESPACE_ID": os.environ["PREVIEW_KV_NAMESPACE_ID"], | ||
| "https://congress-trade-preview.<your-workers-subdomain>.workers.dev": os.environ["PREVIEW_APP_BASE_URL"], | ||
| } | ||
| for old, new in replacements.items(): | ||
| text = text.replace(old, new) | ||
| path.write_text(text) | ||
| PY | ||
| env: | ||
| PREVIEW_D1_DATABASE_ID: ${{ secrets.PREVIEW_D1_DATABASE_ID }} | ||
| PREVIEW_KV_NAMESPACE_ID: ${{ secrets.PREVIEW_KV_NAMESPACE_ID }} | ||
| PREVIEW_APP_BASE_URL: ${{ vars.PREVIEW_APP_BASE_URL || 'https://congress-trade-preview.workers.dev' }} | ||
|
|
||
| - name: Deploy to Cloudflare Workers (preview) | ||
| id: deploy | ||
| run: | | ||
| DEPLOY_URL=$(bash scripts/deploy-preview.sh 2>&1 | tee /dev/stderr | grep -o 'https://[^ ]*\.workers\.dev' | tail -1 || true) | ||
| echo "deploy_url=${DEPLOY_URL:-${PREVIEW_APP_BASE_URL}}" >> "$GITHUB_OUTPUT" | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
| PREVIEW_APP_BASE_URL: ${{ vars.PREVIEW_APP_BASE_URL || 'https://congress-trade-preview.workers.dev' }} | ||
|
|
||
| - name: Comment deploy URL | ||
| if: github.event_name == 'push' | ||
| run: | | ||
| URL="${{ steps.deploy.outputs.deploy_url }}" | ||
| PR_NUMBER="$(gh pr list --head staging --json number -q '.[0].number')" | ||
| if [ -n "$PR_NUMBER" ]; then | ||
| gh pr comment "$PR_NUMBER" --body "Preview deployed: ${URL}" | ||
| fi | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| name: Deploy | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| confirm: | ||
| description: "Type deploy-production to deploy congress.trade" | ||
| required: true | ||
| type: string | ||
|
|
||
| # Never run two deploys at once; let an in-flight deploy finish rather than | ||
| # cancel it mid-deploy. | ||
| concurrency: | ||
| group: deploy-production | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| deploy: | ||
| if: github.event.inputs.confirm == 'deploy-production' | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| defaults: | ||
| run: | ||
| working-directory: app | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 22 | ||
| cache: npm | ||
| cache-dependency-path: app/package-lock.json | ||
|
|
||
| - name: Configure private GitHub dependencies | ||
| env: | ||
| SHARED_PACKAGE_DEPLOY_KEY: ${{ secrets.SHARED_PACKAGE_DEPLOY_KEY }} | ||
| GH_PAT: ${{ secrets.GH_PAT }} | ||
| run: | | ||
| if [ -n "$SHARED_PACKAGE_DEPLOY_KEY" ]; then | ||
| mkdir -p "$HOME/.ssh" | ||
| printf '%s\n' "$SHARED_PACKAGE_DEPLOY_KEY" > "$HOME/.ssh/congress_trading_shared" | ||
| chmod 600 "$HOME/.ssh/congress_trading_shared" | ||
| ssh-keyscan github.com >> "$HOME/.ssh/known_hosts" | ||
| git config --global core.sshCommand "ssh -i $HOME/.ssh/congress_trading_shared -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" | ||
| git config --global url."ssh://git@github.com/".insteadOf "https://github.com/" | ||
| git config --global url."ssh://git@github.com/".insteadOf "git@github.com:" | ||
| git ls-remote ssh://git@github.com/jaywedgeworth22/congress-trading-shared.git HEAD >/dev/null | ||
| elif [ -n "$GH_PAT" ]; then | ||
| git config --global credential.helper store | ||
| printf 'https://x-access-token:%s@github.com\n' "$GH_PAT" > "$HOME/.git-credentials" | ||
| git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" | ||
| git config --global url."https://github.com/".insteadOf "git@github.com:" | ||
| git ls-remote https://github.com/jaywedgeworth22/congress-trading-shared.git HEAD >/dev/null | ||
| else | ||
| echo "::error::SHARED_PACKAGE_DEPLOY_KEY or GH_PAT with read access to jaywedgeworth22/congress-trading-shared is required for npm ci." | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Install dependencies | ||
| run: npm ci | ||
|
jaywedgeworth22 marked this conversation as resolved.
|
||
|
|
||
| - name: Typecheck | ||
| run: npm run typecheck | ||
|
|
||
| - name: Test | ||
| run: npm test | ||
|
|
||
| - name: Deploy to Cloudflare Workers | ||
| run: bash scripts/ship.sh | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
| ADMIN_TOKEN: ${{ secrets.ADMIN_TOKEN }} | ||
|
There was a problem hiding this comment.
In a GitHub Actions run where Useful? React with 👍 / 👎. |
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
GitHub's Dependabot-on-Actions docs state that Dependabot-triggered
pull_requestruns are treated like fork runs and do not receive normal Actions secrets; this new npm Dependabot config will therefore open PRs whose CI cannot readSHARED_PACKAGE_DEPLOY_KEYorGH_PATin the private-dependency setup step and exits beforenpm ci. Add matching Dependabot secrets or route Dependabot PRs through a workflow path that does not require the private package credentials.Useful? React with 👍 / 👎.