dequelabs / axe-api-team-public Goto Github PK

When abort-release-candidate is trying to close issues and PR, it is looking for those that marked as 3.10.0 but it SHOULD be looking for 3.11.0. Gabe believes it is pulling the version from the lerna.json file on the develop branch instead of the release branch, but not 100% sure. Will need looking into.

The release branch is reset correctly, the issue is the release issue, the docs issue and the PR are not closed/moved correctly because the GHA is looking for 1 version previous. The abort reelase candidate gha doesn't error out, it jsut doesn't find what it is looking for so doesn't complete those steps.

Example abort run: https://github.com/dequelabs/jazzband/actions/runs/9212494790

We are getting an error when running create-release in the jazzband repo. The issue appears to be on this line

It may have to do with it looking for data migrations and none found (we ran across this issue before and I am not sure if it was ever fixed).

This repo needs to be converted to using a workspace so that we can automate the use of dependabot to update dependancies.

Overview

Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: slack-notification
Purpose: To generate a Slack notification in a given channel
Usage: This GHA will be called from each repo when the release candidate merges into the release branch, and will post the link of the opened release issue (not PR) into a given slack channel.

Inputs:

• token (required)
• slack-channel (requried)
• slack-title (required)
• slack-message (required)
• slack-webhook (optional)
• msg-minimal (optional)

Outputs:

• Post sent to Slack

Details

Parse out the existing slack functionality into it's own github action

https://github.com/dequelabs/axe-api-team-public/blob/96267efd07acf7202bfc6bf12fa0584f8a310916/.github/actions/auto-major-minor-release-v1/action.yml#L139C1-L150C26

The action should also have unit tests and a Readme. See https://github.com/JasonEtco/create-an-issue for template on how to do this.

Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.

We use the following snippet for getting a version in more than one action. As it's fairly simple we can move it to its own shell script action:

- name: Get version
  shell: bash
  id: get-version
  run: |
    # Get the version number from the prepare_release shell script and set it as an output
    # Monorepos have a lerna.json file that contains the updated version number
    # Non-monorepos, or non-npm repos, have a package.json file that contains the updated version number
    if [ -f "lerna.json" ]; then
      echo "release_candidate_version=$(cat lerna.json | jq -r '.version')" >> $GITHUB_OUTPUT
    else
      echo "release_candidate_version=$(cat package.json | jq -r '.version')" >> $GITHUB_OUTPUT
    fi

The following actions should be removed:

• auto-major-minor-release-v1
• auto-patch-release-v1
• cancel-if-release-pr-exists

Please see #58 (comment) for context.

We should remove the work around once we have an update for @actions/github.

Per dequelabs/axe-api-team-public/.github/actions/semantic-pr-footer-v1@main we now need to add the following line to the bottom of the release candidate PR so it doesn't fail to merge:

No QA needed

It must be the last line of the PR description (no blank lines after)

If a 3rd party contributor makes a pr to fix a bug they've encountered, we shouldn't force them to follow our pr description footer requirements since they don't know what those are.

We need to be able to pull the latest version of a release to use in things like #61 and #62 . Unsure best way - parse from title? Use latest tag (if all repos use tags)? Read from the latest output of prepare_release.sh?

Scope change per Steve (11/21) which sounds just like #82

1. We don't need to get the version number. At any point we would call this we can just look at the version of package.json in the current repo
2. For the docs repo there can be multiple open issues labeled release, either for different repos or even the same repo if multiple versions were released in quick succession and the docs for the prior one haven't been written yet. We'll need to filter all the open release issues by the name of the github repo and also by the current version. Allow supplying version number to input but default to current version from package.json
3. We'll need to allow the action to get issues from other repos (namely the docs repo). Add input for repo (default to current context repo)
4. Rename action to get-release-issue

Overview

Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: abort-release-candidate
Purpose: To reset everything when a release candidate in progress needs to be abandoned for a new one to be created
Usage: This GHA will be called from each repo with a manual trigger

Inputs:
From repo:

• docsRepo - The name of the repo where the release notes live
• base - the name of the main/master branch
• token - A GitHub token used for octokit and GH CLI with the required permissions

Hardcoded in action:

• projTeamBoard - the number of the API Team Board (66)
• colTeamBoard - the column on the API Team Board the issue should be moved to (Not Doing)
• projReleaseBoard- the number of the API Team Releases Board (103)
• colReleaseBoard - the column on the API Team Releases Board the issue should be moved to (Release Cancelled)

Outputs:

• None

Details

This action should

1. Find the open release issues using this GHA
   • Find the open release issue in the current repo
   • Find the open doc release (if provided as input) in the doc repo
2. Once the issue is found:
   • Close the issue as Not Planned (https://cli.github.com/manual/gh_issue_close)
   • Move the issue to the colTeamBoard column in project projTeamBoard
   • Move the issue to the colReleaseBoard column in project projReleaseBoard
3. If docsRepo is not null, find the open issue in the docsRepo for release notes for the current repo/version
   • Close the issue as Not Planned
   • Move the issue to the colTeamBoard column in project `projTeamBoard
4. Reset the release to the base branch

Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.

All of our GHA's have a nyc property within the package json. We can condense all of these to a root .nycrc (https://github.com/istanbuljs/nyc#configuration-files) file that can contains all of the required checks require, example:

  "nyc": {
    "checkCoverage": true,
    "extension": [
      ".ts"
    ],
    "reporter": [
      "text-summary",
      "html"
    ],
    "statements": 100,
    "branches": 100,
    "functions": 100,
    "lines": 100,
    "exclude": [
      "dist",
      "coverage",
      "**/*.test.ts"
    ]
  }

Then we don't need to have a nyc property to any future actions it will just inherit from the root

Overview

Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: deploy-release
Purpose: To make sure everything finishes up automatically when a deployment has been completed
Usage: This GHA will be called from each repo when teh release pr is merged into master/main

Inputs:
From repo:

• None

Outputs:

• None

Details

This composite action should

1. Get the version number from package.json
2. Get the commits using .github/actions/generate-commit-list-v1
3. Run through and label all issues closed in this release using .github/actions/label-and-move-released-issues-v1 (this should create a label with the version number if it doesn't already exist, label any issue closed in this version, and automatically move any issues into the released column if it was dev done or done)
4. Sync the master/main branch back into develop
   Some of the repos already have this which can just be added into this so it is in a single place in case we need to make changes in the future

jobs:
  create_sync_pull_request:
    runs-on: ubuntu-latest
    steps:
      - uses: dequelabs/action-sync-branches@v1
        with:
          github-token: ${{ secrets.PAT }}
          pr-title: 'chore: merge master into develop'
          pr-body: 'Remember to _merge_ (rather than squash) this PR! Also, auto-merge does not work because many of the required checks do not run on the "master" branch.'
          pr-team-reviewers: axe-api-team
          head: master

Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.

Overview

Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: create-release-pr
Purpose: To generate a release pr
Usage: This GHA will be triggered manually in each repo once the RC passes QA and we are ready to deploy a release

Inputs set per repo

• base (string) - This is the branch that the PR will merge into
• head (string) - This is the branch that contains the new code the PR is trying to merge
• repo (string) -
• version (string) - This is the version of the release (currently unsure how to get this)
• pr-title (string) - 'chore: Release v${{ version* }}'
• pr-body (string) - ${{ commit list }}

Outputs:##

• Release PR

Details

This GHA should first check to see if there is any open PR with the release label using https://github.com/dequelabs/axe-api-team/issues/374. If so, this means the RC hasn't been merged yet so stop and do not go any further. If there is not one open, then this parent GHA should call https://github.com/dequelabs/axe-api-team/issues/371 between the release and the master/main branch to generate a commit list, somehow get the version, and then open a release PR using https://github.com/dequelabs/axe-api-team-public/blob/96267efd07acf7202bfc6bf12fa0584f8a310916/.github/actions/create-release-candidate-v1/action.yml#L131C4-L146C1

The action should also have unit tests and a Readme. See https://github.com/JasonEtco/create-an-issue for template on how to do this.

Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.

Flow

We need to investigate why in NPM workspaces its adding a dep called [email protected]:

(https://github.com/dequelabs/axe-core-npm/actions/runs/7294573589/job/19879660978#step:4:110).

For reference this run: dequelabs/axe-core-npm#967

Overview

Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: get-release-issue
Purpose: To get a reference to the latest open issue in the repo with the label release
Usage: This GHA will be called from within a parent GHA

Inputs:

• None

Outputs:

• Reference to the open release Github issue

Details

This GHA should look for an issue in the repo that is labelled release and is currently open. If there are more than 1 returned, it should return the latest. The output will be used in a different GHA to add a comment onto this issue, so the output should be whatever GHA can use to add a comment (ID?, URL?)

The action should also have unit tests and a Readme. See https://github.com/JasonEtco/create-an-issue for template on how to do this.

Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.

Scope change per Steve (11/21) related to #63 and #64

1. We don't need to get the version number. At any point we would call this we can just look at the version of package.json in the current repo
2. For the docs repo there can be multiple open issues labeled release, either for different repos or even the same repo if multiple versions were released in quick succession and the docs for the prior one haven't been written yet. We'll need to filter all the open release issues by the name of the github repo and also by the current version. Allow supplying version number to input but default to current version from package.json
3. We'll need to allow the action to get issues from other repos (namely the docs repo). Add input for repo (default to current context repo)
4. Rename action to get-release-issue

We should add a anchor link within the token input if we require permisions and link that to the permission section within GHAs README

Whenever we make changes to the actions source code we need to rebuild the dist directory so we pull in the latest changes (that gets bundled into index.js). This is prone to error, instead we should not rely on the user to rebuild the action but automate it.

1. Add the build step to husky's pre-commit hook that way if any commit a user does we will rebuild and automatically add any changed dist files to the commit
2. We should add a action similar to the Formatter action that re-builds the dist and commits any changes to the pull-request. This cover cases where the developer commits changes via suggestions within the UI
3. When building locally, we should have a prebuild step to call rimraf dist in case the build changes/removes any emitted files

Set up Dependabot to automatically update dependancies following the examples provided in https://github.com/dequelabs/axe-api-team/pull/400

For our actions we require token and the GH_TOKEN to be set example. We should just be able to pass one input and that sets the required permissions throughout all the actions.

In the [create-release-candidate](https://github.com/dequelabs/axe-api-team-public/blob/main/.github/actions/create-release-candidate-v1/action.yml#L219) there are a few small changes to be made:

• The column the issue should go into on the api team board (66) is Backlog (

  axe-api-team-public/.github/actions/create-release-candidate-v1/action.yml

  Line 169 in 9a92ce1

  column_name: 'Ready for QA'

  )
• The column the issue should go into on the releases board (103) is Upcoming (

  axe-api-team-public/.github/actions/create-release-candidate-v1/action.yml

  Line 219 in 9a92ce1

  column-name: 'RC Created'

  )

We already have https://github.com/dequelabs/update-axe-core, but we should port it to this repo and update it to use TypeScript, add tests, and resolve all the open issues. We should also create a composite action that uses it and opens a pr for us as updating axe-core without a pr is kinda useless. Plus every repo that uses the action has to duplicate the pr creation part.

Now we have automated dependency updates in this repository, depending what gets updated they may get used within .github/actions because of this, we will need to rebuild dist. We can create a GHA that can do the following:

1. Run on push to main
2. Create branch build-update-all-dists
3. Run npm --workspaces run build which will re-build all dists within the action directory
4. If there no file changes, exit 0
5. If there are file changes, commit all with build(.github/actions): rebuild dists
6. Create PR

This way we will always be up to date

Create a new YML file based off of the one used by mobile ( https://github.com/dequelabs/devtools-mobile-service/blob/develop/.github/workflows/checkov.yml) that will send scans to prisma.

• Please move the value of PRISMA_API_URL: https://api4.prismacloud.io into a secret
• Also make output_file_path: a variable passed in by the repo calling the GHA

We've determined that for repos using yarn workspace or repos needing private NPM auth credentials that running the @actions/checkout step will override any prior setup. We added a parameter to the create-update-axe-core-pull-request action to conditionally run the checkout step to handle this. However this solution isn't ideal and we should instead just not check out at all in the public actions. Instead the calling code of the public action should be responsible for checking out the repo and doing setup before calling the action.

In order to do this in piecemeal (so we don't break all the actions) we should:

1. Add the conditional parameter to every public action that uses the @actions/checkout step
2. After that, each repo that uses the public action should update their actions to do the checkout / setup step and use the conditional parameter to disable the step in the public action
3. Once all repos have been converted to this new style we can delete the conditional parameter from the public actions
4. Lastly we can remove the usage of the conditional parameter in all our other repos

We have a pre-commit hook for handling formatting changes with prettier. We should also have a formatter as an action in case the developer commits code via suggestion during code review. We can use this action

When clicking the "Update branch" button on a pr opened by a bot, the action looks at the actor which will be the person who clicked the button and not the bot. This causes the footer action to fail since the actor is not a bot. Instead the action should look at the pull request itself and get the user who opened the pr.

Overview

Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: create-release
Purpose: To generate a release pr
Usage: This GHA will be triggered manually in each repo once the RC passes QA and we are ready to deploy a release

Inputs set per repo

• base (string) - This is the branch that the PR will merge into

Outputs:##

• Release PR

Details

This composite action should

1. Check if there is a release in progress using .github/actions/is-release-in-progress-v1
   • If true, stop github action from going any further
2. Get the commit list using .github/actions/generate-commit-list-v1
3. Use whatever logic walnut uses to figure out if there are any migrations and/or environment variables
4. Get the version number from package.json
5. Open a release PR using https://github.com/dequelabs/axe-api-team-public/blob/96267efd07acf7202bfc6bf12fa0584f8a310916/.github/actions/create-release-candidate-v1/action.yml#L131C4-L146C1
   • Title: `chore(release): v(version)
   • Body:
     • Changelog of the release
     • Data Migrations: (list out the migrations)
     • Environment Variables: (list out the EVs)

Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.

We share a bit of information across different actions, such as the project board numbers and the moveIssueToColumn function (in label-and-move-released-issue). We should create a shared location for these constants and utility functions that any action can use.

The semantic-pr-footer action only supports a tiny subset of the keywords GitHub supports. This seems like an unnecessary limitation, which has already caused confusion (https://github.com/dequelabs/axe-api-team/pull/460).

See https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword

We have several GHA's that are on a CRON schedule, if the workflow fails the team is not notified of the failure instead an individual is notified:

Notifications for scheduled workflows are sent to the user who initially created the workflow. If a different user updates the cron syntax in the workflow file, subsequent notifications will be sent to that user instead. If a scheduled workflow is disabled and then re-enabled, notifications will be sent to the user who re-enabled the workflow rather than the user who last modified the cron syntax.

https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/notifications-for-workflow-runs

To get around this 1-bus factor, we can create a new GHA that is called on failure() that can notify a particular slack channel of what repo and workflow failed.

See comment: #26 (comment)

Each github action within this repo needs to be checked to ensure it follows the timeout policy as described here: https://github.com/dequelabs/axe-api-team/blob/main/policies/github-actions.md#timeouts

• If the timeout is not set, it needs to be set
• If the timeout IS set, the timeout duration should be checked against the last 5 runs to ensure it is set correctly per the policy

Add an input variable to allow user to add custom title instead of the hardcoded default.

During create-release-candidate, the docs issue is created and the url should be showing up in the main release issue but it is not. The issue IS being created, but the url is not being populated anymore in the issue (it used to be)

https://github.com/dequelabs/jazzband/issues/1118

With the adding of the new semantic PR footer dependabot PR's are starting to fail dequelabs/axe-core-maven-html#409.

We should:

• Add a list of github actors we know and use throughout all our repos. We want to do this because we shouldn't have to go and open a PR to pass the same actors for every repo, we should try to centralise all the actors we know and consume.
• Add input for additional actors that might be outside of the team / new actors that come up

Set up https://github.com/dequelabs/axe-api-team-public/blob/main/.github/actions/semantic-pr-footer-v1 so it will block a PR that does not have at least one of the following:

• There is a link to a valid issue in the description of the PR
• The words "QA NOTES" appear in the description of the PR
• The words "QA NOT NEEDED" appear in the description of the PR

After the release branch has been merged into main/master, we want to use label-and-move-released-issues-v1 on all commits in the release. However using generate-commit-list requires two branches, but once master is merged all branches are in-sync there won't be any differences between the branch commits.

To address this we'll need generate-commit-list to accept a tag and the term HEAD in order to get a commit list from the last git tag to the current main/master HEAD.

git log v4.8.2..HEAD --oneline --no-merges --abbrev-commit