dequelabs / axe-api-team-public Goto Github PK
View Code? Open in Web Editor NEWShared configuration, settings, and actions for the Axe API Team
License: Mozilla Public License 2.0
Shared configuration, settings, and actions for the Axe API Team
License: Mozilla Public License 2.0
When abort-release-candidate
is trying to close issues and PR, it is looking for those that marked as 3.10.0 but it SHOULD be looking for 3.11.0. Gabe believes it is pulling the version from the lerna.json file on the develop branch instead of the release branch, but not 100% sure. Will need looking into.
The release branch is reset correctly, the issue is the release issue, the docs issue and the PR are not closed/moved correctly because the GHA is looking for 1 version previous. The abort reelase candidate gha doesn't error out, it jsut doesn't find what it is looking for so doesn't complete those steps.
Example abort run: https://github.com/dequelabs/jazzband/actions/runs/9212494790
This repo needs to be converted to using a workspace so that we can automate the use of dependabot to update dependancies.
Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: slack-notification
Purpose: To generate a Slack notification in a given channel
Usage: This GHA will be called from each repo when the release candidate merges into the release branch, and will post the link of the opened release issue (not PR) into a given slack channel.
Inputs:
token
(required)slack-channel
(requried)slack-title
(required)slack-message
(required)slack-webhook
(optional)msg-minimal
(optional)Outputs:
Parse out the existing slack functionality into it's own github action
The action should also have unit tests and a Readme. See https://github.com/JasonEtco/create-an-issue for template on how to do this.
Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.
We use the following snippet for getting a version in more than one action. As it's fairly simple we can move it to its own shell script action:
- name: Get version
shell: bash
id: get-version
run: |
# Get the version number from the prepare_release shell script and set it as an output
# Monorepos have a lerna.json file that contains the updated version number
# Non-monorepos, or non-npm repos, have a package.json file that contains the updated version number
if [ -f "lerna.json" ]; then
echo "release_candidate_version=$(cat lerna.json | jq -r '.version')" >> $GITHUB_OUTPUT
else
echo "release_candidate_version=$(cat package.json | jq -r '.version')" >> $GITHUB_OUTPUT
fi
The following actions should be removed:
Important
Before we remove these, we should audit all of our repos to make sure these are not still used and if there is an existing workflow utilising it, remove them before removing them here.
Please see #58 (comment) for context.
We should remove the work around once we have an update for @actions/github.
Per dequelabs/axe-api-team-public/.github/actions/semantic-pr-footer-v1@main we now need to add the following line to the bottom of the release candidate PR so it doesn't fail to merge:
No QA needed
It must be the last line of the PR description (no blank lines after)
If a 3rd party contributor makes a pr to fix a bug they've encountered, we shouldn't force them to follow our pr description footer requirements since they don't know what those are.
We need to be able to pull the latest version of a release to use in things like #61 and #62 . Unsure best way - parse from title? Use latest tag (if all repos use tags)? Read from the latest output of prepare_release.sh?
Scope change per Steve (11/21) which sounds just like #82
Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: abort-release-candidate
Purpose: To reset everything when a release candidate in progress needs to be abandoned for a new one to be created
Usage: This GHA will be called from each repo with a manual trigger
Inputs:
From repo:
docsRepo
- The name of the repo where the release notes livebase
- the name of the main/master branchtoken
- A GitHub token used for octokit and GH CLI with the required permissionsHardcoded in action:
Outputs:
This action should
colTeamBoard
column in project projTeamBoard
colReleaseBoard
column in project projReleaseBoard
docsRepo
is not null, find the open issue in the docsRepo
for release notes for the current repo/version
colTeamBoard
column in project `projTeamBoardrelease
to the base
branchEach of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.
All of our GHA's have a nyc
property within the package json. We can condense all of these to a root .nycrc
(https://github.com/istanbuljs/nyc#configuration-files) file that can contains all of the required checks require, example:
"nyc": {
"checkCoverage": true,
"extension": [
".ts"
],
"reporter": [
"text-summary",
"html"
],
"statements": 100,
"branches": 100,
"functions": 100,
"lines": 100,
"exclude": [
"dist",
"coverage",
"**/*.test.ts"
]
}
Then we don't need to have a nyc
property to any future actions it will just inherit from the root
Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: deploy-release
Purpose: To make sure everything finishes up automatically when a deployment has been completed
Usage: This GHA will be called from each repo when teh release pr is merged into master/main
Inputs:
From repo:
Outputs:
This composite action should
package.json
released
column if it was dev done
or done
)jobs:
create_sync_pull_request:
runs-on: ubuntu-latest
steps:
- uses: dequelabs/action-sync-branches@v1
with:
github-token: ${{ secrets.PAT }}
pr-title: 'chore: merge master into develop'
pr-body: 'Remember to _merge_ (rather than squash) this PR! Also, auto-merge does not work because many of the required checks do not run on the "master" branch.'
pr-team-reviewers: axe-api-team
head: master
Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.
Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: create-release-pr
Purpose: To generate a release pr
Usage: This GHA will be triggered manually in each repo once the RC passes QA and we are ready to deploy a release
base
(string) - This is the branch that the PR will merge intohead
(string) - This is the branch that contains the new code the PR is trying to mergerepo
(string) -version
(string) - This is the version of the release (currently unsure how to get this)pr-title
(string) - 'chore: Release v${{ version* }}'pr-body
(string) - ${{ commit list }}This GHA should first check to see if there is any open PR with the release
label using https://github.com/dequelabs/axe-api-team/issues/374. If so, this means the RC hasn't been merged yet so stop and do not go any further. If there is not one open, then this parent GHA should call https://github.com/dequelabs/axe-api-team/issues/371 between the release
and the master/main
branch to generate a commit list, somehow get the version, and then open a release PR using https://github.com/dequelabs/axe-api-team-public/blob/96267efd07acf7202bfc6bf12fa0584f8a310916/.github/actions/create-release-candidate-v1/action.yml#L131C4-L146C1
The action should also have unit tests and a Readme. See https://github.com/JasonEtco/create-an-issue for template on how to do this.
Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.
We need to investigate why in NPM workspaces its adding a dep called [email protected]
:
(https://github.com/dequelabs/axe-core-npm/actions/runs/7294573589/job/19879660978#step:4:110).
For reference this run: dequelabs/axe-core-npm#967
Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: get-release-issue
Purpose: To get a reference to the latest open issue in the repo with the label release
Usage: This GHA will be called from within a parent GHA
Inputs:
Outputs:
release
Github issueThis GHA should look for an issue in the repo that is labelled release
and is currently open. If there are more than 1 returned, it should return the latest. The output will be used in a different GHA to add a comment onto this issue, so the output should be whatever GHA can use to add a comment (ID?, URL?)
The action should also have unit tests and a Readme. See https://github.com/JasonEtco/create-an-issue for template on how to do this.
Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.
Scope change per Steve (11/21) related to #63 and #64
We should add a anchor link within the token
input if we require permisions and link that to the permission section within GHAs README
Whenever we make changes to the actions source code we need to rebuild the dist directory so we pull in the latest changes (that gets bundled into index.js
). This is prone to error, instead we should not rely on the user to rebuild the action but automate it.
build
step to husky's pre-commit hook that way if any commit a user does we will rebuild and automatically add any changed dist
files to the commitprebuild
step to call rimraf dist
in case the build
changes/removes any emitted filesSet up Dependabot to automatically update dependancies following the examples provided in https://github.com/dequelabs/axe-api-team/pull/400
For our actions we require token
and the GH_TOKEN
to be set example. We should just be able to pass one input
and that sets the required permissions throughout all the actions.
In the [create-release-candidate](https://github.com/dequelabs/axe-api-team-public/blob/main/.github/actions/create-release-candidate-v1/action.yml#L219)
there are a few small changes to be made:
Backlog
(
)Upcoming
(
)We already have https://github.com/dequelabs/update-axe-core, but we should port it to this repo and update it to use TypeScript, add tests, and resolve all the open issues. We should also create a composite action that uses it and opens a pr for us as updating axe-core without a pr is kinda useless. Plus every repo that uses the action has to duplicate the pr creation part.
Now we have automated dependency updates in this repository, depending what gets updated they may get used within .github/actions
because of this, we will need to rebuild dist
. We can create a GHA that can do the following:
push
to main
build-update-all-dists
npm --workspaces run build
which will re-build all dists
within the action directorybuild(.github/actions): rebuild dists
This way we will always be up to date
Create a new YML file based off of the one used by mobile ( https://github.com/dequelabs/devtools-mobile-service/blob/develop/.github/workflows/checkov.yml) that will send scans to prisma.
PRISMA_API_URL: https://api4.prismacloud.io
into a secretoutput_file_path:
a variable passed in by the repo calling the GHAWe've determined that for repos using yarn workspace or repos needing private NPM auth credentials that running the @actions/checkout
step will override any prior setup. We added a parameter to the create-update-axe-core-pull-request action to conditionally run the checkout step to handle this. However this solution isn't ideal and we should instead just not check out at all in the public actions. Instead the calling code of the public action should be responsible for checking out the repo and doing setup before calling the action.
In order to do this in piecemeal (so we don't break all the actions) we should:
@actions/checkout
stepWe have a pre-commit hook for handling formatting changes with prettier. We should also have a formatter as an action in case the developer commits code via suggestion during code review. We can use this action
When clicking the "Update branch" button on a pr opened by a bot, the action looks at the actor which will be the person who clicked the button and not the bot. This causes the footer action to fail since the actor is not a bot. Instead the action should look at the pull request itself and get the user who opened the pr.
Repo: https://github.com/dequelabs/axe-api-team-public
GHA Name: create-release
Purpose: To generate a release pr
Usage: This GHA will be triggered manually in each repo once the RC passes QA and we are ready to deploy a release
base
(string) - This is the branch that the PR will merge intoThis composite action should
.github/actions/is-release-in-progress-v1
.github/actions/generate-commit-list-v1
package.json
Each of the public actions in https://github.com/dequelabs/axe-api-team-public should include a readme with information on how to use the action and a list all inputs and outputs.
We share a bit of information across different actions, such as the project board numbers and the moveIssueToColumn function (in label-and-move-released-issue). We should create a shared location for these constants and utility functions that any action can use.
The semantic-pr-footer
action only supports a tiny subset of the keywords GitHub supports. This seems like an unnecessary limitation, which has already caused confusion (https://github.com/dequelabs/axe-api-team/pull/460).
We have several GHA's that are on a CRON schedule, if the workflow fails the team is not notified of the failure instead an individual is notified:
Notifications for scheduled workflows are sent to the user who initially created the workflow. If a different user updates the cron syntax in the workflow file, subsequent notifications will be sent to that user instead. If a scheduled workflow is disabled and then re-enabled, notifications will be sent to the user who re-enabled the workflow rather than the user who last modified the cron syntax.
To get around this 1-bus factor, we can create a new GHA that is called on failure()
that can notify a particular slack channel of what repo and workflow failed.
See comment: #26 (comment)
Each github action within this repo needs to be checked to ensure it follows the timeout policy as described here: https://github.com/dequelabs/axe-api-team/blob/main/policies/github-actions.md#timeouts
Add an input variable to allow user to add custom title instead of the hardcoded default.
During create-release-candidate
, the docs issue is created and the url should be showing up in the main release issue but it is not. The issue IS being created, but the url is not being populated anymore in the issue (it used to be)
With the adding of the new semantic PR footer dependabot PR's are starting to fail dequelabs/axe-core-maven-html#409.
We should:
Set up https://github.com/dequelabs/axe-api-team-public/blob/main/.github/actions/semantic-pr-footer-v1 so it will block a PR that does not have at least one of the following:
After the release
branch has been merged into main
/master
, we want to use label-and-move-released-issues-v1 on all commits in the release. However using generate-commit-list
requires two branches, but once master is merged all branches are in-sync there won't be any differences between the branch commits.
To address this we'll need generate-commit-list
to accept a tag and the term HEAD
in order to get a commit list from the last git tag to the current main
/master
HEAD.
git log v4.8.2..HEAD --oneline --no-merges --abbrev-commit
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.