From 80a3cd8bd388578fc8c4e60e8a1a15db6d201b35 Mon Sep 17 00:00:00 2001 From: Danila Poyarkov Date: Sat, 1 Aug 2026 19:50:08 +0300 Subject: [PATCH] ci: update GitHub Actions to Node 24 (#460) * ci: update GitHub Actions to Node 24 * ci: skip privileged previews for forks * ci: isolate preview deployment secrets --- .github/actions/setup-bun/action.yml | 2 +- .github/workflows/app.yml | 4 +- .github/workflows/build.yml | 6 +- .github/workflows/ci.yml | 4 +- .github/workflows/deploy-preview.yml | 73 ++++++++++++++++++++++++ .github/workflows/docs.yml | 4 +- .github/workflows/heavy-tests.yml | 2 +- .github/workflows/pr-review-guidance.yml | 4 +- .github/workflows/preview.yml | 48 ++++------------ 9 files changed, 97 insertions(+), 50 deletions(-) create mode 100644 .github/workflows/deploy-preview.yml diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml index d4958673e..62d362bec 100644 --- a/.github/actions/setup-bun/action.yml +++ b/.github/actions/setup-bun/action.yml @@ -25,7 +25,7 @@ runs: - uses: oven-sh/setup-bun@v2 - - uses: actions/cache@v4 + - uses: actions/cache@v6 with: path: ~/.bun/install/cache key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} diff --git a/.github/workflows/app.yml b/.github/workflows/app.yml index 9511286a1..9d82d0fa8 100644 --- a/.github/workflows/app.yml +++ b/.github/workflows/app.yml @@ -13,7 +13,7 @@ jobs: contents: read deployments: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: ./.github/actions/setup-bun @@ -22,7 +22,7 @@ jobs: - run: bun run build - - uses: cloudflare/wrangler-action@v3 + - uses: cloudflare/wrangler-action@v4 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 795f80764..517f41762 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -34,7 +34,7 @@ jobs: runs-on: ${{ matrix.platform }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@stable with: @@ -125,9 +125,9 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: 24.x registry-url: https://registry.npmjs.org/ diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c9c8aefce..aa93abbe7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: quality: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: ./.github/actions/setup-bun with: @@ -39,7 +39,7 @@ jobs: group: [app, dom, editor, fig, render, scene, vue] name: Unit tests (${{ matrix.group }}) steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: ./.github/actions/setup-bun with: diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml new file mode 100644 index 000000000..7092ca91e --- /dev/null +++ b/.github/workflows/deploy-preview.yml @@ -0,0 +1,73 @@ +name: Deploy preview + +on: + workflow_run: + workflows: [Preview] + types: [completed] + +concurrency: + group: deploy-preview-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.id }} + cancel-in-progress: true + +jobs: + deploy: + if: >- + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.head_repository.full_name == github.repository && + github.event.workflow_run.pull_requests[0].number != null + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + deployments: write + pull-requests: write + environment: + name: preview + url: ${{ steps.deploy.outputs.deployment-url }} + steps: + - name: Download validated preview artifact + uses: actions/download-artifact@v8 + with: + name: preview-dist + path: dist + github-token: ${{ github.token }} + repository: ${{ github.repository }} + run-id: ${{ github.event.workflow_run.id }} + + - name: Deploy preview + uses: cloudflare/wrangler-action@v4 + id: deploy + with: + apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} + accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} + packageManager: npm + command: pages deploy dist --project-name=openpencil-app --branch=pr-${{ github.event.workflow_run.pull_requests[0].number }} + + - name: Comment preview URL + uses: actions/github-script@v9 + env: + PREVIEW_URL: ${{ steps.deploy.outputs.deployment-url }} + PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} + with: + script: | + const url = process.env.PREVIEW_URL; + const issue_number = Number(process.env.PR_NUMBER); + if (!url || !Number.isInteger(issue_number)) { + core.setFailed('Preview deployment metadata is incomplete'); + return; + } + const marker = ''; + const body = `${marker}\nšŸ”— Preview: ${url}`; + const { data: comments } = await github.rest.issues.listComments({ + ...context.repo, issue_number + }); + const existing = comments.find(comment => comment.body?.includes(marker)); + if (existing) { + await github.rest.issues.updateComment({ + ...context.repo, comment_id: existing.id, body + }); + } else { + await github.rest.issues.createComment({ + ...context.repo, issue_number, body + }); + } diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index fb0ba70bd..d8bb5a9b6 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -13,13 +13,13 @@ jobs: contents: read deployments: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: ./.github/actions/setup-bun - run: bun run --filter @open-pencil/docs build - - uses: cloudflare/wrangler-action@v3 + - uses: cloudflare/wrangler-action@v4 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} diff --git a/.github/workflows/heavy-tests.yml b/.github/workflows/heavy-tests.yml index b56063d8e..7ad7ccfae 100644 --- a/.github/workflows/heavy-tests.yml +++ b/.github/workflows/heavy-tests.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: ./.github/actions/setup-bun with: diff --git a/.github/workflows/pr-review-guidance.yml b/.github/workflows/pr-review-guidance.yml index 9d7a130bd..a6cdb4f51 100644 --- a/.github/workflows/pr-review-guidance.yml +++ b/.github/workflows/pr-review-guidance.yml @@ -20,13 +20,13 @@ jobs: pull-requests: read steps: - name: Check out trusted workflow scripts - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: ref: ${{ github.event.repository.default_branch }} persist-credentials: false - name: Set up Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 with: node-version: 24 diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index 108fc2836..4aff9f1e7 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -1,7 +1,7 @@ name: Preview on: - pull_request_target: + pull_request: branches: [master] paths-ignore: - 'packages/docs/**' @@ -12,20 +12,14 @@ concurrency: group: preview-${{ github.event.pull_request.number }} cancel-in-progress: true +permissions: + contents: read + jobs: preview: runs-on: ubuntu-latest - permissions: - contents: read - deployments: write - pull-requests: write - environment: - name: preview - url: ${{ steps.deploy.outputs.deployment-url }} steps: - - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.sha }} + - uses: actions/checkout@v7 - uses: ./.github/actions/setup-bun @@ -34,30 +28,10 @@ jobs: - run: bun run build - - uses: cloudflare/wrangler-action@v3 - id: deploy + - name: Upload preview artifact + uses: actions/upload-artifact@v7 with: - apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} - accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} - command: pages deploy dist --project-name=openpencil-app --branch=${{ github.event.pull_request.head.ref }} - - - name: Comment preview URL - uses: actions/github-script@v7 - with: - script: | - const url = '${{ steps.deploy.outputs.deployment-url }}'; - const marker = ''; - const body = `${marker}\nšŸ”— Preview: ${url}`; - const { data: comments } = await github.rest.issues.listComments({ - ...context.repo, issue_number: context.issue.number - }); - const existing = comments.find(c => c.body.includes(marker)); - if (existing) { - await github.rest.issues.updateComment({ - ...context.repo, comment_id: existing.id, body - }); - } else { - await github.rest.issues.createComment({ - ...context.repo, issue_number: context.issue.number, body - }); - } + name: preview-dist + path: dist + if-no-files-found: error + retention-days: 1