ci: move build workflow secrets to AWS (#274) (#275) #263
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - develop | |
| - main | |
| workflow_dispatch: | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| permissions: write-all | |
| steps: | |
| - name: Checkout | |
| uses: RDXWorks-actions/checkout@main | |
| with: | |
| fetch-depth: 0 | |
| - name: Use Node.js | |
| uses: RDXWorks-actions/setup-node@main | |
| with: | |
| node-version: '18.12.0' | |
| - name: Install dependencies | |
| run: npm pkg delete scripts.prepare && npm ci | |
| - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main | |
| with: | |
| role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-connector-extension-secrets-read-access' | |
| app_name: 'connector-extension' | |
| step_name: 'connector-extension-webchrome-store-secrets' | |
| secret_prefix: 'GH' | |
| secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/radixdlt/connector_extension/webchrome_store_secrets' | |
| parse_json: true | |
| - name: Github PreRelease | |
| if: github.ref == 'refs/heads/develop' | |
| env: | |
| VITE_GITHUB_REF_NAME: ${{ github.ref_name }} | |
| GITHUB_TOKEN: ${{ env.GH_SEMANTIC_RELEASE_TOKEN }} | |
| GOOGLE_CLIENT_ID: ${{ env.GH_CLIENT_ID }} | |
| GOOGLE_CLIENT_SECRET: ${{ env.GH_CLIENT_SECRET }} | |
| GOOGLE_REFRESH_TOKEN: ${{ env.GH_REFRESH_TOKEN }} | |
| GOOGLE_EXTENSION_ID: ${{ env.GH_BETA_EXTENSION_ID }} | |
| TARGET_RELEASE: default | |
| run: | | |
| sed -i "s/ name:.*/ name: 'Radix Wallet Connector - BETA',/" vite.config.ts | |
| sed -i -E '/^ *description:.*$/ {N; s/.*/ description: '"'"'THIS EXTENSION IS FOR BETA TESTING'"'"',/}' vite.config.ts | |
| sed -i "s/\${EXTENSION_ID}/$GOOGLE_EXTENSION_ID/g" release.config.cjs | |
| sed -i "s/\${TARGET}/$TARGET_RELEASE/g" release.config.cjs | |
| npx semantic-release --verifyConditions | tee out | |
| echo "RELEASE_VERSION=$(grep 'Created tag ' out | awk -F 'Created tag ' '{print $2}')" >> $GITHUB_ENV | |
| - name: Github Release & Upload to webstore | |
| if: github.ref == 'refs/heads/main' | |
| env: | |
| VITE_GITHUB_REF_NAME: ${{ github.ref_name }} | |
| GITHUB_TOKEN: ${{ env.GH_SEMANTIC_RELEASE_TOKEN }} | |
| GOOGLE_CLIENT_ID: ${{ env.GH_CLIENT_ID }} | |
| GOOGLE_CLIENT_SECRET: ${{ env.GH_CLIENT_SECRET }} | |
| GOOGLE_REFRESH_TOKEN: ${{ env.GH_REFRESH_TOKEN }} | |
| GOOGLE_EXTENSION_ID: ${{ env.GH_EXTENSION_ID }} | |
| TARGET_RELEASE: draft | |
| run: | | |
| sed -i "s/\${EXTENSION_ID}/$GOOGLE_EXTENSION_ID/g" release.config.cjs | |
| sed -i "s/\${TARGET}/$TARGET_RELEASE/g" release.config.cjs | |
| npx semantic-release --verifyConditions | tee out | |
| echo "RELEASE_VERSION=$(grep 'Created tag ' out | awk -F 'Created tag ' '{print $2}')" >> $GITHUB_ENV | |
| # Snyk SBOM | |
| - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main | |
| with: | |
| role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' | |
| app_name: 'connector-extension' | |
| step_name: 'snyk-sbom' | |
| secret_prefix: 'SNYK' | |
| secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX' | |
| parse_json: true | |
| - name: Generate SBOM | |
| uses: RDXWorks-actions/snyk-actions/node@master | |
| with: | |
| args: --all-projects --org=${{ env.SNYK_PROJECTS_ORG_ID }} --format=cyclonedx1.4+json > sbom.json | |
| command: sbom | |
| - name: Upload SBOM | |
| uses: RDXWorks-actions/upload-release-assets@c94805dc72e4b20745f543da0f62eaee7722df7a | |
| with: | |
| files: sbom.json | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| release-tag: ${{ env.RELEASE_VERSION }} |