Contributor backend 31 (#165)

* fix: backend workflow

* frontend

* remove environment

* no need to validate PR refs

* test

* undo tmp changes

* build

Co-Authored-By: --global <--global>

.github/workflows/backend.yaml

@@ -19,15 +19,15 @@ on:
         type: string
         required: false
         default: "db"
-    secrets:
+    secrets: # All secrets should not be required to support contributors.
       CODECOV_TOKEN:
         description: "The token used to gain access to Codecov."
         required: false
+      CFL_BOT_GH_TOKEN:
+        description: "The CFL-bot's GitHub token. Used to release."
+        required: false
 
 jobs:
-  validate-pr-refs:
-    uses: ocadotechnology/codeforlife-workspace/.github/workflows/validate-pull-request-refs.yaml@main
-
   test:
     uses: ocadotechnology/codeforlife-workspace/.github/workflows/test-python-code.yaml@main
     secrets: inherit
@@ -36,26 +36,17 @@ jobs:
       source-path: ${{ inputs.source-path }}
       postgres-db: ${{ inputs.postgres-db }}
 
-  deploy:
-    permissions:
-      id-token: "write" # TODO: separate build and deploy jobs and create reusable deploy workflow
+  build:
     runs-on: ubuntu-latest
-    needs: [validate-pr-refs, test]
-    # Deploy if:
-    #  - the previous jobs did not fail (see [needs]).
-    #  - the workflow was not cancelled.
+    needs: [test]
+    # Build if:
     #  - the repo's owner is Ocado Tech.
     #  - the repo is not the backend template.
-    #  - a change is made to an environment's branch.
+    #  - a change is made to the default branch.
     if: |
-      always() && !failure() && !cancelled() &&
       github.repository_owner_id == 2088731 &&
-      github.repository_id != 610204172 && (
-        github.ref_name == 'production' ||
-        github.ref_name == 'development' ||
-        github.ref_name == 'staging'
-      )
-    environment: ${{ github.ref_name }}
+      github.repository_id != 610204172 &&
+      github.ref_name == github.event.repository.default_branch
     steps:
       - name: 🐍 Set up Python ${{ inputs.python-version }} Environment
         uses: ocadotechnology/codeforlife-workspace/.github/actions/python/setup-environment@main
@@ -68,30 +59,15 @@ jobs:
       - name: 🏗️ Collect Static Files
         run: pipenv run python ./manage.py collectstatic --noinput --clear
 
-      - name: 🪪 Get Service Name
-        id: get-service-name
-        uses: ocadotechnology/codeforlife-workspace/.github/actions/gcloud/get-service-name@main
-        with:
-          suffix: -backend
-
-      # https://mikefarah.gitbook.io/yq/
-      # TODO: clean up app.yaml environment variables
-      - name: 🖊️ Configure App Deployment
-        uses: mikefarah/yq@master
+      - name: 📤 Upload Artifact
+        uses: actions/upload-artifact@v4
         with:
-          cmd: |
-            # Set runtime with convention "python{PY_VERSION}".
-            # The version must have the dot removed: "python3.12" -> "python312".
-            runtime=python${{ inputs.python-version }}
-            runtime=${runtime//.}
-
-            yq -i '
-              .runtime = "'$runtime'" |
-              .service = "${{ steps.get-service-name.outputs.fully-qualified-service-name }}" |
-              .env_variables.SERVICE_NAME = "${{ steps.get-service-name.outputs.service-name }}" |
-              .env_variables.SECRET_KEY = "${{ secrets.SECRET_KEY }}" |
-              .env_variables.MODULE_NAME = "${{ github.ref_name }}"
-            ' app.yaml
+          name: build
+          path: |
+            requirements.txt
+            static/
 
-      - name: 🚀 Deploy App on GCloud
-        uses: ocadotechnology/codeforlife-workspace/.github/actions/gcloud/deploy-app@main
+  release:
+    needs: [build]
+    uses: ocadotechnology/codeforlife-workspace/.github/workflows/release.yaml@main
+    secrets: inherit

.github/workflows/frontend.yaml

@@ -8,66 +8,53 @@ on:
         type: number
         required: false
         default: 18
-    secrets:
+    secrets: # All secrets should not be required to support contributors.
       CODECOV_TOKEN:
         description: "The token used to gain access to Codecov."
         required: false
+      CFL_BOT_GH_TOKEN:
+        description: "The CFL-bot's GitHub token. Used to release."
+        required: false
 
 jobs:
-  validate-pr-refs:
-    uses: ocadotechnology/codeforlife-workspace/.github/workflows/validate-pull-request-refs.yaml@main
-
   test:
     uses: ocadotechnology/codeforlife-workspace/.github/workflows/test-javascript-code.yaml@main
     secrets: inherit
     with:
       node-version: ${{ inputs.node-version }}
 
-  deploy:
-    permissions:
-      id-token: "write" # TODO: separate build and deploy jobs and create reusable deploy workflow
+  build:
     runs-on: ubuntu-latest
-    needs: [validate-pr-refs, test]
-    # Deploy if:
-    #  - the previous jobs did not fail (see [needs]).
-    #  - the workflow was not cancelled.
+    needs: [test]
+    # Build if:
     #  - the repo's owner is Ocado Tech.
     #  - the repo is not the frontend template.
-    #  - a change is made to an environment's branch.
+    #  - a change is made to the default branch.
     if: |
-      always() && !failure() && !cancelled() &&
       github.repository_owner_id == 2088731 &&
-      github.repository_id != 841979065 && (
-        github.ref_name == 'production' ||
-        github.ref_name == 'development' ||
-        github.ref_name == 'staging'
-      )
-    environment: ${{ github.ref_name }}
+      github.repository_id != 841979065 &&
+      github.ref_name == github.event.repository.default_branch
+    # TODO: handle build and release for multiple environments.
+    # environment: ${{ github.ref_name }}
     steps:
       - name: 🌐 Set up JavaScript ${{ inputs.node-version }} Environment
         uses: ocadotechnology/codeforlife-workspace/.github/actions/javascript/setup-environment@main
         with:
           node-version: ${{ inputs.node-version }}
-          install-args: --production=false
+          install-args: --production=true
 
       - name: 🏗️ Build App
         run: yarn build
 
-      - name: 🪪 Get Service Name
-        id: get-service-name
-        uses: ocadotechnology/codeforlife-workspace/.github/actions/gcloud/get-service-name@main
-        with:
-          suffix: -frontend
-
-      # https://mikefarah.gitbook.io/yq/
-      - name: 🖊️ Configure App Deployment
-        uses: mikefarah/yq@master
+      - name: 📤 Upload Artifact
+        uses: actions/upload-artifact@v4
         with:
-          cmd: |
-            yq -i '
-              .runtime = "nodejs${{ inputs.node-version }}" |
-              .service = "${{ steps.get-service-name.outputs.fully-qualified-service-name }}"
-            ' app.yaml
-
-      - name: 🚀 Deploy App on GCloud
-        uses: ocadotechnology/codeforlife-workspace/.github/actions/gcloud/deploy-app@main
+          name: build
+          path: |
+            node_modules/
+            dist/
+
+  release:
+    needs: [build]
+    uses: ocadotechnology/codeforlife-workspace/.github/workflows/release.yaml@main
+    secrets: inherit

.github/workflows/release.yaml

@@ -0,0 +1,59 @@
+name: Release
+
+on:
+  workflow_call:
+    inputs:
+      artifact-name:
+        description: "The name of the artifact."
+        type: string
+        required: false
+        default: "build"
+    secrets:
+      CFL_BOT_GH_TOKEN:
+        description: "The CFL-bot's GitHub token. Used to release."
+        required: true
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    # Release if:
+    #  - the repo's owner is Ocado Tech.
+    #  - a change is made to the default branch.
+    if: |
+      github.repository_owner_id == 2088731 &&
+      github.ref_name == github.event.repository.default_branch
+    env:
+      NODE_VERSION: 22
+    steps:
+      - name: 🛫 Checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.CFL_BOT_GH_TOKEN }}
+          fetch-depth: 0
+
+      - name: 📥 Download Artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ inputs.artifact-name }}
+
+      - name: 🌐 Set up Node ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: 🛠 Install Dependencies
+        run: |
+          npm install --global npm
+          npm install --global \
+            semantic-release@^20.1.1 \
+            @semantic-release/git@^10.0.1 \
+            @semantic-release/changelog@^6.0.2
+
+      - name: 🚀 Publish Semantic Release
+        env:
+          GH_TOKEN: ${{ secrets.CFL_BOT_GH_TOKEN }}
+          GIT_AUTHOR_NAME: cfl-bot
+          GIT_AUTHOR_EMAIL: [email protected]
+          GIT_COMMITTER_NAME: cfl-bot
+          GIT_COMMITTER_EMAIL: [email protected]
+        run: npx semantic-release