chore(frontend): fix release workflow (#87)

* chore(frontend): fix git commit command

* chore(frontend): temporary fix to check if it works

* chore(frontend): add logging for bump script

* chore(frontend): fix git push command

* chore(frontend): force git push

* chore(frontend): give up on pushing to a protected branch

* chore(frontend): try an API request to override branch protection

* chore(frontend): use another approach for branch protection disabling

* chore(frontend): update git push script

* chore(frontend): stop using BRANCH env variable to avoid injection vulnerability

* chore(frontend): move bumping to a bash script

* chore(frontend): fix sed call

* chore(frontend): remove unnecessary package

.github/workflows/frontend-release.yml

@@ -34,14 +34,11 @@ jobs:
         env:
           CI: true
       - name: Bump New Version
-        run: |
-          npm run bump -- -v ${{ github.event.release.tag_name }}
-          git commit -m "chore(release): ${{ github.event.release.tag_name }}"
-          git push
+        run: sh scripts/bump.sh
         env:
-          GIT_AUTHOR_NAME: Vaadin Bot
-          GIT_AUTHOR_EMAIL: [email protected]
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          REPO: ${{ github.repository }}
+          VERSION_TAG: ${{ github.event.release.tag_name }}
       - name: Publish
         run: npm run publish
         env:

frontend/package.json

@@ -15,7 +15,6 @@
     "check": "concurrently npm:lint npm:typecheck",
     "bootstrap": "lerna bootstrap",
     "build": "lerna run build --include-dependencies",
-    "bump": "node scripts/bump.js",
     "lint": "lerna run lint",
     "postinstall": "npm run bootstrap",
     "publish": "node scripts/dummy-publish-tmp.js",

frontend/scripts/bump.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+alias ghr="curl https://api.github.com/repos/$REPO/branches/main/protection \
+  -H 'Accept: application/vnd.github.v3+json' \
+  -H 'Authorization: token $GITHUB_TOKEN'"
+
+node scripts/update-package-versions.js "$VERSION_TAG"
+
+git add --all
+
+git \
+  -c user.name='Vaadin Bot' \
+  -c user.email='[email protected]' \
+  commit -m "chore(release): $VERSION_TAG"
+
+protection_config=$(ghr -X GET)
+
+remapped=$(node scripts/protection-remap.js "$protection_config")
+
+ghr -X PUT -d "$(echo "$remapped" | sed '$s/"enforce_admins":true/"enforce_admins":false/')"
+
+git push origin HEAD:main
+
+ghr -X PUT -d "$remapped"

frontend/scripts/protection-remap.js

@@ -0,0 +1,47 @@
+/* eslint-disable import/no-extraneous-dependencies,camelcase */
+import meow from 'meow';
+
+const {
+  input: [response],
+} = meow({ importMeta: import.meta });
+
+const {
+  required_status_checks,
+  enforce_admins,
+  required_pull_request_reviews,
+  restrictions,
+  required_linear_history,
+  allow_force_pushes,
+  allow_deletions,
+  required_conversation_resolution,
+} = JSON.parse(response);
+
+const remapped = {
+  required_status_checks: required_status_checks
+    ? {
+        strict: required_status_checks.strict,
+        contexts: required_status_checks.contexts,
+      }
+    : null,
+  enforce_admins: enforce_admins?.enabled ?? null,
+  required_pull_request_reviews: required_pull_request_reviews
+    ? {
+        dismissal_restrictions: required_pull_request_reviews.dismissal_restrictions
+          ? {
+              users: required_pull_request_reviews.dismissal_restrictions.users.map(({ login }) => login),
+              teams: required_pull_request_reviews.dismissal_restrictions.teams.map(({ slug }) => slug),
+            }
+          : {},
+        dismiss_stale_reviews: required_pull_request_reviews.dismiss_stale_reviews,
+        require_code_owner_reviews: required_pull_request_reviews.require_code_owner_reviews,
+        required_approving_review_count: required_pull_request_reviews.required_approving_review_count,
+      }
+    : null,
+  restrictions: restrictions?.enabled ?? null,
+  required_linear_history: required_linear_history?.enabled ?? false,
+  allow_force_pushes: allow_force_pushes?.enabled ?? null,
+  allow_deletions: allow_deletions?.enabled ?? false,
+  required_conversation_resolution: required_conversation_resolution?.enabled ?? false,
+};
+
+process.stdout.write(JSON.stringify(remapped));

frontend/scripts/bump.js → frontend/scripts/update-package-versions.js

@@ -1,20 +1,16 @@
-/* eslint-disable import/no-extraneous-dependencies */
+/* eslint-disable import/no-extraneous-dependencies,no-console */
 import { readdir, readFile, writeFile } from 'fs/promises';
 import meow from 'meow';
 import { dirname, resolve } from 'path';
 import { fileURLToPath } from 'url';
 
+function log(message) {
+  console.log(`[${new Date().toISOString()}][info]: ${message}`);
+}
+
 const {
-  flags: { version },
-} = meow({
-  importMeta: import.meta,
-  flags: {
-    version: {
-      type: 'string',
-      alias: 'v',
-    },
-  },
-});
+  input: [version],
+} = meow({ importMeta: import.meta });
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -28,6 +24,8 @@ async function updateLernaConfig() {
   };
 
   await writeFile(lernaConfigFile, JSON.stringify(config, null, 2), 'utf8');
+
+  log('lerna.json updated');
 }
 
 async function updatePackageRegistrations() {
@@ -42,6 +40,8 @@ async function updatePackageRegistrations() {
       const content = await readFile(indexFile, 'utf8');
       const updated = content.replace(versionPattern, `version: /* updated-by-script */ '${version}',`);
       await writeFile(indexFile, updated, 'utf8');
+
+      log(`@vaadin/${_package} registration updated`);
     })
   );
 }