ci: 3687 update ci workflows for best practices and standards (#3688)

* Updated dependabot and publish files. Started other workflows Signed-off-by: Roger Barker <roger.barker@swirldslabs.com> * Updated main.yml Signed-off-by: Roger Barker <roger.barker@swirldslabs.com> * updated the workflows Signed-off-by: Roger Barker <roger.barker@swirldslabs.com> * Added setup-yarn action Signed-off-by: Roger Barker <roger.barker@swirldslabs.com> * Updated yarn install process Signed-off-by: Roger Barker <roger.barker@swirldslabs.com> * Updated Borales/setup-yarn command to include cmd: install Signed-off-by: Roger Barker <roger.barker@swirldslabs.com> --------- Signed-off-by: Roger Barker <roger.barker@swirldslabs.com>
hashgraph · Jun 7, 2024 · a5b8e31 · a5b8e31
1 parent 1f01aba
commit a5b8e31
Show file tree

Hide file tree

Showing 6 changed files with 161 additions and 65 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,5 +1,10 @@
 version: 2
 updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
   - package-ecosystem: npm
     directory: "/"
     schedule:

diff --git a/.github/workflows/add-documentation-to-repo.yaml b/.github/workflows/add-documentation-to-repo.yaml
@@ -9,31 +9,51 @@ on:
 
 jobs:
   runService:
-    runs-on: ubuntu-latest
+    name: Run Service
+    runs-on: [self-hosted, Linux, medium, ephemeral]
     strategy:
       matrix:
         node-version: [ 20.x ]
         mongodb-version: [ 7.0.5 ]
     steps:
-      - uses: actions/checkout@v1
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout Code
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 #v4.0.2
         with:
           node-version: ${{ matrix.node-version }}
+
+      - name: Setup Yarn
+        uses: Borales/actions-yarn@3766bb1335b98fb13c60eaf358fe20811b730a88 # v5.0.0
+        with:
+          cmd: install
+
+      - name: Install dependencies
+        run: yarn install
+
       - name: Start NatsMQ
-        uses: onichandame/nats-action@master
+        uses: onichandame/nats-action@a8144f9009c5f67c39edd6a50f9de659c44bd135 # v0.0.0
         with:
           port: "4222"
+
       - name: Config Repo
         run: |
           git config --global user.name "envision-ci-agent"
           git config --global user.email "envision-ci-agent@users.noreply.github.com"
           git remote set-url origin https://x-access-token:${{ secrets.DOC_UPDATE_API_KEY }}@github.com/$GITHUB_REPOSITORY
           git checkout "${GITHUB_REF:11}"
+
       - name: Start MongoDB
-        uses: supercharge/mongodb-github-action@1.7.0
+        uses: supercharge/mongodb-github-action@5a87bd81f88e2a8b195f8b7b656f5cda1350815a # v1.11.0
         with:
           mongodb-version: ${{ matrix.mongodb-version }}
+
       - name: Build
         run: |
           yarn
@@ -51,6 +71,7 @@ jobs:
           popd
         env:
           CI: true
+
       - name: Run service
         run: |
           pushd api-gateway
@@ -60,6 +81,7 @@ jobs:
           yarn start &
           popd
           sleep 30
+
       - name: Download file
         run: |
           rm -fv swagger.yaml

diff --git a/.github/workflows/api-manual.yml b/.github/workflows/api-manual.yml
@@ -5,7 +5,8 @@ on:
 
 jobs:
     buildAndTest:
-        runs-on: ubuntu-latest
+        name: Build and Test (Manual)
+        runs-on: [self-hosted, Linux, medium, ephemeral]
         services:
             ipfs-node:
                 image: ipfs/kubo:latest
@@ -21,13 +22,27 @@ jobs:
                 node-version: [ 20.x ]
                 mongodb-version: [ 7.0.5 ]
         steps:
-            - uses: actions/checkout@v1
+            - name: Harden Runner
+              uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+              with:
+                  egress-policy: audit
+
+            - name: Checkout Code
+              uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
             - name: Use Node.js ${{ matrix.node-version }}
-              uses: actions/setup-node@v1
+              uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 #v4.0.2
               with:
                   node-version: ${{ matrix.node-version }}
+
+            - name: Setup Yarn
+              uses: Borales/actions-yarn@3766bb1335b98fb13c60eaf358fe20811b730a88 # v5.0.0
+              with:
+                  cmd: install
+
             - name: Install dependencies
-              run: yarn
+              run: yarn install
+
             - name: Build packages
               run: |
                   pushd interfaces
@@ -57,14 +72,17 @@ jobs:
                   pushd api-gateway
                   yarn run build
                   popd
+
             - name: Start NatsMQ
-              uses: onichandame/nats-action@master
+              uses: onichandame/nats-action@a8144f9009c5f67c39edd6a50f9de659c44bd135 # v0.0.0
               with:
                   port: "4222"
+
             - name: Start MongoDB
-              uses: supercharge/mongodb-github-action@1.7.0
+              uses: supercharge/mongodb-github-action@5a87bd81f88e2a8b195f8b7b656f5cda1350815a # v1.11.0
               with:
                   mongodb-version: ${{ matrix.mongodb-version }}
+
             - name: Run Guardian
               run: |
                   pushd notification-service
@@ -110,8 +128,9 @@ jobs:
                   npm install --force
                   npx cypress run --env "portApi=3002,operatorId=${{ secrets.CI_HEDERA_ACCOUNT }},operatorKey=${{ secrets.CI_HEDERA_PRIV_KEY }}" --spec cypress/e2e/api-tests/**/*.cy.js            
                   popd
+
             - name: Publish API Test Results
-              uses: EnricoMi/publish-unit-test-result-action@v1
+              uses: EnricoMi/publish-unit-test-result-action@30eadd5010312f995f0d3b3cff7fe2984f69409e # v2.16.1
               if: always()
               with:
                   files: e2e-tests/cypress/test_results/**/*.xml
diff --git a/.github/workflows/api.yml b/.github/workflows/api.yml
@@ -5,7 +5,8 @@ on:
 
 jobs:
     buildAndTest:
-        runs-on: ubuntu-latest
+        name: Build and Test
+        runs-on: [self-hosted, Linux, medium, ephemeral]
         services:
             ipfs-node:
                 image: ipfs/kubo:latest
@@ -21,15 +22,29 @@ jobs:
                 node-version: [ 20.x ]
                 mongodb-version: [ 7.0.5 ]
         steps:
-            - uses: actions/checkout@v1
+            - name: Harden Runner
+              uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+              with:
+                  egress-policy: audit
+
+            - name: Checkout Code
+              uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
               with:
                   ref: 'develop'
+
             - name: Use Node.js ${{ matrix.node-version }}
-              uses: actions/setup-node@v1
+              uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 #v4.0.2
               with:
                   node-version: ${{ matrix.node-version }}
+
+            - name: Setup Yarn
+              uses: Borales/actions-yarn@3766bb1335b98fb13c60eaf358fe20811b730a88 # v5.0.0
+              with:
+                cmd: install
+
             - name: Install dependencies
-              run: yarn
+              run: yarn install
+
             - name: Build packages
               run: |
                   pushd interfaces
@@ -59,14 +74,17 @@ jobs:
                   pushd api-gateway
                   yarn run build
                   popd
+
             - name: Start NatsMQ
-              uses: onichandame/nats-action@master
+              uses: onichandame/nats-action@a8144f9009c5f67c39edd6a50f9de659c44bd135 # v0.0.0
               with:
                   port: "4222"
+
             - name: Start MongoDB
-              uses: supercharge/mongodb-github-action@1.7.0
+              uses: supercharge/mongodb-github-action@5a87bd81f88e2a8b195f8b7b656f5cda1350815a # v1.11.0
               with:
                   mongodb-version: ${{ matrix.mongodb-version }}
+
             - name: Run Guardian
               run: |
                   pushd notification-service
@@ -112,8 +130,9 @@ jobs:
                   npm install --force
                   npx cypress run --env "portApi=3002,operatorId=${{ secrets.CI_HEDERA_ACCOUNT }},operatorKey=${{ secrets.CI_HEDERA_PRIV_KEY }}" --spec cypress/e2e/api-tests/**/*.cy.js            
                   popd
+
             - name: Publish API Test Results
-              uses: EnricoMi/publish-unit-test-result-action@v1
+              uses: EnricoMi/publish-unit-test-result-action@30eadd5010312f995f0d3b3cff7fe2984f69409e # v2.16.1
               if: always()
               with:
                   files: e2e-tests/cypress/test_results/**/*.xml
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -7,16 +7,33 @@ on:
       - 'dependabot/**'
 jobs:
   buildAndTest:
-    runs-on: ubuntu-latest
+    name: Build and Test (Manual - Main)
+    runs-on: [self-hosted, Linux, medium, ephemeral]
     strategy:
       matrix:
         node-version: [ 20.10.0 ]
     steps:
-      - uses: actions/checkout@v1
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout Code
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: ${{ matrix.node-version }}
+
+      - name: Setup Yarn
+        uses: Borales/actions-yarn@3766bb1335b98fb13c60eaf358fe20811b730a88 # v5.0.0
+        with:
+          cmd: install
+
+      - name: Install dependencies
+        run: yarn install
+
       - name: Build
         run: |
           yarn
@@ -56,12 +73,14 @@ jobs:
         env:
           CI: true
           NODE_OPTIONS: --openssl-legacy-provider
+
       - name: Detect secrets
         run: |
           yarn run detect-secrets
         env:
           CI: true
           NODE_OPTIONS: --openssl-legacy-provider
+
       - name: Lint
         run: |
           pushd interfaces
@@ -94,6 +113,7 @@ jobs:
         env:
           CI: true
           NODE_OPTIONS: --openssl-legacy-provider
+
       - name: Test
         run: |
           pushd common
@@ -110,8 +130,9 @@ jobs:
           NODE_OPTIONS: --openssl-legacy-provider
           OPERATOR_ID: ${{ secrets.CI_HEDERA_ACCOUNT }}
           OPERATOR_KEY: ${{ secrets.CI_HEDERA_PRIV_KEY }}
+
       - name: Publish Unit Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v1
+        uses: EnricoMi/publish-unit-test-result-action@30eadd5010312f995f0d3b3cff7fe2984f69409e # v2.16.1
         if: always()
         with:
           files: test_results/**/*.xml