Merge pull request #189 from Software-Hardware-Integration-Lab/lab-26… #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Display Name of the workflow | |
| name: Build - GH Packages and Artifacts | |
| # Event listeners for when the job should start execution | |
| on: | |
| # Triggers the workflow on push or pull request events to the main branch | |
| push: | |
| branches: [main] | |
| # Allow this workflow to be called from another workflow | |
| workflow_call: | |
| inputs: | |
| correlationId: | |
| description: 'Correlates the origin job with the child instance since process start does not return an ID.' | |
| type: string | |
| required: false | |
| jobs: | |
| # Generate the TypeScript SDK client code | |
| TypeScript-Build: | |
| # Generate each SDK client in a separate build process to speed up execution and publishing | |
| strategy: | |
| matrix: | |
| # Spec and SDK root locations | |
| specifications: | |
| - name: SHIELD | |
| sdkPath: 'src/shield/TypeScript' | |
| specPath: 'spec/SHIELD.json' | |
| - name: DataGateway | |
| sdkPath: 'src/dataGateway/TypeScript' | |
| specPath: 'spec/Data-Gateway.json' | |
| - name: UrlShortener | |
| sdkPath: 'src/urlShortener/TypeScript' | |
| specPath: 'spec/Url-Shortener.json' | |
| # Display name of the job | |
| name: Generate NPM Packages | |
| # Operating system filter for the runners | |
| runs-on: ubuntu-latest | |
| # Allow single failures for SDK publish, e.g. SDG fail due to not getting an update but SHIELD goes through | |
| continue-on-error: true | |
| # Sets the scopes available to the github_token injected to the GH Actions runner | |
| permissions: | |
| attestations: write | |
| contents: read | |
| id-token: write | |
| packages: write | |
| # Set of steps required to generate the API client for TypeScript | |
| steps: | |
| # Download all of the source code | |
| - name: Clone Repo Locally | |
| uses: actions/checkout@v7 | |
| background: true | |
| # Set up NodeJS on the build host | |
| - name: Setup Node.JS Runtime | |
| uses: actions/setup-node@v6 | |
| background: true | |
| with: | |
| node-version: 24 | |
| registry-url: https://npm.pkg.github.com | |
| scope: software-hardware-integration-lab | |
| # Set up the socket firewall binary | |
| - name: Install - Socket Firewall | |
| uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f | |
| background: true | |
| with: | |
| mode: firewall-free | |
| # Set up all of the supporting components for SDK generation | |
| - name: Initialize Kiota Binaries | |
| uses: microsoft/setup-kiota@v0.5.0 | |
| background: true | |
| # Bring job back to sync execution by awaiting for all async jobs to finish before continuing | |
| - name: Steps - Convert Back To Synchronous Execution - Build | |
| wait-all: true | |
| # Extract the project version from the package.json | |
| - name: Extract Project Version | |
| id: computedVersion | |
| background: true | |
| working-directory: ${{ matrix.specifications.sdkPath }} | |
| run: echo "version=$(npm pkg get version --workspaces=false | tr -d \")" >> "$GITHUB_OUTPUT" | |
| # Set the experimental tag to indicate if it is an Alpha or Beta build | |
| - name: Compute Channel | |
| id: computedChannel | |
| background: true | |
| run: | | |
| if [ "${{ github.event_name }}" = "release" ] && [ "${{ github.event.release.prerelease }}" = "true" ]; then | |
| echo "channel=beta" >> "$GITHUB_OUTPUT" | |
| elif [ "${{ github.event_name }}" = "release" ]; then | |
| echo "channel=stable" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "channel=alpha" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Get the first 7 chars of the SHA hash that represents the current commit that the build is operating off of. | |
| - name: Compute Short SHA - Experimental Channel | |
| id: shortSha | |
| background: true | |
| run: echo "shortSha=$(echo ${{ github.sha }} | head -c 7)" >> "$GITHUB_OUTPUT" | |
| # Bring job back to sync execution by awaiting for all async jobs to finish before continuing | |
| - name: Steps - Convert Back To Synchronous Execution - Metadata | |
| wait-all: true | |
| # Update the NPM CLI to the latest available version | |
| - name: Update NPM CLI | |
| run: sfw npm install -g npm | |
| # Install the dependencies needed to build the project | |
| - name: Install Build Dependencies | |
| run: sfw npm ci | |
| working-directory: ${{ matrix.specifications.sdkPath }} | |
| # Cryptographically attest that packages haven't been tampered where supported | |
| - name: Attest Dependency Provenance | |
| run: npm audit signatures | |
| working-directory: ${{ matrix.specifications.sdkPath }} | |
| # Generate the TypeScript SDK | |
| - name: Generate SDK Client Code via Kiota | |
| run: npm run generate:Sdk | |
| working-directory: ${{ matrix.specifications.sdkPath }} | |
| # Generate the TypeScript SDK | |
| - name: Build Project | |
| run: npm run build:Prod | |
| working-directory: ${{ matrix.specifications.sdkPath }} | |
| # Update the version of SHIELD being uploaded to have a different version number to avoid SDG version conflict | |
| - name: Tattoo Version - Experimental Channel | |
| if: ${{ steps.computedChannel.outputs.channel != 'stable' }} | |
| working-directory: ${{ matrix.specifications.sdkPath }} | |
| run: npm version --no-commit-hooks --no-git-tag-version "${{ steps.computedVersion.outputs.version }}-${{ steps.computedChannel.outputs.channel }}.${{ steps.shortSha.outputs.shortSha }}" | |
| # Publish the artifact to NPM with attestation | |
| - name: Upload Package to NPM Registry | |
| working-directory: ${{ matrix.specifications.sdkPath }} | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: npm publish --tag ${{ steps.computedChannel.outputs.channel }} | |
| # Generate the NPM package for beta and stable publishing, if required | |
| - name: Generate NPM Package | |
| id: generate-package | |
| working-directory: ${{ matrix.specifications.sdkPath }} | |
| run: echo "package-file=$(npm pack --ignore-scripts)" >> "$GITHUB_OUTPUT" | |
| # Create an attestation for the generated NPM package to ensure integrity and authenticity | |
| - name: Attest NPM Package | |
| uses: actions/attest@v4 | |
| with: | |
| subject-path: ${{ format('{0}/{1}', matrix.specifications.sdkPath, steps.generate-package.outputs.package-file) }} | |
| # Upload the compiled HTML as an artifact for future consumption | |
| - name: Upload a Build Artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: ${{ matrix.specifications.name }} | |
| if-no-files-found: error | |
| path: ${{ matrix.specifications.sdkPath }}/${{ steps.generate-package.outputs.package-file }} |