ci: New CI/CD process

klerick · klerick · commit 3ac537eeda07 · 2025-03-06T11:37:34.000+01:00
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -30,24 +30,23 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions
 
-      - name: Determine base branch for NX affected
-        id: set-base
+      - name: Determine base for NX affected (if not master)
+        if: ${{ inputs.mainBranch != 'master' }}
         shell: bash
         run: |
-          if [ "${{ github.event.inputs.mainBranch }}" = "master" ]; then
-            echo "base=master" >> $GITHUB_OUTPUT
-            echo "Using base branch 'master'"
-          else
-            LAST_TAG=$(git describe --tags --abbrev=0)
-            LAST_TAG_HASH=$(git rev-parse "$LAST_TAG")
-            echo "base=$LAST_TAG_HASH" >> $GITHUB_OUTPUT
-            echo "Using last tag hash: $LAST_TAG_HASH"
-          fi
+          LAST_TAG=$(git describe --tags --abbrev=0)
+          LAST_TAG_HASH=$(git rev-parse "$LAST_TAG")
+          CURRENT_COMMIT=$(git rev-parse HEAD)
+          echo "Using last tag hash as NX_BASE: $LAST_TAG_HASH"
+          echo "Using current commit as NX_HEAD: $CURRENT_COMMIT"
+          echo "NX_BASE=$LAST_TAG_HASH" >> $GITHUB_ENV
+          echo "NX_HEAD=$CURRENT_COMMIT" >> $GITHUB_ENV
 
-      - name: Derive appropriate SHAs for base and head for `nx affected` commands
+      - name: Determine base for NX affected (if master)
+        if: ${{ inputs.mainBranch == 'master' }}
         uses: nrwl/nx-set-shas@v4
         with:
-          main-branch-name: ${{ steps.set-base.outputs.base }}
+          main-branch-name: ${{ inputs.mainBranch }}
 
       - name: Build Libraries
         run: npx nx affected --target=build --parallel=3  --exclude='*,!tag:type:publish'
diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
@@ -22,6 +22,19 @@ on:
         required: false
         type: boolean
         default: false
+    secrets:
+      NODE_AUTH_TOKEN:
+        required: true
+      GITHUB_TOKEN_SECRET:
+        required: true
+      PAT:
+        required: true
+
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN_SECRET }}
+  NPM_CONFIG_PROVENANCE: true
+
 jobs:
   bump-version:
     runs-on: ubuntu-latest
@@ -37,9 +50,5 @@ jobs:
         run: |
           git config --global user.email "actions@github.com"
           git config --global user.name "GitHub Actions"
-          npx nx release --skip-publish --first-release=${{ github.event.inputs.first-release }} --projects=${{ github.event.inputs.projects }} --dry-run=${{ github.event.inputs.dry-run }}
+          npx nx release --skip-publish --first-release=${{ inputs.first-release }} --projects=${{ inputs.projects }} --dry-run=${{ inputs.dry-run }}
         shell: bash
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
diff --git a/.github/workflows/compute-projects.yml b/.github/workflows/compute-projects.yml
@@ -47,22 +47,21 @@ jobs:
 
       - name: Get projects by tag
         id: tag_projects
-        if: ${{ github.event.inputs.tagChoice != '' }}
+        if: ${{ inputs.tagChoice != '' }}
         shell: bash
         run: |
-          echo "Using tag: ${{ github.event.inputs.tagChoice }}"
-          projects=$(npx nx show projects --exclude="*,!${{ github.event.inputs.tagChoice }}" --sep=',')
+          echo "Using tag: ${{ inputs.tagChoice }}"
+          projects=$(npx nx show projects --exclude="*,!${{ inputs.tagChoice }}" --sep=',')
           echo "projects=$projects" >> $GITHUB_OUTPUT
           echo "Projects by tag: $projects"
 
-      # Если тег не выбран, собираем выбранные проекты через чекбоксы
-      - name: Collect projects from checkboxes
-        id: checkbox_projects
-        if: ${{ github.event.inputs.tagChoice == '' }}
+      - name: Collect projects from select
+        id: select_projects
+        if: ${{ inputs.tagChoice == '' }}
         shell: bash
         run: |
           final=""
-          for var in "${{ github.event.inputs.projectList1 }}" "${{ github.event.inputs.projectList2 }}" "${{ github.event.inputs.projectList3 }}"; do
+          for var in "${{ inputs.projectList1 }}" "${{ inputs.projectList2 }}" "${{ inputs.projectList3 }}"; do
             if [ ! -z "$var" ]; then
               if [ -z "$final" ]; then
                 final="$var"
@@ -83,10 +82,10 @@ jobs:
         id: final
         shell: bash
         run: |
-          if [ -n "${{ github.event.inputs.tagChoice }}" ]; then
+          if [ -n "${{ inputs.tagChoice }}" ]; then
             final="${{ steps.tag_projects.outputs.projects }}"
           else
-            final="${{ steps.checkbox_projects.outputs.selectProjects }}"
+            final="${{ steps.select_projects.outputs.selectProjects }}"
           fi
           final=$(echo "$final" | xargs)
           echo "finalProjects=$final" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
@@ -105,6 +105,8 @@ jobs:
       mainBranch: "last-tag"
     secrets:
       NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
+      GIST_SECRET: ${{ secrets.GIST_SECRET }}
+      GIST_ID: ${{ secrets.GIST_ID }}
 
   bump-version:
     needs: [build]
@@ -114,3 +116,7 @@ jobs:
       first-release: ${{ needs.compute-projects.outputs.first-release }}
       beta-release: ${{ needs.compute-projects.outputs.beta-release }}
       dry-run: ${{ needs.compute-projects.outputs.dry-run }}
+    secrets:
+      NPM_ACCESS_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
+      GITHUB_TOKEN_SECRET: ${{ secrets.GITHUB_TOKEN }}
+      PAT: ${{secrets.PAT}}
diff --git a/.github/workflows/e2e-test.yaml b/.github/workflows/e2e-test.yaml
@@ -38,24 +38,25 @@ jobs:
         uses: actions/checkout@v4
       - name: Setup Node.js
         uses: ./.github/actions
-      - name: Determine base branch for NX affected
-        id: set-base
+
+      - name: Determine base for NX affected (if not master)
+        if: ${{ inputs.mainBranch != 'master' }}
         shell: bash
         run: |
-          if [ "${{ github.event.inputs.mainBranch }}" = "master" ]; then
-            echo "base=master" >> $GITHUB_OUTPUT
-            echo "Using base branch 'master'"
-          else
-            LAST_TAG=$(git describe --tags --abbrev=0)
-            LAST_TAG_HASH=$(git rev-parse "$LAST_TAG")
-            echo "base=$LAST_TAG_HASH" >> $GITHUB_OUTPUT
-            echo "Using last tag hash: $LAST_TAG_HASH"
-          fi
-
-      - name: Derive appropriate SHAs for base and head for `nx affected` commands
+          LAST_TAG=$(git describe --tags --abbrev=0)
+          LAST_TAG_HASH=$(git rev-parse "$LAST_TAG")
+          CURRENT_COMMIT=$(git rev-parse HEAD)
+          echo "Using last tag hash as NX_BASE: $LAST_TAG_HASH"
+          echo "Using current commit as NX_HEAD: $CURRENT_COMMIT"
+          echo "NX_BASE=$LAST_TAG_HASH" >> $GITHUB_ENV
+          echo "NX_HEAD=$CURRENT_COMMIT" >> $GITHUB_ENV
+
+      - name: Determine base for NX affected (if master)
+        if: ${{ inputs.mainBranch == 'master' }}
         uses: nrwl/nx-set-shas@v4
         with:
-          main-branch-name: ${{ steps.set-base.outputs.base }}
+          main-branch-name: ${{ inputs.mainBranch }}
+
       - run: npm run typeorm migration:run
       - run: npm run seed:run
       - run: npx nx run json-api-server-e2e:e2e --parallel=1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -26,24 +26,23 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions
 
-      - name: Determine base branch for NX affected
-        id: set-base
+      - name: Determine base for NX affected (if not master)
+        if: ${{ inputs.mainBranch != 'master' }}
         shell: bash
         run: |
-          if [ "${{ github.event.inputs.mainBranch }}" = "master" ]; then
-            echo "base=master" >> $GITHUB_OUTPUT
-            echo "Using base branch 'master'"
-          else
-            LAST_TAG=$(git describe --tags --abbrev=0)
-            LAST_TAG_HASH=$(git rev-parse "$LAST_TAG")
-            echo "base=$LAST_TAG_HASH" >> $GITHUB_OUTPUT
-            echo "Using last tag hash: $LAST_TAG_HASH"
-          fi
+          LAST_TAG=$(git describe --tags --abbrev=0)
+          LAST_TAG_HASH=$(git rev-parse "$LAST_TAG")
+          CURRENT_COMMIT=$(git rev-parse HEAD)
+          echo "Using last tag hash as NX_BASE: $LAST_TAG_HASH"
+          echo "Using current commit as NX_HEAD: $CURRENT_COMMIT"
+          echo "NX_BASE=$LAST_TAG_HASH" >> $GITHUB_ENV
+          echo "NX_HEAD=$CURRENT_COMMIT" >> $GITHUB_ENV
 
-      - name: Derive appropriate SHAs for base and head for `nx affected` commands
+      - name: Determine base for NX affected (if master)
+        if: ${{ inputs.mainBranch == 'master' }}
         uses: nrwl/nx-set-shas@v4
         with:
-          main-branch-name: ${{ steps.set-base.outputs.base }}
+          main-branch-name: ${{ inputs.mainBranch }}
 
       - name: Test
         run: npx nx affected --target=test --parallel=3 --passWithNoTests --exclude='*,!tag:type:publish'
diff --git a/.github/workflows/upload-badge.yaml b/.github/workflows/upload-badge.yaml
@@ -10,8 +10,14 @@ on:
     secrets:
       NX_CLOUD_ACCESS_TOKEN:
         required: true
+      GIST_SECRET:
+        required: true
+      GIST_ID:
+        required: true
 env:
   NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
+  GIST_SECRET: ${{ secrets.GIST_SECRET }}
+  GIST_ID: ${{ secrets.GIST_ID }}
 
 jobs:
   test:
@@ -25,29 +31,23 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions
 
-      - name: Determine base branch for NX affected
-        id: set-base
+      - name: Determine base for NX affected (if not master)
+        if: ${{ inputs.mainBranch != 'master' }}
         shell: bash
         run: |
-          if [ "${{ github.event.inputs.mainBranch }}" = "master" ]; then
-            echo "base=master" >> $GITHUB_OUTPUT
-            echo "Using base branch 'master'"
-          else
-            LAST_TAG=$(git describe --tags --abbrev=0)
-            LAST_TAG_HASH=$(git rev-parse "$LAST_TAG")
-            echo "base=$LAST_TAG_HASH" >> $GITHUB_OUTPUT
-            echo "Using last tag hash: $LAST_TAG_HASH"
-          fi
+          LAST_TAG=$(git describe --tags --abbrev=0)
+          LAST_TAG_HASH=$(git rev-parse "$LAST_TAG")
+          CURRENT_COMMIT=$(git rev-parse HEAD)
+          echo "Using last tag hash as NX_BASE: $LAST_TAG_HASH"
+          echo "Using current commit as NX_HEAD: $CURRENT_COMMIT"
+          echo "NX_BASE=$LAST_TAG_HASH" >> $GITHUB_ENV
+          echo "NX_HEAD=$CURRENT_COMMIT" >> $GITHUB_ENV
 
-      - name: Derive appropriate SHAs for base and head for `nx affected` commands
+      - name: Determine base for NX affected (if master)
+        if: ${{ inputs.mainBranch == 'master' }}
         uses: nrwl/nx-set-shas@v4
         with:
-          main-branch-name: ${{ steps.set-base.outputs.base }}
-
-      - name: Set GIST_SECRET to env
-        run: |
-          echo "GIST_SECRET=${{ secrets.GIST_SECRET }}" >> $GITHUB_ENV
-          echo "GIST_ID=${{ secrets.GIST_ID }}" >> $GITHUB_ENV
+          main-branch-name: ${{ inputs.mainBranch }}
 
       - name: Upload test coverage badge
         run: npx nx affected --target=upload-badge --passWithNoTests --exclude='*,!tag:type:publish'
