[ci] Scope permissions for runtime_commit_artifacts.yml (#32701)
lauren committed
Mar 21, 2025 at 14:40 UTC
607615f4f6b399c314a567fdbf3ab53fa572991d
1 file changed
+60
-38
.github/workflows/runtime_commit_artifacts.yml
+60
-38
@@ -22,6 +22,8 @@ on:
22
default: false
23
type: boolean
24
25
+permissions: {}
26
+
27
env:
28
TZ: /usr/share/zoneinfo/America/Los_Angeles
29
# https://github.com/actions/cache/blob/main/tips-and-workarounds.md#cache-segment-restore-timeout
@@ -30,6 +32,40 @@ env:
32
jobs:
33
download_artifacts:
34
runs-on: ubuntu-latest
35
+ permissions:
36
+ # We use github.token to download the build artifact from a previous runtime_build_and_test.yml run
37
+ actions: read
38
+ steps:
39
+ - uses: actions/checkout@v4
40
+ - name: Restore cached node_modules
41
+ uses: actions/cache@v4
42
+ id: node_modules
43
+ with:
44
+ path: |
45
+ **/node_modules
46
+ key: runtime-release-node_modules-v6-${{ runner.arch }}-${{ runner.os }}-${{ hashFiles('yarn.lock', 'scripts/release/yarn.lock') }}
47
+ - name: Ensure clean build directory
48
+ run: rm -rf build
49
+ - run: yarn install --frozen-lockfile
50
+ if: steps.node_modules.outputs.cache-hit != 'true'
51
+ - run: yarn --cwd scripts/release install --frozen-lockfile
52
+ if: steps.node_modules.outputs.cache-hit != 'true'
53
+ - name: Download artifacts for base revision
54
+ run: |
55
+ GH_TOKEN=${{ github.token }} scripts/release/download-experimental-build.js --commit=${{ inputs.commit_sha || github.event.workflow_run.head_sha || github.sha }}
56
+ - name: Display structure of build
57
+ run: ls -R build
58
+ - name: Archive build
59
+ uses: actions/upload-artifact@v4
60
+ with:
61
+ name: build
62
+ path: build/
63
+ if-no-files-found: error
64
+
65
+
66
+ process_artifacts:
67
+ runs-on: ubuntu-latest
68
+ needs: [download_artifacts]
69
outputs:
70
www_branch_count: ${{ steps.check_branches.outputs.www_branch_count }}
71
fbsource_branch_count: ${{ steps.check_branches.outputs.fbsource_branch_count }}
@@ -69,25 +105,11 @@ jobs:
105
run: |
106
echo "www_branch_count=$(git ls-remote --heads origin "refs/heads/meta-www" | wc -l)" >> "$GITHUB_OUTPUT"
107
echo "fbsource_branch_count=$(git ls-remote --heads origin "refs/heads/meta-fbsource" | wc -l)" >> "$GITHUB_OUTPUT"
72
- - uses: actions/setup-node@v4
108
+ - name: Restore downloaded build
109
+ uses: actions/download-artifact@v4
110
with:
74
- node-version-file: '.nvmrc'
75
- cache: yarn
76
- cache-dependency-path: yarn.lock
77
- - name: Restore cached node_modules
78
- uses: actions/cache@v4
79
- id: node_modules
80
- with:
81
- path: |
82
- **/node_modules
83
- key: runtime-release-node_modules-v6-${{ runner.arch }}-${{ runner.os }}-${{ hashFiles('yarn.lock', 'scripts/release/yarn.lock') }}
84
- - name: Ensure clean build directory
85
- run: rm -rf build
86
- - run: yarn install --frozen-lockfile
87
- - run: yarn --cwd scripts/release install --frozen-lockfile
88
- - name: Download artifacts for base revision
89
- run: |
90
- GH_TOKEN=${{ github.token }} scripts/release/download-experimental-build.js --commit=${{ inputs.commit_sha || github.event.workflow_run.head_sha || github.sha }}
111
+ name: build
112
+ path: build
113
- name: Display structure of build
114
run: ls -R build
115
- name: Strip @license from eslint plugin and react-refresh
@@ -178,8 +200,8 @@ jobs:
200
if-no-files-found: error
201
202
commit_www_artifacts:
181
- needs: download_artifacts
182
- if: inputs.force == true || (github.ref == 'refs/heads/main' && needs.download_artifacts.outputs.www_branch_count == '0')
203
+ needs: [download_artifacts, process_artifacts]
204
+ if: inputs.force == true || (github.ref == 'refs/heads/main' && needs.process_artifacts.outputs.www_branch_count == '0')
205
runs-on: ubuntu-latest
206
steps:
207
- uses: actions/checkout@v4
@@ -192,12 +214,12 @@ jobs:
214
name: compiled
215
path: compiled/
216
- name: Revert version changes
195
- if: needs.download_artifacts.outputs.last_version_classic != '' && needs.download_artifacts.outputs.last_version_modern != ''
217
+ if: needs.process_artifacts.outputs.last_version_classic != '' && needs.process_artifacts.outputs.last_version_modern != ''
218
env:
197
- CURRENT_VERSION_CLASSIC: ${{ needs.download_artifacts.outputs.current_version_classic }}
198
- CURRENT_VERSION_MODERN: ${{ needs.download_artifacts.outputs.current_version_modern }}
199
- LAST_VERSION_CLASSIC: ${{ needs.download_artifacts.outputs.last_version_classic }}
200
- LAST_VERSION_MODERN: ${{ needs.download_artifacts.outputs.last_version_modern }}
219
+ CURRENT_VERSION_CLASSIC: ${{ needs.process_artifacts.outputs.current_version_classic }}
220
+ CURRENT_VERSION_MODERN: ${{ needs.process_artifacts.outputs.current_version_modern }}
221
+ LAST_VERSION_CLASSIC: ${{ needs.process_artifacts.outputs.last_version_classic }}
222
+ LAST_VERSION_MODERN: ${{ needs.process_artifacts.outputs.last_version_modern }}
223
run: |
224
echo "Reverting $CURRENT_VERSION_CLASSIC to $LAST_VERSION_CLASSIC"
225
grep -rl "$CURRENT_VERSION_CLASSIC" ./compiled || echo "No files found with $CURRENT_VERSION_CLASSIC"
@@ -227,12 +249,12 @@ jobs:
249
echo "should_commit=false" >> "$GITHUB_OUTPUT"
250
fi
251
- name: Re-apply version changes
230
- if: inputs.force == true || (steps.check_should_commit.outputs.should_commit == 'true' && needs.download_artifacts.outputs.last_version_classic != '' && needs.download_artifacts.outputs.last_version_modern != '')
252
+ if: inputs.force == true || (steps.check_should_commit.outputs.should_commit == 'true' && needs.process_artifacts.outputs.last_version_classic != '' && needs.process_artifacts.outputs.last_version_modern != '')
253
env:
232
- CURRENT_VERSION_CLASSIC: ${{ needs.download_artifacts.outputs.current_version_classic }}
233
- CURRENT_VERSION_MODERN: ${{ needs.download_artifacts.outputs.current_version_modern }}
234
- LAST_VERSION_CLASSIC: ${{ needs.download_artifacts.outputs.last_version_classic }}
235
- LAST_VERSION_MODERN: ${{ needs.download_artifacts.outputs.last_version_modern }}
254
+ CURRENT_VERSION_CLASSIC: ${{ needs.process_artifacts.outputs.current_version_classic }}
255
+ CURRENT_VERSION_MODERN: ${{ needs.process_artifacts.outputs.current_version_modern }}
256
+ LAST_VERSION_CLASSIC: ${{ needs.process_artifacts.outputs.last_version_classic }}
257
+ LAST_VERSION_MODERN: ${{ needs.process_artifacts.outputs.last_version_modern }}
258
run: |
259
echo "Re-applying $LAST_VERSION_CLASSIC to $CURRENT_VERSION_CLASSIC"
260
grep -rl "$LAST_VERSION_CLASSIC" ./compiled || echo "No files found with $LAST_VERSION_CLASSIC"
@@ -266,8 +288,8 @@ jobs:
288
run: git push
289
290
commit_fbsource_artifacts:
269
- needs: download_artifacts
270
- if: inputs.force == true || (github.ref == 'refs/heads/main' && needs.download_artifacts.outputs.fbsource_branch_count == '0')
291
+ needs: [download_artifacts, process_artifacts]
292
+ if: inputs.force == true || (github.ref == 'refs/heads/main' && needs.process_artifacts.outputs.fbsource_branch_count == '0')
293
runs-on: ubuntu-latest
294
steps:
295
- uses: actions/checkout@v4
@@ -280,10 +302,10 @@ jobs:
302
name: compiled-rn
303
path: compiled-rn/
304
- name: Revert version changes
283
- if: needs.download_artifacts.outputs.last_version_rn != ''
305
+ if: needs.process_artifacts.outputs.last_version_rn != ''
306
env:
285
- CURRENT_VERSION: ${{ needs.download_artifacts.outputs.current_version_rn }}
286
- LAST_VERSION: ${{ needs.download_artifacts.outputs.last_version_rn }}
307
+ CURRENT_VERSION: ${{ needs.process_artifacts.outputs.current_version_rn }}
308
+ LAST_VERSION: ${{ needs.process_artifacts.outputs.last_version_rn }}
309
run: |
310
echo "Reverting $CURRENT_VERSION to $LAST_VERSION"
311
grep -rl "$CURRENT_VERSION" ./compiled-rn || echo "No files found with $CURRENT_VERSION"
@@ -309,10 +331,10 @@ jobs:
331
echo "should_commit=false" >> "$GITHUB_OUTPUT"
332
fi
333
- name: Re-apply version changes
312
- if: inputs.force == true || (steps.check_should_commit.outputs.should_commit == 'true' && needs.download_artifacts.outputs.last_version_rn != '')
334
+ if: inputs.force == true || (steps.check_should_commit.outputs.should_commit == 'true' && needs.process_artifacts.outputs.last_version_rn != '')
335
env:
314
- CURRENT_VERSION: ${{ needs.download_artifacts.outputs.current_version_rn }}
315
- LAST_VERSION: ${{ needs.download_artifacts.outputs.last_version_rn }}
336
+ CURRENT_VERSION: ${{ needs.process_artifacts.outputs.current_version_rn }}
337
+ LAST_VERSION: ${{ needs.process_artifacts.outputs.last_version_rn }}
338
run: |
339
echo "Re-applying $LAST_VERSION to $CURRENT_VERSION"
340
grep -rl "$LAST_VERSION" ./compiled-rn || echo "No files found with $LAST_VERSION"