diff --git a/.github/libs/GithubUtils.js b/.github/libs/GithubUtils.js index cbfa56600b2f..7020eb50b005 100644 --- a/.github/libs/GithubUtils.js +++ b/.github/libs/GithubUtils.js @@ -6,7 +6,7 @@ const {throttling} = require('@octokit/plugin-throttling'); const GITHUB_OWNER = 'Expensify'; const EXPENSIFY_CASH_REPO = 'Expensify.cash'; -const EXPENSIFY_CASH_URL = 'https://github.com/Expensify/Expensify.cash'; +const EXPENSIFY_CASH_URL = 'https://github.com/Expensify/App'; const GITHUB_BASE_URL_REGEX = new RegExp('https?://(?:github\\.com|api\\.github\\.com)'); const PULL_REQUEST_REGEX = new RegExp(`${GITHUB_BASE_URL_REGEX.source}/.*/.*/pull/([0-9]+).*`); @@ -219,7 +219,7 @@ class GithubUtils { // Tag version and comparison URL // eslint-disable-next-line max-len - let issueBody = `**Release Version:** \`${tag}\`\r\n**Compare Changes:** https://github.com/Expensify/Expensify.cash/compare/production...staging\r\n`; + let issueBody = `**Release Version:** \`${tag}\`\r\n**Compare Changes:** https://github.com/Expensify/App/compare/production...staging\r\n`; // PR list if (!_.isEmpty(sortedPRList)) { diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 72dccd69beb3..319073c9d761 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -3,7 +3,7 @@ ## Security Rules 🔐 1. Do **not** use `pull_request_target` trigger unless an external fork needs access to secrets, or a _write_ `GITHUB_TOKEN`. 1. Do **not ever** write a `pull_request_target` trigger with an explicit PR checkout, e.g. using `actions/checkout@v2`. This is [discussed further here](https://securitylab.github.com/research/github-actions-preventing-pwn-requests) -1. **Do use** the `pull_request` trigger as it does not send internal secrets and only grants a _read_ `GITHUB_TOKEN`. +1. **Do use** the `pull_request` trigger as it does not send internal secrets and only grants a _read_ `GITHUB_TOKEN`. 1. If an external action needs access to any secret (`GITHUB_TOKEN` or internal secret), use the commit hash of the workflow to prevent a modification of underlying source code at that version. For example: 1. **Bad:** `hmarr/auto-approve-action@v2.0.0` Relies on the tag 1. **Good:** `hmarr/auto-approve-action@7782c7e2bdf62b4d79bdcded8332808fd2f179cd` Explicit Git hash @@ -25,7 +25,7 @@ The GitHub workflows require a large list of secrets to deploy, notify and test 4. `ios/Certificates.p12.gpg` 2. `SLACK_WEBHOOK` - Sends Slack notifications via Slack WebHook https://expensify.slack.com/services/B01AX48D7MM 3. `OS_BOTIFY_TOKEN` - Personal access token for @OSBotify user in GitHub -4. `CLA_BOTIFY_TOKEN` - Personal access token for @CLABotify user in GitHub +4. `CLA_BOTIFY_TOKEN` - Personal access token for @CLABotify user in GitHub 5. `CSC_LINK` - Required to be set for desktop code signing: https://www.electron.build/code-signing.html#travis-appveyor-and-other-ci-servers 6. `CSC_KEY_PASSWORD` - Required to be set for desktop code signing: https://www.electron.build/code-signing.html#travis-appveyor-and-other-ci-servers 7. `APPLE_ID` - Required for notarizing desktop code in `desktop/notarize.js` @@ -42,7 +42,7 @@ The GitHub workflows require a large list of secrets to deploy, notify and test All these _workflows_ are comprised of atomic _actions_. Most of the time, we can use pre-made and independently maintained actions to create powerful workflows that meet our needs. However, when we want to do something very specific or have a more complex or robust action in mind, we can create our own _actions_. -All our actions are stored in the neighboring directory [`.github/actions`](https://github.com/Expensify/Expensify.cash/tree/main/.github/actions). Each action is a module comprised of three parts: +All our actions are stored in the neighboring directory [`.github/actions`](https://github.com/Expensify/App/tree/main/.github/actions). Each action is a module comprised of three parts: 1) An [action metadata file](https://docs.github.com/en/free-pro-team@latest/actions/creating-actions/creating-a-javascript-action#creating-an-action-metadata-file) called `action.yml`. This describes the action, gives it a name, and defines its inputs and outputs. 2) A Node.js script, whose name matches the module. This is where you can implement the custom logic for your action. @@ -69,7 +69,7 @@ In order to bundle actions with their dependencies into a single Node.js executa - Use the absolute path of the action in GitHub, including the repo name, path, and branch ref, like so: ```yaml - name: Generate Version - uses: Expensify/Expensify.cash/.github/actions/bumpVersion@main + uses: Expensify/App/.github/actions/bumpVersion@main ``` Do not try to use a relative path. - Confusingly, paths in action metadata files (`action.yml`) _must_ use relative paths. @@ -78,11 +78,11 @@ In order to bundle actions with their dependencies into a single Node.js executa ## Imperative Workflows -We have a unique way of defining certain workflows which can be manually triggered by the `workflow_dispatch` event. See `createNewVersion.yml` and `updateProtectedBranch.yml` for examples. Used in combination with the custom [`triggerWorkflowAndWait` action](https://github.com/Expensify/Expensify.cash/blob/d07dcf4e3e0b3f11bec73726856e6d5f8624704c/.github/actions/triggerWorkflowAndWait/triggerWorkflowAndWait.js), workflows can be synchronously executed like a function from another workflow, like this: +We have a unique way of defining certain workflows which can be manually triggered by the `workflow_dispatch` event. See `createNewVersion.yml` and `updateProtectedBranch.yml` for examples. Used in combination with the custom [`triggerWorkflowAndWait` action](https://github.com/Expensify/App/blob/d07dcf4e3e0b3f11bec73726856e6d5f8624704c/.github/actions/triggerWorkflowAndWait/triggerWorkflowAndWait.js), workflows can be synchronously executed like a function from another workflow, like this: ```yaml - name: Create new BUILD version - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: createNewVersion.yml diff --git a/.github/workflows/cherryPick.yml b/.github/workflows/cherryPick.yml index 9d40699f99f5..7ec8503dfc7d 100644 --- a/.github/workflows/cherryPick.yml +++ b/.github/workflows/cherryPick.yml @@ -44,7 +44,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Create new BUILD version - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: createNewVersion.yml @@ -77,7 +77,7 @@ jobs: - name: Get merge commit for CP pull request id: getCPMergeCommit - uses: Expensify/Expensify.cash/.github/actions/getMergeCommitForPullRequest@main + uses: Expensify/App/.github/actions/getMergeCommitForPullRequest@main with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} PULL_REQUEST_NUMBER: ${{ github.event.inputs.PULL_REQUEST_NUMBER }} @@ -94,7 +94,7 @@ jobs: - name: Get merge commit for version-bump pull request id: getVersionBumpMergeCommit - uses: Expensify/Expensify.cash/.github/actions/getMergeCommitForPullRequest@main + uses: Expensify/App/.github/actions/getMergeCommitForPullRequest@main with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} USER: OSBotify @@ -132,12 +132,12 @@ jobs: destination_branch: staging github_token: ${{ secrets.OS_BOTIFY_TOKEN }} pr_title: '🍒 Cherry pick PR #${{ github.event.inputs.PULL_REQUEST_NUMBER }} to staging 🍒' - pr_body: '🍒 Cherry pick https://github.com/Expensify/Expensify.cash/pull/${{ github.event.inputs.PULL_REQUEST_NUMBER }} to staging 🍒' + pr_body: '🍒 Cherry pick https://github.com/Expensify/App/pull/${{ github.event.inputs.PULL_REQUEST_NUMBER }} to staging 🍒' pr_label: automerge - name: Check if pull request is mergeable id: isPullRequestMergeable - uses: Expensify/Expensify.cash/.github/actions/isPullRequestMergeable@main + uses: Expensify/App/.github/actions/isPullRequestMergeable@main with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} PULL_REQUEST_NUMBER: ${{ steps.createPullRequest.outputs.pr_number }} diff --git a/.github/workflows/createNewVersion.yml b/.github/workflows/createNewVersion.yml index 4252e6c6dcb4..84dab948bd4c 100644 --- a/.github/workflows/createNewVersion.yml +++ b/.github/workflows/createNewVersion.yml @@ -39,7 +39,7 @@ jobs: - name: Generate version id: bumpVersion - uses: Expensify/Expensify.cash/.github/actions/bumpVersion@main + uses: Expensify/App/.github/actions/bumpVersion@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} SEMVER_LEVEL: ${{ github.event.inputs.SEMVER_LEVEL }} @@ -56,7 +56,7 @@ jobs: git push origin ${{ env.VERSION_BRANCH }} - name: Update main branch - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: updateProtectedBranch.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 0865485bcbf2..5d68673888e0 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -59,7 +59,7 @@ jobs: - name: Get Release Pull Request List id: getReleasePRList - uses: Expensify/Expensify.cash/.github/actions/getDeployPullRequestList@main + uses: Expensify/App/.github/actions/getDeployPullRequestList@main with: TAG: ${{ env.PRODUCTION_VERSION }} GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} @@ -67,7 +67,7 @@ jobs: - name: Generate Release Body id: getReleaseBody - uses: Expensify/Expensify.cash/.github/actions/getReleaseBody@main + uses: Expensify/App/.github/actions/getReleaseBody@main with: PR_LIST: ${{ steps.getReleasePRList.outputs.PR_LIST }} @@ -79,4 +79,3 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} - diff --git a/.github/workflows/deployBlocker.yml b/.github/workflows/deployBlocker.yml index cce29a3112c1..517cd606b3d9 100644 --- a/.github/workflows/deployBlocker.yml +++ b/.github/workflows/deployBlocker.yml @@ -34,7 +34,7 @@ jobs: echo "DEPLOY_BLOCKER_TITLE=$(sed -e "s/'/'\\\\''/g; s/\`/\\\\\`/g; 1s/^/'/; \$s/\$/'/" <<< ${{ github.event.pull_request.title }})" >> $GITHUB_ENV - name: Update StagingDeployCash with new deploy blocker - uses: Expensify/Expensify.cash/.github/actions/createOrUpdateStagingDeploy@main + uses: Expensify/App/.github/actions/createOrUpdateStagingDeploy@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} @@ -67,7 +67,7 @@ jobs: github_token: ${{ secrets.OS_BOTIFY_TOKEN }} number: ${{ env.DEPLOY_BLOCKER_NUMBER }} body: | - :wave: Friendly reminder that deploy blockers are time-sensitive ⏱ issues! [Check out the open `StagingDeployCash` deploy checklist](https://github.com/Expensify/Expensify.cash/issues?q=is%3Aopen+is%3Aissue+label%3AStagingDeployCash) to see the list of PRs included in this release, then work quickly to do one of the following: + :wave: Friendly reminder that deploy blockers are time-sensitive ⏱ issues! [Check out the open `StagingDeployCash` deploy checklist](https://github.com/Expensify/App/issues?q=is%3Aopen+is%3Aissue+label%3AStagingDeployCash) to see the list of PRs included in this release, then work quickly to do one of the following: 1. Identify the pull request that introduced this issue and revert it. 2. Find someone who can quickly fix the issue. 3. Fix the issue yourself. diff --git a/.github/workflows/finishReleaseCycle.yml b/.github/workflows/finishReleaseCycle.yml index 7d1aaace2ab4..2fc27034cb83 100644 --- a/.github/workflows/finishReleaseCycle.yml +++ b/.github/workflows/finishReleaseCycle.yml @@ -16,14 +16,14 @@ jobs: steps: - name: Check for any deploy blockers id: checkDeployBlockers - uses: Expensify/Expensify.cash/.github/actions/checkDeployBlockers@main + uses: Expensify/App/.github/actions/checkDeployBlockers@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} ISSUE_NUMBER: ${{ github.event.issue.number }} - name: Reopen and comment on issue if: ${{ steps.checkDeployBlockers.outputs.HAS_DEPLOY_BLOCKERS == 'true' }} - uses: Expensify/Expensify.cash/.github/actions/reopenIssueWithComment@main + uses: Expensify/App/.github/actions/reopenIssueWithComment@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} ISSUE_NUMBER: ${{ github.event.issue.number }} @@ -45,7 +45,7 @@ jobs: token: ${{ secrets.OS_BOTIFY_TOKEN }} - name: Update production branch - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: updateProtectedBranch.yml @@ -71,14 +71,14 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Create new BUILD version - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: createNewVersion.yml INPUTS: '{ "SEMVER_LEVEL": "BUILD" }' - name: Update staging branch to trigger staging deploy - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: updateProtectedBranch.yml @@ -96,7 +96,7 @@ jobs: run: git tag ${{ env.NEW_VERSION }} - name: Create new StagingDeployCash - uses: Expensify/Expensify.cash/.github/actions/createOrUpdateStagingDeploy@main + uses: Expensify/App/.github/actions/createOrUpdateStagingDeploy@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} NPM_VERSION: ${{ env.NEW_VERSION }} diff --git a/.github/workflows/lockDeploys.yml b/.github/workflows/lockDeploys.yml index 9123870b449e..b180ee81d753 100644 --- a/.github/workflows/lockDeploys.yml +++ b/.github/workflows/lockDeploys.yml @@ -23,14 +23,14 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Create new PATCH version - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: createNewVersion.yml INPUTS: '{ "SEMVER_LEVEL": "PATCH" }' - name: Update staging branch - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: updateProtectedBranch.yml @@ -47,7 +47,7 @@ jobs: run: git tag ${{ env.NEW_VERSION }} - name: Update StagingDeployCash - uses: Expensify/Expensify.cash/.github/actions/createOrUpdateStagingDeploy@main + uses: Expensify/App/.github/actions/createOrUpdateStagingDeploy@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} NPM_VERSION: ${{ env.NEW_VERSION }} diff --git a/.github/workflows/platformDeploy.yml b/.github/workflows/platformDeploy.yml index 3c85ac4a1d01..3027d39020e5 100644 --- a/.github/workflows/platformDeploy.yml +++ b/.github/workflows/platformDeploy.yml @@ -334,7 +334,7 @@ jobs: - name: Determine if this was a cherry-pick id: isStagingDeployLocked - uses: Expensify/Expensify.cash/.github/actions/isStagingDeployLocked@main + uses: Expensify/App/.github/actions/isStagingDeployLocked@main with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -343,14 +343,14 @@ jobs: - name: Get Release Pull Request List id: getReleasePRList - uses: Expensify/Expensify.cash/.github/actions/getDeployPullRequestList@main + uses: Expensify/App/.github/actions/getDeployPullRequestList@main with: TAG: ${{ env.VERSION }} GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} IS_PRODUCTION_DEPLOY: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }} - name: Comment on issues - uses: Expensify/Expensify.cash/.github/actions/markPullRequestsAsDeployed@main + uses: Expensify/App/.github/actions/markPullRequestsAsDeployed@main with: PR_LIST: ${{ steps.getReleasePRList.outputs.PR_LIST }} IS_PRODUCTION_DEPLOY: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }} diff --git a/.github/workflows/preDeploy.yml b/.github/workflows/preDeploy.yml index aa96abf9d3d9..c700afc6dc95 100644 --- a/.github/workflows/preDeploy.yml +++ b/.github/workflows/preDeploy.yml @@ -28,7 +28,7 @@ jobs: - name: Check if StagingDeployCash is locked id: isStagingDeployLocked - uses: Expensify/Expensify.cash/.github/actions/isStagingDeployLocked@main + uses: Expensify/App/.github/actions/isStagingDeployLocked@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} @@ -73,7 +73,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Create new BUILD version - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: createNewVersion.yml @@ -81,7 +81,7 @@ jobs: - name: Update staging branch from main if: ${{ needs.chooseDeployActions.outputs.isStagingDeployLocked == 'false' }} - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: updateProtectedBranch.yml @@ -99,14 +99,14 @@ jobs: - name: Cherry pick to staging if: ${{ needs.chooseDeployActions.outputs.isStagingDeployLocked == 'true' && needs.chooseDeployActions.outputs.shouldCherryPick == 'true' }} - uses: Expensify/Expensify.cash/.github/actions/triggerWorkflowAndWait@main + uses: Expensify/App/.github/actions/triggerWorkflowAndWait@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} WORKFLOW: cherryPick.yml INPUTS: '{ "PULL_REQUEST_NUMBER": "${{ needs.chooseDeployActions.outputs.mergedPullRequest }}", "NEW_VERSION": "${{ env.NEW_VERSION }}" }' - name: Update StagingDeployCash - uses: Expensify/Expensify.cash/.github/actions/createOrUpdateStagingDeploy@main + uses: Expensify/App/.github/actions/createOrUpdateStagingDeploy@main with: GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} NPM_VERSION: ${{ env.NEW_VERSION }} diff --git a/.github/workflows/updateProtectedBranch.yml b/.github/workflows/updateProtectedBranch.yml index 4d7882636fdf..c158a7c71903 100644 --- a/.github/workflows/updateProtectedBranch.yml +++ b/.github/workflows/updateProtectedBranch.yml @@ -78,7 +78,7 @@ jobs: - name: Check if pull request is mergeable id: isPullRequestMergeable - uses: Expensify/Expensify.cash/.github/actions/isPullRequestMergeable@main + uses: Expensify/App/.github/actions/isPullRequestMergeable@main with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} PULL_REQUEST_NUMBER: ${{ steps.createPullRequest.outputs.pr_number }} diff --git a/.github/workflows/warnCPLabel.yml b/.github/workflows/warnCPLabel.yml index 25434a5d88b7..3aa536b3518a 100644 --- a/.github/workflows/warnCPLabel.yml +++ b/.github/workflows/warnCPLabel.yml @@ -17,7 +17,7 @@ jobs: github_token: ${{ secrets.GITHUB_TOKEN }} body: | :warning: :warning: **Heads up! This pull request has the `CP Staging` label.** :warning: :warning: - Merging it will cause it to be immediately deployed to staging, _even if the [open `StagingDeployCash` deploy checklist](https://github.com/Expensify/Expensify.cash/issues?q=is%3Aopen+is%3Aissue+label%3AStagingDeployCash) is locked._ + Merging it will cause it to be immediately deployed to staging, _even if the [open `StagingDeployCash` deploy checklist](https://github.com/Expensify/App/issues?q=is%3Aopen+is%3Aissue+label%3AStagingDeployCash) is locked._ # This Slack step is duplicated in all workflows, if you make a change to this step, make sure to update all # the other workflows with the same change diff --git a/README.md b/README.md index c8edfdf80a07..9a24fec82dcb 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@