Merge pull request #48671 from Expensify/Rory-FixChecklistUpdates

[No QA] Create and push tag before updating checklist

.github/workflows/deploy.yml

@@ -28,12 +28,35 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
 
+  createTag:
+    needs: validateActor
+    if: ${{ github.ref == 'refs/heads/staging' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.OS_BOTIFY_TOKEN }}
+
+      - name: Setup git for OSBotify
+        uses: ./.github/actions/composite/setupGitForOSBotifyApp
+        id: setupGitForOSBotify
+        with:
+          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
+          OS_BOTIFY_APP_ID: ${{ secrets.OS_BOTIFY_APP_ID }}
+          OS_BOTIFY_PRIVATE_KEY: ${{ secrets.OS_BOTIFY_PRIVATE_KEY }}
+
+      - name: Create and push tag
+        run: |
+          git tag "$(jq -r .version < package.json)"
+          git push origin --tags
+
   # Note: we're updating the checklist before running the deploys and assuming that it will succeed on at least one platform
   deployChecklist:
     name: Create or update deploy checklist
     uses: ./.github/workflows/createDeployChecklist.yml
     if: ${{ github.ref == 'refs/heads/staging' }}
-    needs: validateActor
+    needs: createTag
     secrets: inherit
 
   android:
@@ -45,7 +68,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-      
+
       - name: Configure MapBox SDK
         run: ./scripts/setup-mapbox-sdk.sh ${{ secrets.MAPBOX_SDK_DOWNLOAD_TOKEN }}
 
@@ -446,32 +469,19 @@ jobs:
     if: ${{ github.ref == 'refs/heads/staging' && fromJSON(needs.checkDeploymentSuccess.outputs.IS_AT_LEAST_ONE_PLATFORM_DEPLOYED) }}
     needs: [checkDeploymentSuccess]
     steps:
-      # The command "gh release create" also creates and pushes a tag for the version if one does not already exist,
-      # So we need to checkout the staging branch and create that tag from the staging branch.
       - name: Checkout staging branch
         uses: actions/checkout@v4
-        with:
-          ref: staging
-          token: ${{ secrets.OS_BOTIFY_TOKEN }}
-
-      - name: Setup git for OSBotify
-        uses: ./.github/actions/composite/setupGitForOSBotifyApp
-        id: setupGitForOSBotify
-        with:
-          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
-          OS_BOTIFY_APP_ID: ${{ secrets.OS_BOTIFY_APP_ID }}
-          OS_BOTIFY_PRIVATE_KEY: ${{ secrets.OS_BOTIFY_PRIVATE_KEY }}
 
       - name: Get current app version
-        run: echo "STAGING_VERSION=$(npm run print-version --silent)" >> "$GITHUB_ENV"
+        run: echo "STAGING_VERSION=$(jq -r .version < package.json)" >> "$GITHUB_ENV"
 
       - name: Download all workflow run artifacts
         uses: actions/download-artifact@v4
 
       - name: 🚀 Create prerelease 🚀
         run: gh release create ${{ env.STAGING_VERSION }} --title ${{ env.STAGING_VERSION }} --generate-notes --prerelease --target staging
         env:
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: Upload artifacts to GitHub Release
         run: |
@@ -486,7 +496,7 @@ jobs:
             ./web-build-tar-gz/webBuild.tar.gz \
             ./web-build-zip/webBuild.zip
         env:
-          GITHUB_TOKEN: ${{ github.token }} 
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: Warn deployers if staging deploy failed
         if: ${{ failure() }}
@@ -513,17 +523,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         name: Checkout
-        with:
-          ref: production
-          token: ${{ secrets.OS_BOTIFY_TOKEN }}
-
-      - name: Setup git for OSBotify
-        uses: ./.github/actions/composite/setupGitForOSBotifyApp
-        id: setupGitForOSBotify
-        with:
-          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
-          OS_BOTIFY_APP_ID: ${{ secrets.OS_BOTIFY_APP_ID }}
-          OS_BOTIFY_PRIVATE_KEY: ${{ secrets.OS_BOTIFY_PRIVATE_KEY }}
 
       - name: Get current app version
         run: echo "PRODUCTION_VERSION=$(npm run print-version --silent)" >> "$GITHUB_ENV"
@@ -537,15 +536,15 @@ jobs:
             ./web-build-tar-gz/webBuild.tar.gz \
             ./web-build-zip/webBuild.zip
         env:
-          GITHUB_TOKEN: ${{ github.token }} 
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: 🚀 Edit the release to be no longer a prerelease 🚀
         run: |
           LATEST_RELEASE="$(gh release list --exclude-pre-releases --json tagName,isLatest --jq '.[] | select(.isLatest) | .tagName')"
           gh api --method POST /repos/Expensify/App/releases/generate-notes -f "tag_name=${{ env.PRODUCTION_VERSION }}" -f "previous_tag_name=$LATEST_RELEASE" | jq -r '.body' >> releaseNotes.md
           gh release edit ${{ env.PRODUCTION_VERSION }} --prerelease=false --latest --notes-file releaseNotes.md
         env:
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: Warn deployers if production deploy failed
         if: ${{ failure() }}