-
Notifications
You must be signed in to change notification settings - Fork 5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ci: Migrate LavaMoat validation to GitHub Actions (#29369)
## **Description** Migrate LavaMoat policy validation from CircleCI to GitHub actions. No functional changes. [](https://codespaces.new/MetaMask/metamask-extension/pull/29369?quickstart=1) ## **Related issues** Relates to #28572 These changes were extracted from #29256 ## **Manual testing steps** * Checkout this branch (`migrate-lavamoat-validation`), then from there create a new branch to test with * On this new branch, make a dependency change with a policy impact (e.g. add or remove a package, upgrade something, etc.), but make sure the build still passes (validation requires a passing build) * Create a draft PR, and verify that the policy validation fails * Use the `metamaskbot update-policies` bot command to update the policies, then verify the validation now succeeds. PR with errors - #29396 Failure - https://github.com/MetaMask/metamask-extension/actions/runs/12434996100/job/34719873040?pr=29396 Passing - https://github.com/MetaMask/metamask-extension/actions/runs/12435253146/job/34720674397?pr=29396 ## **Screenshots/Recordings** N/A ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.
- Loading branch information
](https://codespaces.new/MetaMask/metamask-extension/pull/29369?quickstart=1){kind=link}
Showing
5 changed files
with
97 additions
and
60 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| name: Validate lavamoat allow scripts | ||
|
|
||
| on: | ||
| workflow_call: | ||
|
|
||
| jobs: | ||
| validate-lavamoat-allow-scripts: | ||
| name: Validate lavamoat allow scripts | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup environment | ||
| uses: metamask/github-tools/.github/actions/setup-environment@main | ||
|
|
||
| - name: Validate allow-scripts config | ||
| run: yarn allow-scripts auto | ||
|
|
||
| - name: Check working tree | ||
| run: | | ||
| if ! git diff --exit-code; then | ||
| echo "::error::Working tree dirty." | ||
| exit 1 | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| name: Validate lavamoat policy build | ||
|
|
||
| on: | ||
| workflow_call: | ||
|
|
||
| jobs: | ||
| validate-lavamoat-policy-build: | ||
| name: Validate lavamoat policy build | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup environment | ||
| uses: metamask/github-tools/.github/actions/setup-environment@main | ||
|
|
||
| - name: Validate lavamoat build policy | ||
| run: yarn lavamoat:build:auto | ||
| env: | ||
| INFURA_PROJECT_ID: 00000000000 | ||
|
|
||
| - name: Check working tree | ||
| run: | | ||
| if ! git diff --exit-code; then | ||
| echo "::error::Working tree dirty." | ||
| exit 1 | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| name: Validate lavamoat policy webapp | ||
|
|
||
| on: | ||
| workflow_call: | ||
|
|
||
| jobs: | ||
| validate-lavamoat-policy-webapp: | ||
| name: Validate lavamoat policy webapp | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| matrix: | ||
| build-type: [main, beta, flask, mmi] | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup environment | ||
| uses: metamask/github-tools/.github/actions/setup-environment@main | ||
|
|
||
| - name: Validate lavamoat ${{ matrix.build-type }} policy | ||
| run: yarn lavamoat:webapp:auto:ci --build-types=${{ matrix.build-type }} | ||
| env: | ||
| INFURA_PROJECT_ID: 00000000000 | ||
|
|
||
| - name: Check working tree | ||
| run: | | ||
| if ! git diff --exit-code; then | ||
| echo "::error::Working tree dirty." | ||
| exit 1 | ||
| fi |