ci(github): connect release reorganization #12444

karliatto · 2024-05-16T13:30:04Z

Description

This PR changes the process to release connect to be like below:

Create a non-protected branch to update changelogs and bump versions
Merging the previous branch to develop
Triggering new workflow that will from specific commit from develop branch create the release/connect/... branch and will check what versions are different in package.json and NPM and it will trigger the workflows to release those with different versions
The same workflow will trigger the relesase to staging (without permissions since it is just staging)
Then we need to manually trigger the production release that will need to trigger by an authorized member and approved by other one.
Release is done.

Release process

So the process would be:

Run workflow .github/workflows/release-connect-bump-versions.yml
- It will create a branch (non protected) with version bumped and changelogs most of it automated
- This branch can be updated and modify until we get satisfying changelog
- Once the changelogs and versions are fine we merge it to develop
Run workflow .github/workflows/release-connect-init.yml using the commit hash of the previously merged bump-versions/connect-${version}.
- It will create the branch release/connect/<version>
- Automatically trigger github/workflows/release-connect-v9-staging.yml over the new created branch that will release to staging without any other approval.
- Automatically trigger .github/workflows/release-connect-v9-production.yml over the new created release branch that will need approval from other member to release to production connect.trezor.io/9 for all the deployment types and only to connect.trezor.io/9.x.x for canary releases.
- Automatically trigger .github/workflows/release-connect-npm-init.yml over new created release branch that will require approval to release all the npm dependencies.

Related Issue

Related #12157

mroz22

it looks nice. will get back to it later to read through it more carefully mostly to make sure that I understand everything.

.github/workflows/release-connect-bump-versions.yml

.github/workflows/release-connect-init.yml

.github/workflows/release-connect-npm-init.yml

mroz22 · 2024-05-22T10:08:42Z

.github/workflows/release-connect-bump-versions.yml

+
+jobs:
+  bump-versions:
+    if: github.repository == 'trezor/trezor-suite'


I noticed that not all the jobs here have this check. should they have it? or is it enough only for the first job to have it?

Good point. I actually think that if: github.repository == 'trezor/trezor-suite' should be only used in workflows that are run automatically like the tests ones, to avoid running when running in forks. But this one has to be triggered manually so I would say it is not necessarily. @vdovhanych could you confirm it?

Yes, we can get rid of it for release workflows

karliatto · 2024-05-23T06:57:48Z

.github/workflows/release-connect-npm-init.yml

-          git config --global user.name "trezor-ci"
-          git config --global user.email "${{ secrets.TREZOR_BOT_EMAIL }}"
-          gh config set prompt disabled


@vdovhanych getting rid of "trezor-ci" git user here, since I think this was totally unnecessary.

karliatto · 2024-05-23T06:58:53Z

.github/workflows/release-connect-init.yml

+        run: |
+          echo ${{ env.BRANCH_NAME }}
+          git checkout -b ${{ env.BRANCH_NAME }}
+          git push origin ${{ env.BRANCH_NAME }}


@vdovhanych as agreed I am not adding here the "trezor-ci" bot credential and name since this branch is going to be created by the user that triggers the action.

How is this supposed to work? Its trying to push te code to protected branch. It wont work like this, we don't want to have automation rights to push commits to protected branch.

ci/scripts/connect-bump-versions.ts

mroz22

the new system sounds good to me. I just pointed few nitpicks around the review, not really important ones.

Maybe please wait also for @vdovhanych and his second approval 🙏

vdovhanych · 2024-05-23T08:27:50Z

.github/workflows/release-connect-bump-versions.yml

@@ -0,0 +1,37 @@
+name: "[Release] connect bump versions"


This will run and create a new unprotected branch with updated versions and create a pull request to the protected branch?

This will create a new unprotected branch with update versions and create a pull request to develop.
Then we merge it to develop and once it is in develop we run the other workflow .github/workflows/release-connect-init.yml to create the protected branch release/connect/...

vdovhanych · 2024-05-23T08:29:20Z

.github/workflows/release-connect-init.yml

+        run: |
+          echo ${{ env.BRANCH_NAME }}
+          git checkout -b ${{ env.BRANCH_NAME }}
+          git push origin ${{ env.BRANCH_NAME }}


How is this supposed to work? Its trying to push te code to protected branch. It wont work like this, we don't want to have automation rights to push commits to protected branch.

vdovhanych · 2024-05-23T08:32:32Z

.github/workflows/template-check-connect-version-match.yml

@@ -0,0 +1,37 @@
+name: Check connect version match with branch


This should probably be called [Template] ...

Also i would probably convert this to action as this is something that is quite static and wont be changing that often (but its super low priority)

Yes, I made new action .github/actions/check-connect-version-match/action.yml

vdovhanych · 2024-05-23T08:37:54Z

.github/workflows/release-connect-npm-init.yml

-          git config --global user.name "trezor-ci"
-          git config --global user.email "${{ secrets.TREZOR_BOT_EMAIL }}"
-          gh config set prompt disabled


vdovhanych · 2024-05-23T08:41:20Z

.github/workflows/release-connect-init.yml

+
+      - name: Create and push new branch
+        env:
+          BRANCH_NAME: "release/connect/${{ needs.extract-version.outputs.version }}"


This is where what branch its pushing to is specified. W probably want to push the code to create-push-release-branch: branch that was created in that job at the line 46.

What about this still?

This will now be done by the "trezor-ci".

vdovhanych · 2024-05-23T08:43:01Z

.github/workflows/release-connect-init.yml

+          git push origin ${{ env.BRANCH_NAME }}
+          echo "branch_name=${{ env.BRANCH_NAME }}" >> $GITHUB_OUTPUT
+
+  trigger-v9-staging-release:


Im not sure if this will do what we want, if we trigger the workflows like this it will still be possible to approve the run by one person. I trigger release and i can approve it myself because the deploy was requested by the github-actions "user". This is valied for all following trigger jobs

I see, I think you are right.
I am researching if there is a way of using the same user that triggered the action as the one that trigger it.

I think I have an idea, what if instead of running those workflows using gh I will make those workflows templates that will run in the original workflow release-connect-init.yml ?

Then it will all be run by the user that is triggering the initial workflow, right?

Now it seams even more right in my mind.

Maybe it is problematic with "approval" since the approval are per workflow not per job. Right?
And in my mind this is design to approve each workflow at a different moment.

Or we can do the process a bit more manual and trigger those workflows manually at least for now.

Ok, for now I suggest get rid of the automation of triggering all the workflows from one and trigger them manually until we decide how to do it in order to achieve that each of the releases part has to be trigger by one authorize user and approve by other.

Therefore I added this fixup to remove all those trigger... jobs 3029015

@vdovhanych if you agree I will squash that fixup and we can try manually then we will see.

vdovhanych · 2024-05-23T08:44:21Z

.github/workflows/release-connect-npm-init.yml

+        env:
+          BRANCH_NAME: release/connect/${{ needs.extract-version.outputs.version }}
+
+  trigger-npm-release-connect:


same here with te triggering the action with github actions.

I dont think this is resolved

You are right, just getting rid of that file completely since this time we are going to run those workflows manually 95ffe13

vdovhanych · 2024-05-23T08:44:55Z

.github/workflows/release-connect-npm-init.yml

-          gh config set prompt disabled
-          gh api /user --jq .login
-          node ./ci/scripts/connect-release-init-npm.js ${{ github.event.inputs.semver }}
+          yarn tsx ./ci/scripts/connect-release-npm-init.ts ${{ github.event.inputs.deploymentType }} ${{ env.BRANCH_NAME }}


This again tries to push the code to the protected branch. Or I'm missing something?

No, this is not pushing code to any protected branch. This is triggering the workflow that will initialize the release of NPM.

It requires to have a script that checks what are the dependencies that need to be updated.

Please look at the section ## Release process in the description of this PR, I am trying to explain there the process. And let' me know if you have doubts or ideas.

karliatto force-pushed the ci/refactor-order-of-connect-release branch 2 times, most recently from 32e940e to 5ddee00 Compare May 20, 2024 11:13

karliatto changed the title ~~wip~~ wip: ci(github): connect release reorganization May 20, 2024

karliatto force-pushed the ci/refactor-order-of-connect-release branch 4 times, most recently from d88e8f4 to 86cb240 Compare May 21, 2024 09:40

karliatto changed the title ~~wip: ci(github): connect release reorganization~~ ci(github): connect release reorganization May 22, 2024

karliatto marked this pull request as ready for review May 22, 2024 07:21

karliatto requested review from vdovhanych and mroz22 as code owners May 22, 2024 07:21

mroz22 reviewed May 22, 2024

View reviewed changes

karliatto force-pushed the ci/refactor-order-of-connect-release branch from 86cb240 to cf2d60f Compare May 23, 2024 06:56

karliatto commented May 23, 2024

View reviewed changes

mroz22 reviewed May 23, 2024

View reviewed changes

ci/scripts/connect-bump-versions.ts Outdated Show resolved Hide resolved

mroz22 approved these changes May 23, 2024

View reviewed changes

vdovhanych reviewed May 23, 2024

View reviewed changes

karliatto force-pushed the ci/refactor-order-of-connect-release branch 3 times, most recently from 95ffe13 to 36bd85e Compare May 24, 2024 09:17

ci(github): connect release reorder

db94318

karliatto force-pushed the ci/refactor-order-of-connect-release branch from 36bd85e to db94318 Compare May 24, 2024 09:18

vdovhanych approved these changes May 24, 2024

View reviewed changes

karliatto merged commit 6c09263 into develop May 24, 2024
25 checks passed

karliatto deleted the ci/refactor-order-of-connect-release branch May 24, 2024 12:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci(github): connect release reorganization #12444

ci(github): connect release reorganization #12444

karliatto commented May 16, 2024 •

edited

Loading

mroz22 left a comment

mroz22 May 22, 2024

karliatto May 22, 2024

vdovhanych May 22, 2024

karliatto May 23, 2024

vdovhanych May 23, 2024

karliatto May 23, 2024

vdovhanych May 23, 2024

mroz22 left a comment

vdovhanych May 23, 2024

karliatto May 23, 2024

vdovhanych May 24, 2024

vdovhanych May 23, 2024

vdovhanych May 23, 2024

vdovhanych May 23, 2024

karliatto May 23, 2024

vdovhanych May 23, 2024

vdovhanych May 23, 2024

vdovhanych May 24, 2024

karliatto May 24, 2024

vdovhanych May 23, 2024

karliatto May 23, 2024

karliatto May 23, 2024

karliatto May 23, 2024 •

edited

Loading

karliatto May 23, 2024 •

edited

Loading

karliatto May 23, 2024

karliatto May 23, 2024

vdovhanych May 23, 2024

vdovhanych May 24, 2024

karliatto May 24, 2024

vdovhanych May 23, 2024

karliatto May 23, 2024

vdovhanych May 24, 2024

		@@ -0,0 +1,37 @@
		name: Check connect version match with branch

ci(github): connect release reorganization #12444

ci(github): connect release reorganization #12444

Conversation

karliatto commented May 16, 2024 • edited Loading

Description

Release process

Related Issue

mroz22 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mroz22 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

karliatto May 23, 2024 • edited Loading

Choose a reason for hiding this comment

karliatto May 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

karliatto commented May 16, 2024 •

edited

Loading

karliatto May 23, 2024 •

edited

Loading

karliatto May 23, 2024 •

edited

Loading