Switch to version of the "Sync Labels" workflow for npm-managed projects

The "Sync Labels" workflow was originally developed with Arduino firmware repositories in mind. Those projects don't have a lot of existing infrastructure and, since they are intended to be very approachable, the impact of adding additional non-firmware files or folders (especially in the root) must be carefully considered. In that context, a self-contained workflow is desirable. However, the situation is different in the inherently more complex and infrastructure rich tooling projects, which are typically consumed only as a binary by users. For this reason, an alternative standardized version of the "Sync Labels" workflow was produced, which utilizes npm to manage its tool dependencies. The code dependencies of this project and the code infrastructure are already managed via npm, which means the switch to this superior version of the workflow can be made without the need to add any additional infrastructure. This provides some significant benefits: - Controlled updates via Dependabot PRs instead of being subject to immediate breakage resulting from a new tool release - Enables automated vulnerability alerts This is especially important for the github-label-sync tool, since it is making irreversible writes to the GitHub repository.
2022-12-16 15:40:05 -08:00
parent 3bb910ef88
commit 8aba048b49
4 changed files with 1789 additions and 24 deletions
@@ -1,26 +1,32 @@
-# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/sync-labels.md
+# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/sync-labels-npm.md
 name: Sync Labels

-# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
+env:
+  # See: https://github.com/actions/setup-node/#readme
+  NODE_VERSION: 16.x
+  CONFIGURATIONS_FOLDER: .github/label-configuration-files
+  CONFIGURATIONS_ARTIFACT: label-configuration-files
+
+# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
 on:
  push:
    paths:
-      - ".github/workflows/sync-labels.ya?ml"
+      - ".github/workflows/sync-labels-npm.ya?ml"
      - ".github/label-configuration-files/*.ya?ml"
+      - "package.json"
+      - "package-lock.json"
  pull_request:
    paths:
-      - ".github/workflows/sync-labels.ya?ml"
+      - ".github/workflows/sync-labels-npm.ya?ml"
      - ".github/label-configuration-files/*.ya?ml"
+      - "package.json"
+      - "package-lock.json"
  schedule:
    # Run daily at 8 AM UTC to sync with changes to shared label configurations.
    - cron: "0 8 * * *"
  workflow_dispatch:
  repository_dispatch:

-env:
-  CONFIGURATIONS_FOLDER: .github/label-configuration-files
-  CONFIGURATIONS_ARTIFACT: label-configuration-files
-
 jobs:
  check:
    runs-on: ubuntu-latest
@@ -29,6 +35,11 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@v3

+      - name: Setup Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
      - name: Download JSON schema for labels configuration file
        id: download-schema
        uses: carlosperate/download-file-action@v2
@@ -37,20 +48,19 @@ jobs:
          location: ${{ runner.temp }}/label-configuration-schema

      - name: Install JSON schema validator
-        run: |
-          sudo npm install \
-            --global \
-            ajv-cli \
-            ajv-formats
+        run: npm install

      - name: Validate local labels configuration
        run: |
          # See: https://github.com/ajv-validator/ajv-cli#readme
-          ajv validate \
-            --all-errors \
-            -c ajv-formats \
-            -s "${{ steps.download-schema.outputs.file-path }}" \
-            -d "${{ env.CONFIGURATIONS_FOLDER }}/*.{yml,yaml}"
+          npx \
+            --package=ajv-cli \
+            --package=ajv-formats \
+            ajv validate \
+              --all-errors \
+              -c ajv-formats \
+              -s "${{ steps.download-schema.outputs.file-path }}" \
+              -d "${{ env.CONFIGURATIONS_FOLDER }}/*.{yml,yaml}"

  download:
    needs: check
@@ -86,7 +96,7 @@ jobs:
    steps:
      - name: Set environment variables
        run: |
-          # See: https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
+          # See: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable
          echo "MERGED_CONFIGURATION_PATH=${{ runner.temp }}/labels.yml" >> "$GITHUB_ENV"

      - name: Determine whether to dry run
@@ -119,6 +129,11 @@ jobs:
        with:
          name: ${{ env.CONFIGURATIONS_ARTIFACT }}

+      - name: Setup Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
      - name: Merge label configuration files
        run: |
          # Merge all configuration files
@@ -126,14 +141,15 @@ jobs:
          cat "${{ env.CONFIGURATIONS_FOLDER }}"/*.@(yml|yaml) > "${{ env.MERGED_CONFIGURATION_PATH }}"

      - name: Install github-label-sync
-        run: sudo npm install --global github-label-sync
+        run: npm install

      - name: Sync labels
        env:
          GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # See: https://github.com/Financial-Times/github-label-sync
-          github-label-sync \
-            --labels "${{ env.MERGED_CONFIGURATION_PATH }}" \
-            ${{ steps.dry-run.outputs.flag }} \
-            ${{ github.repository }}
+          npx \
+            github-label-sync \
+              --labels "${{ env.MERGED_CONFIGURATION_PATH }}" \
+              ${{ steps.dry-run.outputs.flag }} \
+              ${{ github.repository }}
@@ -11,6 +11,7 @@
 [![Spell Check status](https://github.com/arduino/setup-task/actions/workflows/spell-check-task.yml/badge.svg)](https://github.com/arduino/setup-task/actions/workflows/spell-check-task.yml)
 [![Check License status](https://github.com/arduino/setup-task/actions/workflows/check-license.yml/badge.svg)](https://github.com/arduino/setup-task/actions/workflows/check-license.yml)
 [![Check npm Dependencies status](https://github.com/arduino/setup-task/actions/workflows/check-npm-dependencies-task.yml/badge.svg)](https://github.com/arduino/setup-task/actions/workflows/check-npm-dependencies-task.yml)
+[![Sync Labels status](https://github.com/arduino/setup-task/actions/workflows/sync-labels-npm.yml/badge.svg)](https://github.com/arduino/setup-task/actions/workflows/sync-labels-npm.yml)

 A [GitHub Actions](https://docs.github.com/en/actions) action that makes the [Task](https://taskfile.dev/#/) task runner / build tool available to use in your workflow.

@@ -29,11 +29,14 @@
    "@typescript-eslint/eslint-plugin": "^5.46.1",
    "@typescript-eslint/parser": "^5.46.1",
    "@vercel/ncc": "^0.36.0",
+    "ajv-cli": "^5.0.0",
+    "ajv-formats": "^2.1.1",
    "eslint": "^8.29.0",
    "eslint-config-airbnb-base": "^15.0.0",
    "eslint-config-airbnb-typescript": "^17.0.0",
    "eslint-config-prettier": "^8.5.0",
    "eslint-plugin-import": "^2.26.0",
+    "github-label-sync": "2.2.0",
    "jest": "^28.1.3",
    "jest-circus": "^29.3.1",
    "nock": "^13.2.9",