Victor Lyuboslavsky
5550d01611
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41198 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated GitHub Actions dependencies to latest stable versions across CI/CD workflows for improved reliability, security, and performance. * Enhanced build provenance attestation configuration for macOS, Linux, and Windows builds. * **Security** * Strengthened workflow validation by removing override exception for build artifact version mismatch rules, ensuring stricter security compliance. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
83 lines
2.8 KiB
YAML
83 lines
2.8 KiB
YAML
name: Collect engineering metrics
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 9 * * *' # Run at 4am CDT (9am UTC)
|
|
workflow_dispatch: # Allow manual triggering
|
|
|
|
# This allows a subsequently queued workflow run to interrupt previous runs
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read # fetch repo metadata
|
|
pull-requests: read # read PR timelines
|
|
|
|
env:
|
|
# Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
|
|
NPM_CONFIG_MIN_RELEASE_AGE: 0.5
|
|
|
|
jobs:
|
|
collect-metrics:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: '24.14.0'
|
|
cache: 'npm'
|
|
cache-dependency-path: .github/actions/eng-metrics/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
working-directory: .github/actions/eng-metrics
|
|
run: npm ci
|
|
|
|
- name: Create service account key file
|
|
working-directory: .github/actions/eng-metrics
|
|
run: |
|
|
echo '${{ secrets.ENG_METRICS_GCP_SERVICE_ACCOUNT_KEY }}' > service-account-key.json
|
|
# Verify the file is valid JSON and is a top-level object
|
|
if ! jq 'type == "object"' service-account-key.json | grep -q true; then
|
|
echo "Error: service-account-key.json is either invalid JSON or not a JSON object"
|
|
echo "Is ENG_METRICS_GCP_SERVICE_ACCOUNT_KEY secret properly set?"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Collect and upload engineering metrics
|
|
uses: ./.github/actions/eng-metrics
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
SERVICE_ACCOUNT_KEY_PATH: './service-account-key.json'
|
|
|
|
- name: Slack notification
|
|
if: github.event_name == 'schedule' && failure()
|
|
uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
|
|
with:
|
|
payload: |
|
|
{
|
|
"text": "${{ job.status }}",
|
|
"blocks": [
|
|
{
|
|
"type": "section",
|
|
"text": {
|
|
"type": "mrkdwn",
|
|
"text": "Collect engineering metrics result: ${{ job.status }}\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
env:
|
|
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
|
|
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
|