Merge branch 'main' into 2percentsilk/download-usage-report

Author: hubwriter

.github/actions-scripts/staging-undeploy.js

@@ -11,6 +11,7 @@ on:
 
 permissions:
   issues: write
+  pull-requests: write
 
 jobs:
   comment:

.github/workflows/merged-notification.yml

@@ -0,0 +1,30 @@
+name: 'Orphaned assets check'
+
+# **What it does**: Checks that there are no files in ./assets/ that aren't mentioned in any source file.
+# **Why we have it**: To avoid orphans into the repo.
+# **Who does it impact**: Docs content.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+
+      - name: Setup node
+        uses: actions/setup-node@04c56d2f954f1e4c69436aa54cfef261a018f458
+        with:
+          node-version: 16.13.x
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      - name: Check for orphaned assets
+        run: ./script/find-orphaned-assets.mjs --verbose --exit

.github/workflows/orphaned-assets-check.yml

@@ -0,0 +1,90 @@
+name: Production (Azure) - Build and Deploy
+
+# **What it does**: Builds and deploys the default branch to production
+# **Why we have it**: To enable us to deploy the latest to production whenever necessary rather than relying on PR merges.
+# **Who does it impact**: All contributors.
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  deployments: write
+
+# This allows a subsequently queued workflow run to take priority over
+# previously queued runs but NOT interrupt currently executing runs
+concurrency:
+  group: '${{ github.workflow }}'
+  cancel-in-progress: false
+
+jobs:
+  build-and-deploy:
+    if: ${{ github.repository == 'github/docs-internal' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      IMAGE_TAG_BASE: ${{ secrets.PROD_REGISTRY_SERVER }}/${{ github.repository }}
+
+    steps:
+      - name: 'Docker login'
+        uses: azure/docker-login@81744f9799e7eaa418697cb168452a2882ae844a
+        with:
+          login-server: ${{ secrets.PROD_REGISTRY_SERVER }}
+          username: ${{ secrets.PROD_REGISTRY_USERNAME }}
+          password: ${{ secrets.PROD_REGISTRY_PASSWORD }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@94ab11c41e45d028884a99163086648e898eed25
+
+      - name: Check out repo
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+        with:
+          ref: ${{ github.sha }}
+          # To prevent issues with cloning early access content later
+          persist-credentials: 'false'
+          lfs: 'true'
+
+      - name: Check out LFS objects
+        run: git lfs checkout
+
+      - name: Setup node
+        uses: actions/setup-node@04c56d2f954f1e4c69436aa54cfef261a018f458
+        with:
+          node-version: 16.13.x
+          cache: npm
+
+      - name: Clone early access
+        run: npm install dotenv && node script/early-access/clone-for-build.js
+        env:
+          DOCUBOT_REPO_PAT: ${{ secrets.DOCUBOT_REPO_PAT }}
+          GIT_BRANCH: main
+
+      - name: 'Build and push image'
+        uses: docker/build-push-action@a66e35b9cbcf4ad0ea91ffcaf7bbad63ad9e0229
+        with:
+          context: .
+          push: true
+          target: 'production_early_access'
+          tags: ${{ env.IMAGE_TAG_BASE }}:${{ github.sha }}, ${{ env.IMAGE_TAG_BASE }}:production
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # TODO - enable this when we disable the other production deploy
+      # - name: Purge Fastly edge cache
+      #   env:
+      #     FASTLY_TOKEN: ${{ secrets.FASTLY_TOKEN }}
+      #     FASTLY_SERVICE_ID: ${{ secrets.FASTLY_SERVICE_ID }}
+      #     FASTLY_SURROGATE_KEY: 'every-deployment'
+      #   run: npm install got && .github/actions-scripts/purge-fastly-edge-cache.js
+
+      - name: Send Slack notification if workflow failed
+        uses: someimportantcompany/github-actions-slack-message@f8d28715e7b8a4717047d23f48c39827cacad340
+        if: ${{ failure() }}
+        with:
+          channel: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
+          bot-token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
+          color: failure
+          text: Production deployment (Azure) failed at commit ${{ github.sha }}. See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/prod-build-deploy-azure.yml

@@ -4,8 +4,9 @@ name: Remove stale staging resources
 # This cleans up any rogue staging applications and environments that outlasted
 # the closure of their corresponding pull requests.
 # **Why we have it**:
-# Staging applications and environments sometimes fail to be destroyed when
-# their corresponding pull request is closed or merged.
+# Staging applications and environments should be destroyed after their
+# corresponding pull request is closed or merged, especially to save money spent
+# on Heroku App staging deployments for closed PRs.
 # **Who does it impact**:
 # Anyone with a closed, spammy, or deleted pull request in docs or docs-internal.
 
@@ -14,8 +15,10 @@ on:
     - cron: '15,45 * * * *' # every thirty minutes at :15 and :45
 
 permissions:
+  actions: read
   contents: read
-  pull-requests: read
+  deployments: write
+  pull-requests: write
 
 jobs:
   remove_stale_staging_apps:
@@ -60,5 +63,7 @@ jobs:
       - name: Run script
         run: script/remove-stale-staging-envs.js
         env:
-          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_FR }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ELEVATED_TOKEN: ${{ secrets.DOCS_BOT_FR }}
           REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}

.github/workflows/remove-stale-staging-resources.yml

@@ -25,9 +25,6 @@ permissions:
   statuses: write
 
 # This allows a subsequently queued workflow run to interrupt previous runs
-# These are different from the concurrency in that here it checks if the
-# whole workflow runs again. The "inner concurrency" is used for
-# undeployments to cleaning up resources.
 concurrency:
   group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
   cancel-in-progress: true
@@ -44,11 +41,7 @@ jobs:
     runs-on: self-hosted
 
     timeout-minutes: 5
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
-    concurrency:
-      group: 'PR Staging @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
-      cancel-in-progress: true
+
     steps:
       - name: Check out repo
         uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
@@ -85,15 +78,6 @@ jobs:
           DOCUBOT_REPO_PAT: ${{ secrets.DOCUBOT_REPO_PAT }}
           GIT_BRANCH: ${{ github.event.pull_request.head.sha }}
 
-      - name: Check that the PR isn't blocking deploys
-        # We can't use ${{...}} on this if statement because of this bug
-        # https://github.com/cschleiden/actions-linter/issues/114
-        if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'automated-block-deploy')
-        run: |
-          echo "The PR appears to have the label 'automated-block-deploy'"
-          echo "Will not proceed to deploy the PR."
-          exit 2
-
       - name: Create a Heroku build source
         id: build-source
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d

.github/workflows/staging-build-and-deploy-pr.yml

@@ -27,8 +27,7 @@ jobs:
 
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
     timeout-minutes: 5
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
+    # This interrupts Build and Deploy workflow runs in progress for this PR branch.
     concurrency:
       group: 'PR Staging @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
       cancel-in-progress: true

.github/workflows/staging-build-pr.yml

@@ -198,68 +198,12 @@ jobs:
           color: failure
           text: Staging build failed for PR ${{ needs.pr-metadata.outputs.url }} at commit ${{ needs.pr-metadata.outputs.head_sha }}. See ${{ env.BUILD_ACTIONS_RUN_LOG }}. This run was ${{ env.ACTIONS_RUN_LOG }}.
 
-  check-pr-before-prepare:
-    needs: pr-metadata
-    if: >-
-      ${{
-        needs.pr-metadata.outputs.number != '0' &&
-        github.event.workflow_run.conclusion == 'success'
-      }}
-    runs-on: ubuntu-latest
-    # This timeout should match or exceed the value of the timeout for Undeploy
-    timeout-minutes: 5
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
-    concurrency:
-      group: 'PR Staging @ ${{ needs.pr-metadata.outputs.head_label }}'
-      cancel-in-progress: true
-    outputs:
-      pull_request_state: ${{ steps.check-pr.outputs.state }}
-    steps:
-      - name: Check pull request state
-        id: check-pr
-        uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
-        env:
-          PR_NUMBER: ${{ needs.pr-metadata.outputs.number }}
-        with:
-          script: |
-            // Equivalent of the 'await-sleep' module without the install
-            const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
-
-            const blockingLabel = 'automated-block-deploy'
-            const { owner, repo } = context.repo
-            const startTime = Date.now()
-
-            let pullRequest = {}
-            let blocked = true
-
-            // Keep polling the PR until the blocking label has been removed
-            while (blocked) {
-              const { data: pr } = await github.pulls.get({
-                owner,
-                repo,
-                pull_number: process.env.PR_NUMBER
-              })
-
-              blocked = pr.labels.some(({ name }) => name === blockingLabel)
-              if (blocked) {
-                console.warn(`WARNING! PR currently has blocking label "${blockingLabel}" (after ${Date.now() - startTime} ms). Will check again soon...`)
-                await sleep(15000) // Wait 15 seconds and check again
-              } else {
-                console.log(`PR was unblocked (after ${Date.now() - startTime} ms)!`)
-                pullRequest = pr
-              }
-            }
-
-            core.setOutput('state', pullRequest.state)
-
   prepare-for-deploy:
-    needs: [pr-metadata, check-pr-before-prepare]
-    if: ${{ needs.check-pr-before-prepare.outputs.pull_request_state == 'open' }}
+    needs: pr-metadata
+    if: ${{ needs.pr-metadata.outputs.state == 'open' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
+    # This interrupts Build and Deploy workflow runs in progress for this PR branch.
     concurrency:
       group: 'PR Staging @ ${{ needs.pr-metadata.outputs.head_label }}'
       cancel-in-progress: true
@@ -395,8 +339,7 @@ jobs:
     needs: [pr-metadata, prepare-for-deploy]
     runs-on: ubuntu-latest
     timeout-minutes: 1
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
+    # This interrupts Build and Deploy workflow runs in progress for this PR branch.
     concurrency:
       group: 'PR Staging @ ${{ needs.pr-metadata.outputs.head_label }}'
       cancel-in-progress: true
@@ -423,8 +366,7 @@ jobs:
     if: ${{ needs.check-pr-before-deploy.outputs.pull_request_state == 'open' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
+    # This interrupts Build and Deploy workflow runs in progress for this PR branch.
     concurrency:
       group: 'PR Staging @ ${{ needs.pr-metadata.outputs.head_label }}'
       cancel-in-progress: true