Merge branch 'main' into chore/upgrade-helm-build

.dockerignore

@@ -1,8 +1,38 @@
-node_modules/
-dist/
-scripts/ci/
+# vi: ft=gitignore
+
+# Known ignores
+/.github/
+/.git/
+/scripts/ci/
+/.env.*
+/.envrc*
+/.nx/
+
+# Cache and packages
+**/node_modules/
+# Ignoring _all_ cache folders dosen't work, because we have libraries named `cache`
+# **/cache/
+/.yarn/cache/
+/.yarn/install-state*
+# Ignores e.g. `cache/` and `cache_outptut/`
 /cache*
-cache/
-.git/
-log/
-*.log
+/.cache*/
+
+# Logs and temporaries
+**/log/
+**/*.log
+**/tmp/
+**/temp/
+**/.next/
+
+# Outputs
+**/dist/
+**/out/
+
+# Docker-stuff
+**/Dockerfile
+**/Dockerfile.*
+**/Containerfile
+**/Containerfile.*
+**/*-compose.yaml
+**/*-compose.yml

.github/actions/get-cache/action.yml

@@ -4,6 +4,9 @@ inputs:
   github-token:
     description: 'GitHub token'
     required: true
+  cache-url:
+    description: 'Cache URL'
+    default: 'https://cache.dev01.devland.is/'
   enable-cache:
     description: 'Enable cache'
     default: ''
@@ -18,12 +21,15 @@ runs:
   using: 'composite'
   steps:
     - name: Adding required env vars
+      # Skip when running locally
+      if: ${{ !github.event.localrun }}
       uses: actions/github-script@v7
       env:
+        cache-url: ${{ inputs.cache-url }}
         github-token: ${{ inputs.GITHUB_TOKEN }}
       with:
         script: |
-          core.exportVariable('ACTIONS_CACHE_URL', 'https://cache.dev01.devland.is/')
+          core.exportVariable('ACTIONS_CACHE_URL', process.env['cache-url'])
           core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])
           core.exportVariable('ACTIONS_RUNTIME_URL', process.env['ACTIONS_RUNTIME_URL'])
     - name: Get cache
@@ -35,8 +41,8 @@ runs:
         NODE_OPTIONS: --max-old-space-size=8192
       run: |
         # This is because of a weird bug where Github would write as root to .cache
-        export COREPACK_HOME=/github/home/.corepack-cache
-        export CYPRESS_CACHE_FOLDER=/github/home/.cypress-cache
+        export COREPACK_HOME="$HOME/.corepack-cache"
+        export CYPRESS_CACHE_FOLDER="$HOME/.cypress-cache"
         echo "COREPACK_HOME=$COREPACK_HOME" >> $GITHUB_ENV
         echo "CYPRESS_CACHE_FOLDER=$CYPRESS_CACHE_FOLDER" >> $GITHUB_ENV
         cd scripts/ci/cache

.github/workflows/dd-metrics.yml

@@ -0,0 +1,34 @@
+on:
+  workflow_run:
+    workflows:
+      - '**'
+    types:
+      - completed
+  pull_request:
+    types:
+      - opened
+      - closed
+      - synchronize
+      - labeled
+  push:
+    branches:
+      - main
+
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  pull-requests: read
+
+jobs:
+  send:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: int128/datadog-actions-metrics@v1
+        with:
+          collect-job-metrics: true
+          collect-step-metrics: true
+          datadog-api-key: ${{ secrets.DD_API_KEY }}
+          datadog-site: datadoghq.eu
+          send-pull-request-labels: true

.github/workflows/merge-queue.yml

@@ -0,0 +1,31 @@
+name: Validate code in the merge queue (post merge)
+
+on:
+  workflow_dispatch:
+  merge_group:
+
+jobs:
+  success:
+    runs-on: ec2-runners
+    container:
+      image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest
+    steps:
+      - name: Dump GitHub context
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: |
+          echo "$GITHUB_CONTEXT"
+      - name: Announce success
+        run: echo "Build is successful"
+  codeowners-check:
+    name: Lint CODEOWNERS
+    runs-on: ec2-runners
+    env:
+      CHECK: 'false'
+    container:
+      image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest
+
+    steps:
+      - name: Codeowners validation
+        run: |
+          exit 0

.github/workflows/pullrequest.yml

@@ -17,6 +17,11 @@ env:
   COMPOSE_HTTP_TIMEOUT: 180
   SKIP_GENERATED_CACHE: ${{ contains(github.event.pull_request.labels.*.name, 'skip-generated-cache') }}
   NX_AFFECTED_ALL: ${{ contains(github.event.pull_request.labels.*.name, 'nx-affected-all') }}
+  CHUNK_SIZE: ${{ vars.CHUNK_SIZE || 8 }}
+  DISABLE_CHUNKS: ${{ vars.DISABLE_CHUNKS || true }}
+  MAX_JOBS: ${{ vars.MAX_JOBS || 10 }}
+  NX_PARALLEL: ${{ vars.NX_PARALLEL || 15 }}
+  NX_MAX_PARALLEL: ${{ vars.NX_MAX_PARALLEL || 15 }}
 
 jobs:
   prepare:
@@ -27,7 +32,6 @@ jobs:
 
     env:
       AFFECTED_ALL: ${{ secrets.AFFECTED_ALL }}
-      CHUNK_SIZE: 7
       SERVERSIDE_FEATURES_ON: ''
       DOCKER_REGISTRY: 821090935708.dkr.ecr.eu-west-1.amazonaws.com/
       DOCKER_BASE_IMAGE_REGISTRY: 821090935708.dkr.ecr.eu-west-1.amazonaws.com/ecr-public
@@ -40,9 +44,17 @@ jobs:
       BUILD_CHUNKS: ${{ steps.build_projects.outputs.CHUNKS }}
       CACHE_KEYS: ${{ steps.get-cache.outputs.keys }}
     steps:
+      # Creates homedir if missing (e.g. when set to /tmp/runner/ when running locally with act)
+      - name: Debug home etc.
+        run: |
+          echo "User: HOME=$HOME, PWD=$PWD, id=$(id)"
+          mkdir -p "$HOME"
+          ls -lah "$HOME"
+
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - uses: actions/setup-node@v4
         with:
           node-version-file: 'package.json'
@@ -54,13 +66,21 @@ jobs:
         run: |
           set -euo pipefail
           node -v
-          ls -l `which node`
+          yarn --version
+          ls -l "$(which node)"
+
       - name: Checking out relevant branches
         run: |
           set -euo pipefail
-          git checkout "$GITHUB_HEAD_REF"
-          git checkout "$GITHUB_BASE_REF"
-          git checkout "$GITHUB_SHA"
+          echo "CHUNK_SIZE: $CHUNK_SIZE"
+          echo "MAX_JOBS: $MAX_JOBS"
+          echo "NX_PARALLEL: $NX_PARALLEL"
+          set -x
+
+          git checkout -m "$GITHUB_HEAD_REF"
+          git checkout -m "$GITHUB_BASE_REF"
+          git checkout -m "$GITHUB_SHA"
+
           git config --global user.email "[email protected]"
           git config --global user.name "CI Bot"
 
@@ -74,6 +94,8 @@ jobs:
       # https://github.blog/changelog/2020-10-08-github-actions-ability-to-change-retention-days-for-artifacts-and-logs/
       - name: Keep PR run event
         uses: actions/upload-artifact@b18b1d32f3f31abcdc29dee3f2484801fe7822f4
+        # Don't run this step locally
+        if: ${{ !github.event.localrun }}
         with:
           name: pr-event
           path: event.json
@@ -88,7 +110,12 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           enable-cache: 'node_modules,cypress,generated-files'
 
-      - run: |
+      - name: Preparing HEAD and BASE tags
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HTML_URL: ${{ github.event.pull_request.html_url }}
+          ISSUE_REPORTING_SLACK_WEBHOOK_URL: ${{ secrets.SLACK_BUILD_ISSUES_REPORTING_WEBHOOK_URL }}
+        run: |
           set -euo pipefail
           echo "HEAD=$GITHUB_SHA" >> "$GITHUB_ENV"
           export HEAD_REF="$GITHUB_HEAD_REF"
@@ -99,41 +126,46 @@ jobs:
           source ./scripts/ci/00_prepare-base-tags.sh "$(git merge-base HEAD "$GITHUB_BASE_REF")"
           git checkout "$GITHUB_SHA"
           echo "BASE=$BASE" >> "$GITHUB_ENV"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HTML_URL: ${{ github.event.pull_request.html_url }}
-          ISSUE_REPORTING_SLACK_WEBHOOK_URL: ${{ secrets.SLACK_BUILD_ISSUES_REPORTING_WEBHOOK_URL }}
-        name: Preparing HEAD and BASE tags
 
       - name: License audit Node modules
         run: ./scripts/ci/20_license-audit.sh
 
       - name: Check user permissions
         uses: actions-cool/check-user-permission@v2
         id: check-permission
+        # This fails locally without a token, and only prevents "admin" label usage
+        if: ${{ !github.event.localrun }}
 
       - name: Set magic env if test-everything label is set
-        if: ${{ contains(github.event.pull_request.labels.*.name, 'test everything') && steps.check-permission.outputs['user-permission'] == 'admin' }}
+        if: ${{ contains(github.event.pull_request.labels.*.name, 'test everything') && steps.check-permission.outcome == 'success' && steps.check-permission.outputs['user-permission'] == 'admin' }}
         run: |
           echo "AFFECTED_ALL=7913-$GITHUB_HEAD_REF" >> "$GITHUB_ENV"
 
       - name: Warn if user does not have the required permissions
-        if: ${{ contains(github.event.pull_request.labels.*.name, 'test everything') && steps.check-permission.outputs['user-permission'] != 'admin' }}
+        if: ${{ contains(github.event.pull_request.labels.*.name, 'test everything') && steps.check-permission.outcome == 'success'&& steps.check-permission.outputs['user-permission'] != 'admin' }}
         run: |
           echo "## WARN permissions" >> "$GITHUB_STEP_SUMMARY"
           echo "User '$GITHUB_ACTOR' does not have the required permissions to apply the 'test everything' label" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Prepare lint targets
         id: lint_projects
+        env:
+          DISABLE_CHUNKS: 'true'
+          DISABLE_PROBLEMATIC: 'true'
+          DISABLE_GROUPING: 'true'
         run: |
           set -euo pipefail
+          echo "DISABLE_CHUNKS: $DISABLE_CHUNKS"
           CHUNKS="$(./scripts/ci/generate-chunks.sh lint)"
           if [[ "$CHUNKS" != "[]" ]]; then
             echo "CHUNKS={\"projects\":$CHUNKS}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Prepare test targets
         id: test_projects
+        env:
+          DISABLE_CHUNKS: 'true'
+          DISABLE_GROUPING: 'true'
         run: |
           set -euo pipefail
           CHUNKS="$(./scripts/ci/generate-chunks.sh test)"
@@ -156,7 +188,8 @@ jobs:
       - name: Prepare build targets
         id: build_projects
         env:
-          CHUNK_SIZE: 4
+          DISABLE_CHUNKS: 'true'
+          DISABLE_GROUPING: 'true'
         run: |
           set -euo pipefail
           CHUNKS="$(./scripts/ci/generate-chunks.sh build)"
@@ -178,10 +211,9 @@ jobs:
     runs-on: ec2-runners
     container:
       image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest
-    timeout-minutes: 35
+    timeout-minutes: 45
     env:
       AFFECTED_PROJECTS: ${{ matrix.projects }}
-      MAX_JOBS: 1
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.prepare.outputs.TEST_CHUNKS) }}
@@ -205,7 +237,8 @@ jobs:
           keys: ${{ needs.prepare.outputs.CACHE_KEYS }}
           enable-cache: 'node_modules,cypress,generated-files'
 
-      - uses: ./.github/actions/unit-test
+      - name: Run unit tests
+        uses: ./.github/actions/unit-test
         with:
           dd-api-key: '${{ secrets.DD_API_KEY }}'
           codecov-token: ${{ secrets.CODECOV_TOKEN }}
@@ -220,7 +253,7 @@ jobs:
     runs-on: ec2-runners
     container:
       image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest
-    timeout-minutes: 35
+    timeout-minutes: 45
     env:
       AFFECTED_PROJECT: ${{ matrix.projects }}
       CYPRESS_PROJECT_ID: 4q7jz8
@@ -288,8 +321,7 @@ jobs:
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-pr-review
-          fail_on_error: true
-          level: info
+          fail-level: info
           exclude: >-
             */node_modules/*
 
@@ -345,12 +377,16 @@ jobs:
     env:
       AFFECTED_PROJECTS: ${{ matrix.projects }}
       NODE_OPTIONS: --max-old-space-size=4096
-      MAX_JOBS: 3
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.prepare.outputs.LINT_CHUNKS) }}
     steps:
       - uses: actions/checkout@v4
+        if: ${{ github.event_name == 'pull_request' }}
+        # Needed for doing git commit in git-check-dirty script
+        with:
+          token: ${{ secrets.DIRTY_FIX_BOT_TOKEN }}
+          ref: ${{ github.event.pull_request.head.ref }}
       - uses: actions/setup-node@v4
         with:
           node-version-file: 'package.json'
@@ -363,6 +399,19 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           keys: ${{ needs.prepare.outputs.CACHE_KEYS }}
           enable-cache: 'node_modules,generated-files'
+      - name: Lintfix
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'dirty bypass') }}
+        run: |
+          set -euo pipefail
+          echo "Running lint --fix for affected projects: ${AFFECTED_PROJECTS}"
+          ./infra/scripts/ci/git-check-dirty.sh \
+            -p "/" \
+            -a "nx run-many --target lint --fix --parallel ${MAX_JOBS} --projects=${AFFECTED_PROJECTS//[[\]]}" \
+            -o "dirtybot" \
+            -r || {
+              echo "Error: Lintfix failed. Check the logs above for details." >&2
+              exit 1
+            }
       - name: Linting
         run: ./scripts/ci/run-in-parallel-native.sh lint
 
@@ -375,7 +424,6 @@ jobs:
     timeout-minutes: 35
     env:
       AFFECTED_PROJECTS: ${{ matrix.projects }}
-      MAX_JOBS: 2
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.prepare.outputs.BUILD_CHUNKS) }}