Skip to content

Commit 696de02

Browse files
sra-hubsra-hub
authored
Merge branch 'master' into feature-ha-config
2 parents d984446 + 4b9001c commit 696de02

18 files changed

Lines changed: 5235 additions & 978 deletions

‎.github/workflows/deploy-live.yml‎

Lines changed: 30 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,14 @@ on:
44
push:
55
branches: [ master ]
66
workflow_dispatch:
7-
7+
8+
concurrency:
9+
group: deploy-live
10+
cancel-in-progress: false
11+
812
jobs:
913
build:
10-
if: github.repository_owner == 'PaloAltoNetworks'
14+
if: github.repository_owner == 'PaloAltoNetworks' && github.ref == 'refs/heads/master'
1115
name: Build
1216
runs-on: pan-dev-runner-xl
1317
permissions:
@@ -16,6 +20,8 @@ jobs:
1620
steps:
1721
- name: Checkout repository
1822
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
23+
with:
24+
persist-credentials: false
1925

2026
- name: Setup node
2127
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
@@ -44,7 +50,7 @@ jobs:
4450
# pandev-live
4551

4652
- name: Install dependencies
47-
run: yarn --prefer-offline
53+
run: yarn --prefer-offline --frozen-lockfile --ignore-scripts
4854

4955
# needed for fetching Hashicorp blog feed
5056
- name: Cache Playwright
@@ -53,9 +59,9 @@ jobs:
5359
with:
5460
path: |
5561
~/.cache/ms-playwright
56-
key: ${{ runner.os }}-playwright-${{ hashFiles('package.json') }}
62+
key: ${{ runner.os }}-playwright-master-${{ hashFiles('package.json') }}
5763
restore-keys: |
58-
${{ runner.os }}-playwright-
64+
${{ runner.os }}-playwright-master-
5965
6066
- name: Install Playwright
6167
if: steps.playwright-cache.outputs.cache-hit != 'true'
@@ -64,7 +70,18 @@ jobs:
6470
npx playwright install-deps chromium
6571
6672
- name: Build site
67-
run: REACT_APP_ERROR_REPORTER_APIKEY=${{ secrets.ERROR_REPORTER_APIKEY }} REACT_APP_FIREBASE_APIKEY=${{ secrets.FIREBASE_APIKEY }} REACT_APP_RECAPTCHA_APIKEY=${{ secrets.RECAPTCHA_APIKEY }} FEED_SOFT_FAIL=1 FEED_DEBUG=1 yarn build-github && zip -r build.zip build
73+
run: |
74+
FEED_SOFT_FAIL=1 FEED_DEBUG=1 yarn build-github
75+
rm -f build.zip
76+
zip -r build.zip build
77+
env:
78+
REACT_APP_ERROR_REPORTER_APIKEY: ${{ secrets.ERROR_REPORTER_APIKEY }}
79+
80+
- name: Verify build did not modify critical files
81+
run: |
82+
git diff --exit-code -- \
83+
firebase.json .firebaserc package.json yarn.lock docusaurus.config.ts \
84+
'scripts/**' '.github/**' 'src/theme/**' 'plugin-sitemap-coveo/**'
6885
6986
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
7087
with:
@@ -74,14 +91,19 @@ jobs:
7491
deploy:
7592
name: Deploy
7693
needs: build
94+
if: github.repository_owner == 'PaloAltoNetworks' && github.ref == 'refs/heads/master'
7795
runs-on: pan-dev-runner-lg
96+
environment: production
7897
permissions:
98+
contents: read
7999
id-token: write
80100

81101
steps:
82102
- name: Checkout repository
83103
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
84-
104+
with:
105+
persist-credentials: false
106+
85107
- name: Setup node
86108
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
87109
with:
@@ -93,7 +115,7 @@ jobs:
93115
name: build
94116

95117
- name: Unzip build artifact
96-
run: unzip build.zip
118+
run: unzip -n build.zip 'build/*'
97119

98120
- name: Authenticate to Google Cloud
99121
id: auth
@@ -109,10 +131,6 @@ jobs:
109131
echo "::add-mask::$creds"
110132
echo "sa_key=$creds" >> "$GITHUB_OUTPUT"
111133
112-
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
113-
with:
114-
name: build
115-
116134
- name: Deploy to Firebase
117135
id: deploy_live
118136
uses: FirebaseExtended/action-hosting-deploy@e2eda2e106cfa35cdbcf4ac9ddaf6c4756df2c8c # v0.10.0

‎.github/workflows/deploy-preview.yml‎

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,28 +14,36 @@ jobs:
1414
outputs:
1515
is-org-member-result: ${{ steps.is-org-member.outputs.is-org-member-result }}
1616
steps:
17-
- name: Check if actor is org member
17+
- name: Check if PR head is trusted
1818
id: is-org-member
1919
run: |
20-
if [[ "${{ github.actor }}" == "create-pr-on-fork-for-pan-dev[bot]" ]]; then
20+
if [[ "$PR_AUTHOR" == "create-pr-on-fork-for-pan-dev[bot]" ]]; then
2121
echo "is-org-member-result=true" >> "$GITHUB_OUTPUT"
2222
exit 0
2323
fi
2424
25-
if [ "${{ github.actor }}" = "dependabot[bot]" ]; then
25+
if [[ "$PR_AUTHOR" == "dependabot[bot]" ]]; then
26+
echo "is-org-member-result=false" >> "$GITHUB_OUTPUT"
27+
exit 0
28+
fi
29+
30+
if [[ "$HEAD_REPO" != "$BASE_REPO" ]]; then
2631
echo "is-org-member-result=false" >> "$GITHUB_OUTPUT"
2732
exit 0
2833
fi
2934
3035
status=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $GH_TOKEN" \
31-
https://api.github.com/orgs/PaloAltoNetworks/members/${{ github.actor }})
32-
if [ "$status" = "204" ]; then
36+
"https://api.github.com/orgs/PaloAltoNetworks/members/$PR_AUTHOR")
37+
if [[ "$status" == "204" ]]; then
3338
echo "is-org-member-result=true" >> "$GITHUB_OUTPUT"
3439
else
3540
echo "is-org-member-result=false" >> "$GITHUB_OUTPUT"
3641
fi
3742
env:
3843
GH_TOKEN: ${{ secrets.READ_ORG_PAT }}
44+
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
45+
HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
46+
BASE_REPO: ${{ github.repository }}
3947

4048
analyze:
4149
if: github.repository == 'PaloAltoNetworks/pan.dev' && needs.precheck.outputs.is-org-member-result == 'true'
@@ -56,6 +64,7 @@ jobs:
5664
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
5765
with:
5866
ref: ${{ github.event.pull_request.head.sha }}
67+
persist-credentials: false
5968

6069
- name: Initialize CodeQL
6170
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v3
@@ -86,6 +95,7 @@ jobs:
8695
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
8796
with:
8897
ref: ${{ github.event.pull_request.head.sha }}
98+
persist-credentials: false
8999

90100
- name: Initialize CodeQL
91101
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v3
@@ -112,6 +122,7 @@ jobs:
112122
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
113123
with:
114124
ref: ${{ github.event.pull_request.head.sha }}
125+
persist-credentials: false
115126

116127
- name: Setup node
117128
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
@@ -183,13 +194,11 @@ jobs:
183194
# needed for fetching Hashicorp blog feed
184195
- name: Cache Playwright
185196
id: playwright-cache
186-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
197+
uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
187198
with:
188199
path: |
189200
~/.cache/ms-playwright
190201
key: ${{ runner.os }}-playwright-${{ hashFiles('package.json') }}
191-
restore-keys: |
192-
${{ runner.os }}-playwright-
193202

194203
- name: Install Playwright
195204
if: steps.playwright-cache.outputs.cache-hit != 'true'
@@ -200,6 +209,12 @@ jobs:
200209
- name: Build site
201210
run: FEED_SOFT_FAIL=1 FEED_DEBUG=1 yarn build-github
202211

212+
- name: Verify build did not modify critical files
213+
run: |
214+
git diff --exit-code -- \
215+
firebase.json .firebaserc package.json yarn.lock docusaurus.config.ts \
216+
'scripts/**' '.github/**' 'src/theme/**' 'plugin-sitemap-coveo/**'
217+
203218
- name: Zip build directory
204219
run: |
205220
if [ -d "build" ]; then
@@ -210,8 +225,9 @@ jobs:
210225
echo "Error: 'build' directory not found in current directory or in websites/pan-dev/"
211226
exit 1
212227
fi
213-
228+
214229
echo "Build directory found at: $BUILD_DIR"
230+
rm -f build.zip
215231
zip -r build.zip "$BUILD_DIR"
216232
217233
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
@@ -224,6 +240,7 @@ jobs:
224240
needs: build
225241
if: ${{ github.repository == 'PaloAltoNetworks/pan.dev' && !failure() && !cancelled() }}
226242
runs-on: pan-dev-runner-lg
243+
environment: preview
227244
permissions:
228245
contents: read
229246
pull-requests: write
@@ -233,6 +250,8 @@ jobs:
233250
steps:
234251
- name: Checkout repository
235252
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
253+
with:
254+
persist-credentials: false
236255

237256
- name: Setup node
238257
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4
@@ -246,7 +265,7 @@ jobs:
246265

247266
- name: Unzip build artifact
248267
run: |
249-
unzip build.zip
268+
unzip -n build.zip 'build/*' || unzip -n build.zip 'websites/pan-dev/build/*'
250269
if [ -d "build" ]; then
251270
DEPLOY_DIR="."
252271
elif [ -d "websites/pan-dev/build" ]; then
@@ -272,10 +291,6 @@ jobs:
272291
echo "::add-mask::$creds"
273292
echo "sa_key=$creds" >> "$GITHUB_OUTPUT"
274293
275-
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
276-
with:
277-
name: build
278-
279294
- name: Deploy to Firebase
280295
id: deploy_preview
281296
uses: FirebaseExtended/action-hosting-deploy@e2eda2e106cfa35cdbcf4ac9ddaf6c4756df2c8c # v0.10.0

‎CODEOWNERS‎

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,29 @@
11
# pan.dev Admins
2-
src/* @PaloAltoNetworks/pan-dev
3-
package.json @PaloAltoNetworks/pan-dev
4-
.github/* @PaloAltoNetworks/pan-dev
5-
firebase.json @PaloAltoNetworks/pan-dev
2+
/.github/ @PaloAltoNetworks/pan-dev
3+
/src/ @PaloAltoNetworks/pan-dev
4+
/scripts/ @PaloAltoNetworks/pan-dev
5+
/plugin-sitemap-coveo/ @PaloAltoNetworks/pan-dev
6+
/package.json @PaloAltoNetworks/pan-dev
7+
/yarn.lock @PaloAltoNetworks/pan-dev
8+
/docusaurus.config.* @PaloAltoNetworks/pan-dev
9+
/firebase.json @PaloAltoNetworks/pan-dev
10+
/.firebaserc @PaloAltoNetworks/pan-dev
11+
/CODEOWNERS @PaloAltoNetworks/pan-dev
612

713
# pan.dev SASE team
8-
products/sase/* @PaloAltoNetworks/pan-dev-sase
9-
openapi-specs/sase/* @PaloAltoNetworks/pan-dev-sase
14+
products/sase/ @PaloAltoNetworks/pan-dev-sase
15+
openapi-specs/sase/ @PaloAltoNetworks/pan-dev-sase
1016

1117
# pan.dev PAN-OS and Everything-as-code team
12-
products/terraform/* @PaloAltoNetworks/design-hive
13-
products/ansible/* @PaloAltoNetworks/design-hive
14-
products/panos/* @PaloAltoNetworks/design-hive
15-
products/splunk/* @PaloAltoNetworks/design-hive
18+
products/terraform/ @PaloAltoNetworks/design-hive
19+
products/ansible/ @PaloAltoNetworks/design-hive
20+
products/panos/ @PaloAltoNetworks/design-hive
21+
products/splunk/ @PaloAltoNetworks/design-hive
1622

1723
# SWFW "Orchestration Hub"
18-
products/terraform/docs/swfw/* @PaloAltoNetworks/pso_prisma_maintainers
24+
products/terraform/docs/swfw/ @PaloAltoNetworks/pso_prisma_maintainers
1925
products/terraform/sidebars.ts @PaloAltoNetworks/pso_prisma_maintainers
2026

2127
# Prisma Cloud team
22-
openapi-specs/cspm/* @PaloAltoNetworks/pan-dev-prisma-cloud
23-
products/prisma-cloud/* @PaloAltoNetworks/pan-dev-prisma-cloud
28+
openapi-specs/cspm/ @PaloAltoNetworks/pan-dev-prisma-cloud
29+
products/prisma-cloud/ @PaloAltoNetworks/pan-dev-prisma-cloud

0 commit comments

Comments
 (0)