Re-mint the da-cc site token in-run when expired #517
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Run Nala Tests | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| types: [opened, synchronize, labeled, unlabeled] | |
| # Prevent multiple runs from happening at the same time | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check-paths: | |
| name: Check Changed Paths | |
| runs-on: ubuntu-latest | |
| outputs: | |
| is-trivial: ${{ steps.filter.outputs.trivial }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect trivial-only changes | |
| id: filter | |
| uses: ./.github/actions/detect-trivial | |
| with: | |
| base-ref: ${{ github.event.pull_request.base.ref }} | |
| nala-gate: | |
| name: Nala Gate | |
| needs: check-paths | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Fail if check-paths did not succeed | |
| if: needs.check-paths.result != 'success' | |
| run: | | |
| echo "::error::check-paths job did not succeed (result: ${{ needs.check-paths.result }})" | |
| exit 1 | |
| - name: Pass gate for trivial PRs | |
| if: needs.check-paths.outputs.is-trivial == 'true' | |
| run: echo "Trivial PR — skipping Nala gate" | |
| - name: Require 'run nala' label | |
| # Bypass only via git-computed is-trivial (check-paths), not the mutable 'trivial' label. | |
| if: | | |
| needs.check-paths.outputs.is-trivial != 'true' && | |
| github.event.action != 'opened' && | |
| !contains(github.event.pull_request.labels.*.name, 'run nala') | |
| run: | | |
| echo "::error::Add the 'run nala' label to merge this PR" | |
| exit 1 | |
| run-nala-studio-tests: | |
| name: Running Nala Studio E2E UI Tests | |
| needs: [nala-gate, check-paths] | |
| if: | | |
| needs.nala-gate.result == 'success' && | |
| needs.check-paths.outputs.is-trivial != 'true' && | |
| (github.event.action == 'opened' || | |
| contains(github.event.pull_request.labels.*.name, 'run nala')) | |
| runs-on: [self-hosted, Linux, X64] | |
| timeout-minutes: 45 # Prevent hanging jobs | |
| strategy: | |
| matrix: | |
| node-version: [20.x] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 2 | |
| - name: Set up Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'npm' | |
| cache-dependency-path: | | |
| **/package-lock.json | |
| **/yarn.lock | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Cache Playwright browsers | |
| uses: actions/cache@v4 | |
| id: playwright-cache | |
| continue-on-error: true | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: playwright-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}-${{ hashFiles('**/playwright.config.js') }} | |
| - name: Install Playwright system dependencies | |
| uses: ./.github/actions/prep-apt | |
| - name: Install/verify Playwright browsers | |
| run: | | |
| # Always run this - it's idempotent and fast when browsers are already correct | |
| # It checks version compatibility and only installs if browsers are missing or outdated | |
| npx playwright install | |
| - name: Set execute permission for gh.run.sh | |
| run: chmod +x ./nala/utils/gh.run.sh | |
| - name: Run Nala Studio Tests via gh.run.sh | |
| run: ./nala/utils/gh.run.sh | |
| env: | |
| labels: "@mas-studio ${{ join(github.event.pull_request.labels.*.name, ' ') }}" | |
| branch: ${{ github.event.pull_request.head.ref }} | |
| repoName: ${{ github.repository }} | |
| prUrl: ${{ github.event.pull_request.head.repo.html_url }} | |
| prOrg: ${{ github.event.pull_request.head.repo.owner.login }} | |
| prRepo: ${{ github.event.pull_request.head.repo.name }} | |
| prBranch: ${{ github.event.pull_request.head.ref }} | |
| prBaseBranch: ${{ github.event.pull_request.base.ref }} | |
| GITHUB_ACTION_PATH: ${{ github.workspace }} | |
| IMS_EMAIL: ${{ secrets.IMS_EMAIL }} | |
| IMS_PASS: ${{ secrets.IMS_PASS }} | |
| FORCE_COLOR: 3 # Force color output | |
| # studio:3 + docs:1 = 4 workers × 45 RPS = 180 RPS, safely under 200 RPS EDS limit. | |
| # Both jobs share the same self-hosted runner pool — 4 total workers = 4 vCPUs. | |
| NALA_PLAYWRIGHT_WORKERS: 3 | |
| - name: Cleanup cloned cards | |
| if: always() | |
| run: node -e " | |
| import('./nala/utils/global.teardown.js') | |
| .then(module => module.default()) | |
| .catch(err => { | |
| console.error('Cleanup failed:', err.message); | |
| process.exit(1); | |
| });" | |
| env: | |
| GITHUB_ACTION_PATH: ${{ github.workspace }} | |
| IMS_EMAIL: ${{ secrets.IMS_EMAIL }} | |
| IMS_PASS: ${{ secrets.IMS_PASS }} | |
| run-nala-docs-tests: | |
| name: Running Nala Docs E2E UI Tests | |
| needs: [nala-gate, check-paths] | |
| if: | | |
| needs.nala-gate.result == 'success' && | |
| needs.check-paths.outputs.is-trivial != 'true' && | |
| (github.event.action == 'opened' || | |
| contains(github.event.pull_request.labels.*.name, 'run nala')) | |
| runs-on: [self-hosted, Linux, X64] | |
| timeout-minutes: 20 # Prevent hanging jobs | |
| strategy: | |
| matrix: | |
| node-version: [20.x] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Fetch base branch for diff | |
| env: | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| run: git fetch origin "${BASE_REF}" | |
| - name: Detect io/www changes | |
| id: filter | |
| env: | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| run: | | |
| if git diff --quiet "origin/${BASE_REF}...HEAD" -- io/www/ 2>/dev/null; then | |
| echo "io-www=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "io-www=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Set up Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'npm' | |
| cache-dependency-path: | | |
| **/package-lock.json | |
| **/yarn.lock | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Cache Playwright browsers | |
| uses: actions/cache@v4 | |
| id: playwright-cache | |
| continue-on-error: true | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: playwright-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}-${{ hashFiles('**/playwright.config.js') }} | |
| # Docs tests run on GitHub-hosted runners (ubuntu-latest) — no unattended-upgrades | |
| # lock contention, so the prep-apt composite action is not needed here. | |
| - name: Install Playwright system dependencies | |
| if: steps.playwright-cache.outputs.cache-hit != 'true' | |
| run: npx playwright install-deps | |
| - name: Install/verify Playwright browsers | |
| run: | | |
| # Always run this - it's idempotent and fast when browsers are already correct | |
| # It checks version compatibility and only installs if browsers are missing or outdated | |
| npx playwright install | |
| - name: Set execute permission for gh.run.sh | |
| run: chmod +x ./nala/utils/gh.run.sh | |
| - name: Set MAS_IO_URL when io/www has changes | |
| if: steps.filter.outputs.io-www == 'true' | |
| env: | |
| ACTOR_NS: ${{ secrets[format('AIO_NS_{0}', github.event.pull_request.user.login)] }} | |
| ACTOR_LOGIN: ${{ github.event.pull_request.user.login }} | |
| run: | | |
| if [ -z "$ACTOR_NS" ]; then | |
| echo "::error::Missing AIO namespace secret AIO_NS_${ACTOR_LOGIN} for PR author" | |
| exit 1 | |
| fi | |
| echo "Using AIO namespace for PR author ${ACTOR_LOGIN}" | |
| echo "MAS_IO_URL=?mas-io-url=https://${ACTOR_NS}.adobeioruntime.net/api/v1/web/MerchAtScale" >> "$GITHUB_ENV" | |
| - name: Run Nala Docs Tests via gh.run.sh | |
| run: ./nala/utils/gh.run.sh | |
| env: | |
| labels: "@mas-docs ${{ join(github.event.pull_request.labels.*.name, ' ') }}" | |
| branch: ${{ github.event.pull_request.head.ref }} | |
| repoName: ${{ github.repository }} | |
| prUrl: ${{ github.event.pull_request.head.repo.html_url }} | |
| prOrg: ${{ github.event.pull_request.head.repo.owner.login }} | |
| prRepo: ${{ github.event.pull_request.head.repo.name }} | |
| prBranch: ${{ github.event.pull_request.head.ref }} | |
| prBaseBranch: ${{ github.event.pull_request.base.ref }} | |
| GITHUB_ACTION_PATH: ${{ github.workspace }} | |
| FORCE_COLOR: 3 # Force color output | |
| NALA_PLAYWRIGHT_WORKERS: 1 |