From f5a41febd97f1a4ac58fa51c22c3612194ecf276 Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:11:17 -0700 Subject: [PATCH 01/12] ci: code freeze through github actions --- .github/code-freeze-filter.yaml | 14 ++++++++++++ .github/workflows/code-freeze.yml | 38 +++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 .github/code-freeze-filter.yaml create mode 100644 .github/workflows/code-freeze.yml diff --git a/.github/code-freeze-filter.yaml b/.github/code-freeze-filter.yaml new file mode 100644 index 0000000000..484df37f72 --- /dev/null +++ b/.github/code-freeze-filter.yaml @@ -0,0 +1,14 @@ +# Each component that is being frozen should have a section in this file. +# The `changed` section should pull all the files that are changed +# in order to put an error on the given file if it is changed. + +# Please provide a reasoning for each component that is frozen. + +# Conductor is frozen for zellic audit. +conductor: &conductor + - crates/astria-conductor/src/** +sequencer-relayer: &sequencer-relayer + - crates/astria-sequencer-relayer/src/** +changed: + - *conductor + - *sequencer-relayer diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml new file mode 100644 index 0000000000..92d000e5a5 --- /dev/null +++ b/.github/workflows/code-freeze.yml @@ -0,0 +1,38 @@ +on: + pull_request_target: + types: + - opened + - synchronize + - reopened + - labeled + - unlabeled + branches: + - main + +jobs: + code_freeze: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Filter Check + id: filters + uses: dorny/paths-filter@v3 + with: + list-files: shell + filters: .github/code-freeze-filter.yaml + - name: Code Freeze + if: steps.filters.outputs.changes != '' && !contains(github.event.pull_request.labels.*.name, 'override-freeze') + run: | + TITLE="Code Freeze in Effect" + LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" | sed 's/,/, /g') + MESSAGE=("This PR updates the following components which are code frozen:" + "$LEGIBLE_CHANGES" + "Freeze can be overriden by adding the 'override-freeze' label to the PR." + ) + echo "::error title=$TITLE::${MESSAGE[*]}" + IFS="," read -ra FILE_LIST <<< "${{ steps.filters.outputs.changes }}" + FILE_MESSAGE="This file is under code freeze." + for FILE in "${FILE_LIST[@]}"; do + echo "::error file=$FILE,title=$TITLE::$FILE_MESSAGE" + done + exit 1 From 94155b7172581223a31370f0fbf408e60afff0da Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:14:01 -0700 Subject: [PATCH 02/12] testing --- .github/workflows/code-freeze.yml | 2 +- crates/astria-sequencer-relayer/src/main.rs | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index 92d000e5a5..aac68d331b 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -1,5 +1,5 @@ on: - pull_request_target: + pull_request: types: - opened - synchronize diff --git a/crates/astria-sequencer-relayer/src/main.rs b/crates/astria-sequencer-relayer/src/main.rs index a072bf06f7..2fbd24b7e4 100644 --- a/crates/astria-sequencer-relayer/src/main.rs +++ b/crates/astria-sequencer-relayer/src/main.rs @@ -16,6 +16,7 @@ use tracing::{ warn, }; +// Testing #[tokio::main] async fn main() -> ExitCode { astria_eyre::install().expect("astria eyre hook must be the first hook installed"); From f1b0ebffcd9095cad5f89eb03d09977139a99c2f Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:18:06 -0700 Subject: [PATCH 03/12] try using changed files --- .github/workflows/code-freeze.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index aac68d331b..43b44cbd71 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -30,7 +30,7 @@ jobs: "Freeze can be overriden by adding the 'override-freeze' label to the PR." ) echo "::error title=$TITLE::${MESSAGE[*]}" - IFS="," read -ra FILE_LIST <<< "${{ steps.filters.outputs.changes }}" + IFS="," read -ra FILE_LIST <<< "${{ steps.filters.outputs.changed_files }}" FILE_MESSAGE="This file is under code freeze." for FILE in "${FILE_LIST[@]}"; do echo "::error file=$FILE,title=$TITLE::$FILE_MESSAGE" From e721a1981a72483899a8f305b579f07547f34c04 Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:29:55 -0700 Subject: [PATCH 04/12] create summary --- .github/workflows/code-freeze.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index 43b44cbd71..15d87552da 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -24,15 +24,22 @@ jobs: if: steps.filters.outputs.changes != '' && !contains(github.event.pull_request.labels.*.name, 'override-freeze') run: | TITLE="Code Freeze in Effect" - LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" | sed 's/,/, /g') + LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" | sed 's/[][]//g' | sed 's/,/, /g' | grep -v 'changed') MESSAGE=("This PR updates the following components which are code frozen:" "$LEGIBLE_CHANGES" "Freeze can be overriden by adding the 'override-freeze' label to the PR." ) - echo "::error title=$TITLE::${MESSAGE[*]}" + echo "### ${TITLE}" >> $GITHUB_ENV + echo "" >> $GITHUB_ENV + echo "This PR updates the following components which are code frozen: ${LEGIBLE_CHANGES}" >> $GITHUB_ENV + echo "" >> $GITHUB_ENV + echo "The following files are modified and frozen:" >> $GITHUB_ENV IFS="," read -ra FILE_LIST <<< "${{ steps.filters.outputs.changed_files }}" FILE_MESSAGE="This file is under code freeze." for FILE in "${FILE_LIST[@]}"; do + echo " - ${FILE}" >> $GITHUB_ENV echo "::error file=$FILE,title=$TITLE::$FILE_MESSAGE" done + echo "" >> $GITHUB_ENV + echo "Freeze can be overriden by adding the 'override-freeze' label to the PR." >> $GITHUB_ENV exit 1 From a12f5b514ce2b6e536172b2edc9b6b0fa133e9fd Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:31:28 -0700 Subject: [PATCH 05/12] simplify --- .github/workflows/code-freeze.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index 15d87552da..b0d936dd52 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -24,7 +24,7 @@ jobs: if: steps.filters.outputs.changes != '' && !contains(github.event.pull_request.labels.*.name, 'override-freeze') run: | TITLE="Code Freeze in Effect" - LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" | sed 's/[][]//g' | sed 's/,/, /g' | grep -v 'changed') + LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" sed 's/,/, /g') MESSAGE=("This PR updates the following components which are code frozen:" "$LEGIBLE_CHANGES" "Freeze can be overriden by adding the 'override-freeze' label to the PR." From d921fc69c5437f80aa51167086f1874129ab94d5 Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:32:07 -0700 Subject: [PATCH 06/12] try --- .github/workflows/code-freeze.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index b0d936dd52..aaab86420d 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -29,17 +29,17 @@ jobs: "$LEGIBLE_CHANGES" "Freeze can be overriden by adding the 'override-freeze' label to the PR." ) - echo "### ${TITLE}" >> $GITHUB_ENV + echo "### ${TITLE}" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_ENV - echo "This PR updates the following components which are code frozen: ${LEGIBLE_CHANGES}" >> $GITHUB_ENV - echo "" >> $GITHUB_ENV - echo "The following files are modified and frozen:" >> $GITHUB_ENV + echo "This PR updates the following components which are code frozen: ${LEGIBLE_CHANGES}" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "The following files are modified and frozen:" >> $GITHUB_STEP_SUMMARY IFS="," read -ra FILE_LIST <<< "${{ steps.filters.outputs.changed_files }}" FILE_MESSAGE="This file is under code freeze." for FILE in "${FILE_LIST[@]}"; do - echo " - ${FILE}" >> $GITHUB_ENV + echo " - ${FILE}" >> $GITHUB_STEP_SUMMARY echo "::error file=$FILE,title=$TITLE::$FILE_MESSAGE" done - echo "" >> $GITHUB_ENV - echo "Freeze can be overriden by adding the 'override-freeze' label to the PR." >> $GITHUB_ENV + echo "" >> $GITHUB_STEP_SUMMARY + echo "Freeze can be overriden by adding the 'override-freeze' label to the PR." >> $GITHUB_STEP_SUMMARY exit 1 From 54e2cd837f88f5d37a388aed38361f593be37703 Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:40:00 -0700 Subject: [PATCH 07/12] better? --- .github/workflows/code-freeze.yml | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index aaab86420d..111a5a0242 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -24,22 +24,20 @@ jobs: if: steps.filters.outputs.changes != '' && !contains(github.event.pull_request.labels.*.name, 'override-freeze') run: | TITLE="Code Freeze in Effect" - LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" sed 's/,/, /g') - MESSAGE=("This PR updates the following components which are code frozen:" - "$LEGIBLE_CHANGES" - "Freeze can be overriden by adding the 'override-freeze' label to the PR." - ) + SUMMARY_MESSAGE_BODY="" + LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" | sed 's/,changed//g' | sed 's/,/, /g' | sed 's/[][]//g') echo "### ${TITLE}" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_ENV - echo "This PR updates the following components which are code frozen: ${LEGIBLE_CHANGES}" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "The following files are modified and frozen:" >> $GITHUB_STEP_SUMMARY + echo "This PR updates the following components which are code frozen: ${LEGIBLE_CHANGES}" >> $SUMMARY_MESSAGE_BODY + echo "" >> $SUMMARY_MESSAGE_BODY + echo "The following files are modified and frozen:" >> $SUMMARY_MESSAGE_BODY IFS="," read -ra FILE_LIST <<< "${{ steps.filters.outputs.changed_files }}" FILE_MESSAGE="This file is under code freeze." for FILE in "${FILE_LIST[@]}"; do - echo " - ${FILE}" >> $GITHUB_STEP_SUMMARY + echo " - ${FILE}" >> $SUMMARY_MESSAGE_BODY echo "::error file=$FILE,title=$TITLE::$FILE_MESSAGE" done echo "" >> $GITHUB_STEP_SUMMARY - echo "Freeze can be overriden by adding the 'override-freeze' label to the PR." >> $GITHUB_STEP_SUMMARY + echo "Freeze can be overriden by adding the 'override-freeze' label to the PR." >> $SUMMARY_MESSAGE_BODY + echo "::error title=$TITLE::$SUMMARY_MESSAGE_BODY" exit 1 From 276aa0b6402dba285f6ba59ee9a1db25405648b0 Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:44:44 -0700 Subject: [PATCH 08/12] test --- .github/workflows/code-freeze.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index 111a5a0242..fcc4498af3 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -1,3 +1,4 @@ +name: Code Freeze on: pull_request: types: @@ -11,6 +12,7 @@ on: jobs: code_freeze: + name: Code Freeze runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 @@ -20,24 +22,22 @@ jobs: with: list-files: shell filters: .github/code-freeze-filter.yaml - - name: Code Freeze + - name: Output if: steps.filters.outputs.changes != '' && !contains(github.event.pull_request.labels.*.name, 'override-freeze') run: | TITLE="Code Freeze in Effect" SUMMARY_MESSAGE_BODY="" LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" | sed 's/,changed//g' | sed 's/,/, /g' | sed 's/[][]//g') - echo "### ${TITLE}" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_ENV - echo "This PR updates the following components which are code frozen: ${LEGIBLE_CHANGES}" >> $SUMMARY_MESSAGE_BODY - echo "" >> $SUMMARY_MESSAGE_BODY - echo "The following files are modified and frozen:" >> $SUMMARY_MESSAGE_BODY + echo "This PR updates the following components which are code frozen: ${LEGIBLE_CHANGES}" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "The following files are modified and frozen:" >> $GITHUB_STEP_SUMMARY IFS="," read -ra FILE_LIST <<< "${{ steps.filters.outputs.changed_files }}" FILE_MESSAGE="This file is under code freeze." for FILE in "${FILE_LIST[@]}"; do - echo " - ${FILE}" >> $SUMMARY_MESSAGE_BODY + echo " - ${FILE}" >> $GITHUB_STEP_SUMMARY echo "::error file=$FILE,title=$TITLE::$FILE_MESSAGE" done echo "" >> $GITHUB_STEP_SUMMARY - echo "Freeze can be overriden by adding the 'override-freeze' label to the PR." >> $SUMMARY_MESSAGE_BODY - echo "::error title=$TITLE::$SUMMARY_MESSAGE_BODY" + echo "Freeze can be overriden by adding the 'override-freeze' label to the PR." >> $GITHUB_STEP_SUMMARY + echo "::error title=$TITLE::$GITHUB_STEP_SUMMARY" exit 1 From 35bcc990756acac6add55335c0ab337da7460218 Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:46:40 -0700 Subject: [PATCH 09/12] cleanup --- .github/workflows/code-freeze.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index fcc4498af3..642c541437 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -26,8 +26,8 @@ jobs: if: steps.filters.outputs.changes != '' && !contains(github.event.pull_request.labels.*.name, 'override-freeze') run: | TITLE="Code Freeze in Effect" - SUMMARY_MESSAGE_BODY="" LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" | sed 's/,changed//g' | sed 's/,/, /g' | sed 's/[][]//g') + echo "### ${TITLE}" >> $GITHUB_STEP_SUMMARY echo "This PR updates the following components which are code frozen: ${LEGIBLE_CHANGES}" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "The following files are modified and frozen:" >> $GITHUB_STEP_SUMMARY @@ -39,5 +39,4 @@ jobs: done echo "" >> $GITHUB_STEP_SUMMARY echo "Freeze can be overriden by adding the 'override-freeze' label to the PR." >> $GITHUB_STEP_SUMMARY - echo "::error title=$TITLE::$GITHUB_STEP_SUMMARY" exit 1 From 47c3d9a87b6ef3f5abf8a032949d58c1a86c6967 Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 11:55:13 -0700 Subject: [PATCH 10/12] remove blocking change --- .github/workflows/code-freeze.yml | 2 +- crates/astria-sequencer-relayer/src/main.rs | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index 642c541437..4aa972f958 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -1,6 +1,6 @@ name: Code Freeze on: - pull_request: + pull_request_target: types: - opened - synchronize diff --git a/crates/astria-sequencer-relayer/src/main.rs b/crates/astria-sequencer-relayer/src/main.rs index 2fbd24b7e4..a072bf06f7 100644 --- a/crates/astria-sequencer-relayer/src/main.rs +++ b/crates/astria-sequencer-relayer/src/main.rs @@ -16,7 +16,6 @@ use tracing::{ warn, }; -// Testing #[tokio::main] async fn main() -> ExitCode { astria_eyre::install().expect("astria eyre hook must be the first hook installed"); From 145d5c0388a8016b90840701a08bc2a3fdcbc89a Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 12:02:13 -0700 Subject: [PATCH 11/12] update --- .github/workflows/code-freeze.yml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/.github/workflows/code-freeze.yml b/.github/workflows/code-freeze.yml index 4aa972f958..e781ba25c4 100644 --- a/.github/workflows/code-freeze.yml +++ b/.github/workflows/code-freeze.yml @@ -22,7 +22,7 @@ jobs: with: list-files: shell filters: .github/code-freeze-filter.yaml - - name: Output + - name: Output Failure if: steps.filters.outputs.changes != '' && !contains(github.event.pull_request.labels.*.name, 'override-freeze') run: | TITLE="Code Freeze in Effect" @@ -40,3 +40,21 @@ jobs: echo "" >> $GITHUB_STEP_SUMMARY echo "Freeze can be overriden by adding the 'override-freeze' label to the PR." >> $GITHUB_STEP_SUMMARY exit 1 + - name: Output Bypass + if: steps.filters.outputs.changes != '' && !contains(github.event.pull_request.labels.*.name, 'override-freeze') + run: | + TITLE="Code Freeze in Effect - Bypassed" + LEGIBLE_CHANGES=$(echo "${{ steps.filters.outputs.changes }}" | sed 's/,changed//g' | sed 's/,/, /g' | sed 's/[][]//g') + echo "### ${TITLE}" >> $GITHUB_STEP_SUMMARY + echo "This PR updates the following components which are code frozen: ${LEGIBLE_CHANGES}" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "The following files are modified and frozen:" >> $GITHUB_STEP_SUMMARY + IFS="," read -ra FILE_LIST <<< "${{ steps.filters.outputs.changed_files }}" + FILE_MESSAGE="This file is under code freeze." + for FILE in "${FILE_LIST[@]}"; do + echo " - ${FILE}" >> $GITHUB_STEP_SUMMARY + echo "::warning file=$FILE,title=$TITLE::$FILE_MESSAGE" + done + echo "" >> $GITHUB_STEP_SUMMARY + echo "Freeze has been overriden by adding the 'override-freeze' label to the PR." >> $GITHUB_STEP_SUMMARY + exit 0 From ef3cebf5c58aa202fbfaa2c3ffad158f94baf4d3 Mon Sep 17 00:00:00 2001 From: Jordan Oroshiba Date: Fri, 27 Sep 2024 12:32:45 -0700 Subject: [PATCH 12/12] updated comments --- .github/code-freeze-filter.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/code-freeze-filter.yaml b/.github/code-freeze-filter.yaml index 484df37f72..47e5e97290 100644 --- a/.github/code-freeze-filter.yaml +++ b/.github/code-freeze-filter.yaml @@ -4,11 +4,15 @@ # Please provide a reasoning for each component that is frozen. -# Conductor is frozen for zellic audit. +# Frozen for audit. conductor: &conductor - crates/astria-conductor/src/** +# Frozen for audit. sequencer-relayer: &sequencer-relayer - crates/astria-sequencer-relayer/src/** + +# if new components are added above update the list below to get better +# gh pr level visibility into which files are frozen. changed: - *conductor - *sequencer-relayer