Merge branch 'main' into MMS-2030-fix-swap-txs-showing-as-bridge

Author: ghgoodreau

.github/workflows/add-release-label.yml

@@ -12,14 +12,12 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged == true
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
         with:
+          is-high-risk-environment: false
           fetch-depth: 0 # This is needed to checkout all branches
 
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
-
       - name: Get the next semver version
         id: get-next-semver-version
         env:

.github/workflows/build-beta.yml

@@ -40,9 +40,12 @@ jobs:
               echo "NEEDS_BETA_BUILD=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Setup environment
+      - name: Checkout and setup high risk environment
         if: ${{ steps.needs-beta-build.outputs.NEEDS_BETA_BUILD == 'true' }}
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: true
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Run beta build
         if: ${{ steps.needs-beta-build.outputs.NEEDS_BETA_BUILD == 'true' }}

.github/workflows/build-storybook.yml

@@ -11,11 +11,10 @@ jobs:
     name: Build storybook
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
+      - name: Checkout and setup high risk environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: true
 
       - name: Build storybook
         run: yarn storybook:build

.github/workflows/check-attributions.yml

@@ -8,11 +8,10 @@ jobs:
   check-attributions:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
 
       - name: Check attributions changes
         run: yarn attributions:check

.github/workflows/check-pr-labels.yml

@@ -17,11 +17,10 @@ jobs:
       pull-requests: read
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
 
       - name: Check PR has required labels
         env:

.github/workflows/check-template-and-add-labels.yml

@@ -10,11 +10,10 @@ jobs:
   check-template-and-add-labels:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
 
       - name: Check template and add labels
         id: check-template-and-add-labels

.github/workflows/close-bug-report.yml

@@ -12,11 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'Version-v')
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
 
       - name: Close release bug report issue
         env:

.github/workflows/create-bug-report.yml

@@ -17,13 +17,11 @@ jobs:
             echo "Not a release branch, skip next steps"
           fi
 
-      - name: Checkout repository
+      - name: Checkout and setup environment
         if: steps.extract_version.outputs.version
-        uses: actions/checkout@v4
-
-      - name: Setup environment
-        if: steps.extract_version.outputs.version
-        uses: metamask/github-tools/.github/actions/setup-environment@main
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
 
       - name: Create bug report issue on planning repo
         if: steps.extract_version.outputs.version

.github/workflows/crowdin-action.yml

@@ -14,7 +14,6 @@ on:
 jobs:
   synchronize-with-crowdin:
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/fitness-functions.yml

@@ -11,14 +11,12 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
         with:
+          is-high-risk-environment: false
           fetch-depth: 0 # This is needed to checkout all branches
 
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
-
       - name: Run fitness functions
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}

.github/workflows/main.yml

@@ -15,75 +15,61 @@ on:
   merge_group:
 
 jobs:
+  prep-deps:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
+          cache-node-modules: 'true'
+
   lint-workflows:
     name: Lint workflows
-    uses: metamask/github-tools/.github/workflows/lint-workflows.yml@1d657e262aea7e3f216754febb624831527d2565
-
-  test-lint-shellcheck:
-    name: Test lint shellcheck
-    uses: ./.github/workflows/test-lint-shellcheck.yml
+    uses: metamask/github-tools/.github/workflows/lint-workflows.yml@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
 
   test-lint:
-    name: Test lint
+    needs: prep-deps
     uses: ./.github/workflows/test-lint.yml
 
   test-circular-deps:
     name: Test circular deps
+    needs: prep-deps
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
 
       - name: Check circular dependencies
         run: yarn circular-deps:check
 
-  test-lint-changelog:
-    name: Test lint changelog
-    uses: ./.github/workflows/test-lint-changelog.yml
-
-  test-lint-lockfile:
-    name: Test lint lockfile
-    uses: ./.github/workflows/test-lint-lockfile.yml
-
-  test-deps-audit:
-    name: Test deps audit
-    uses: ./.github/workflows/test-deps-audit.yml
-
-  test-yarn-dedupe:
-    name: Test yarn dedupe
-    uses: ./.github/workflows/test-yarn-dedupe.yml
-
-  test-deps-depcheck:
-    name: Test deps depcheck
-    uses: ./.github/workflows/test-deps-depcheck.yml
+  repository-health-checks:
+    needs: prep-deps
+    uses: ./.github/workflows/repository-health-checks.yml
 
   test-storybook:
     name: Test storybook
+    needs: prep-deps
     uses: ./.github/workflows/test-storybook.yml
 
-  validate-lavamoat-allow-scripts:
-    name: Validate lavamoat allow scripts
-    uses: ./.github/workflows/validate-lavamoat-allow-scripts.yml
-
   validate-lavamoat-policy-build:
-    name: Validate lavamoat policy build
+    needs: prep-deps
     uses: ./.github/workflows/validate-lavamoat-policy-build.yml
 
   validate-lavamoat-policy-webapp:
-    name: Validate lavamoat policy webapp
+    needs: prep-deps
     uses: ./.github/workflows/validate-lavamoat-policy-webapp.yml
 
   prep-build-test-browserify:
+    needs: prep-deps
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
 
       - run: yarn build:test
 
@@ -94,13 +80,13 @@ jobs:
           path: ./dist/
 
   prep-build-test-webpack:
+    needs: prep-deps
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
 
       - run: yarn webpack --test --no-lavamoat --no-cache --browser=chrome --lockdown --sentry --snow --env production
         env:
@@ -114,6 +100,7 @@ jobs:
 
   run-tests:
     name: Run tests
+    needs: prep-deps
     uses: ./.github/workflows/run-tests.yml
 
   run-benchmarks:
@@ -171,14 +158,9 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - lint-workflows
-      - test-lint-shellcheck
       - test-lint
-      - test-lint-changelog
-      - test-lint-lockfile
-      - test-yarn-dedupe
-      - test-deps-depcheck
+      - repository-health-checks
       - test-storybook
-      - validate-lavamoat-allow-scripts
       - validate-lavamoat-policy-build
       - validate-lavamoat-policy-webapp
       - run-tests

.github/workflows/publish-prerelease.yml

@@ -11,14 +11,12 @@ jobs:
     name: Publish prerelease
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: Checkout and setup high risk environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
         with:
+          is-high-risk-environment: true
           fetch-depth: 0 # This is needed to get merge base to calculate bundle size diff
 
-      - name: Setup environment
-        uses: metamask/github-tools/.github/actions/setup-environment@1d657e262aea7e3f216754febb624831527d2565
-
       - name: Get merge base commit hash
         id: get-merge-base
         env:

.github/workflows/repository-health-checks.yml

@@ -0,0 +1,72 @@
+# This suite originally ran on 7 individual VMs that each took about 1m30s to execute
+# It's now combined onto a single VM that takes about 1m20s
+# The `if: always()` statements make all independent tests run, even if one fails.
+name: Repository health checks
+
+on:
+  workflow_call:
+
+jobs:
+  repository-health-checks:
+    name: Repository health checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout and setup environment
+        uses: metamask/github-tools/.github/actions/checkout-and-setup@1299bb1de0c6974ae6d0a32c7e8897fe168239ac
+        with:
+          is-high-risk-environment: false
+
+      # test-lint-shellcheck
+      - name: ShellCheck Lint
+        if: always()
+        run: ./development/shellcheck.sh
+
+      # test-lint-changelog
+      - name: Validate changelog
+        # For a `pull_request` event, the branch is `github.head_ref``.
+        # For a `push` event, the branch is `github.ref_name`.
+        if: ${{ !startsWith(github.head_ref || github.ref_name, 'Version-v') }}
+        run: yarn lint:changelog
+
+      - name: Validate release candidate changelog
+        # For a `pull_request` event, the branch is `github.head_ref``.
+        # For a `push` event, the branch is `github.ref_name`.
+        if: ${{ startsWith(github.head_ref || github.ref_name, 'Version-v') }}
+        run: .circleci/scripts/validate-changelog-in-rc.sh
+
+      # test-lint-lockfile
+      - name: Lint lockfile
+        if: always()
+        run: yarn lint:lockfile
+
+      - name: Check yarn resolutions
+        if: always()
+        run: yarn --check-resolutions
+
+      # test-deps-audit
+      - name: Run audit
+        if: always()
+        run: yarn audit
+
+      # test-yarn-dedupe
+      - name: Detect yarn lock deduplications
+        if: always()
+        run: yarn dedupe --check
+
+      # test-deps-depcheck
+      - name: Run depcheck
+        if: always()
+        run: yarn depcheck
+
+      # validate-lavamoat-allow-scripts
+      - name: Validate allow-scripts config
+        if: always()
+        run: yarn allow-scripts auto
+
+      - name: Check working tree
+        if: always()
+        run: |
+          if ! git diff --exit-code; then
+              echo "::error::Working tree dirty."
+              exit 1
+          fi