feat: use pinned aria-at commit with cron to update #1510
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,152 @@ | ||
| name: Update pinned ARIA-AT data | ||
|
|
||
| on: | ||
| schedule: | ||
| - cron: '0 6 * * *' | ||
| workflow_dispatch: {} | ||
|
|
||
| concurrency: | ||
| group: update-aria-at | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| bump: | ||
| name: Test latest upstream and update pin if clean | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| steps: | ||
| - name: Checkout the repository | ||
| uses: actions/checkout@v4 | ||
| - name: Install NodeJS 20 | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
| - run: yarn --version | ||
| - name: Remove pre-bundled versions of postgres to avoid version clashes | ||
| run: | | ||
| sudo DEBIAN_FRONTEND=noninteractive apt-get purge -y postgresql\* | ||
| sudo apt-get autoremove -y | ||
| sudo rm -rf /var/lib/postgresql/ | ||
| sudo rm -rf /etc/postgresql/ | ||
| - name: Install PostgreSQL 12 | ||
| run: | | ||
| wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add - | ||
| sudo sh -c 'echo "deb https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list' | ||
| sudo apt-get -y update | ||
| sudo apt-get -y install postgresql-12 | ||
| sudo apt-get -y install postgresql-client-12 | ||
| - name: before_install | ||
| run: | | ||
| sudo sed -i 's/port = 5433/port = 5432/' /etc/postgresql/12/main/postgresql.conf | ||
| sudo pg_ctlcluster 12 main restart | ||
| - name: before_script | ||
| run: | | ||
| yarn --frozen-lockfile | ||
| npx patch-package | ||
| source config/test.env | ||
| sudo -u postgres createdb ${PGDATABASE} | ||
| echo Created ${PGDATABASE} | ||
| sudo -u postgres psql -c "CREATE ROLE ${PGUSER} WITH LOGIN PASSWORD '${PGPASSWORD}'" | ||
| sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE ${PGDATABASE} to ${PGUSER};" | ||
| yarn sequelize:test db:migrate | ||
| yarn sequelize:test db:seed:all | ||
| - name: Check for latest upstream SHA | ||
| id: latest | ||
| run: | | ||
| set -e | ||
| echo "Checking for latest ARIA-AT upstream SHA..." | ||
| LATEST=$(git ls-remote https://github.com/w3c/aria-at HEAD | cut -f1) | ||
| PINNED=$(cat config/aria-at.version || true) | ||
| echo "latest=$LATEST" >> $GITHUB_OUTPUT | ||
| echo "pinned=$PINNED" >> $GITHUB_OUTPUT | ||
| if [ -z "$LATEST" ]; then | ||
| echo "Failed to resolve latest upstream SHA" | ||
| exit 1 | ||
| fi | ||
| echo "Current pinned SHA: ${PINNED:-none}" | ||
| echo "Latest upstream SHA: $LATEST" | ||
| if [ "$LATEST" = "$PINNED" ]; then | ||
| echo "Already up to date with latest upstream SHA" | ||
| exit 0 | ||
| else | ||
| echo "Found newer upstream SHA, will test and update" | ||
| fi | ||
| - name: Import and test latest upstream SHA | ||
| if: steps.latest.outputs.latest != steps.latest.outputs.pinned | ||
| run: | | ||
| # Ensure IMPORT_ARIA_AT_TESTS_COMMIT_* env vars are available in this step | ||
| source config/test.env | ||
| echo "Importing historical commits for testing..." | ||
| yarn workspace server db-import-tests:test -c "${IMPORT_ARIA_AT_TESTS_COMMIT_1} ${IMPORT_ARIA_AT_TESTS_COMMIT_2} ${IMPORT_ARIA_AT_TESTS_COMMIT_3} ${IMPORT_ARIA_AT_TESTS_COMMIT_4}" | ||
| echo "Importing latest upstream commit: ${{ steps.latest.outputs.latest }}" | ||
| yarn workspace server db-import-tests:test -c "${{ steps.latest.outputs.latest }}" | ||
| echo "Populating sample data..." | ||
| yarn workspace server db-populate-sample-data:test | ||
| - name: Run tests (excluding snapshots) | ||
| if: steps.latest.outputs.latest != steps.latest.outputs.pinned | ||
| run: | | ||
| yarn workspace shared prettier | ||
| yarn workspace client prettier | ||
| yarn workspace server prettier | ||
| yarn workspace shared lint | ||
| yarn workspace client lint | ||
| yarn workspace server lint | ||
| yarn workspace shared jest | ||
| yarn workspace client jest --testPathIgnorePatterns=snapshots | ||
| yarn workspace server jest | ||
| - name: Update pinned SHA and snapshots (tests passed) | ||
| if: steps.latest.outputs.latest != steps.latest.outputs.pinned | ||
| run: | | ||
| echo "All tests passed! Updating pinned SHA to latest upstream..." | ||
| echo "${{ steps.latest.outputs.latest }}" > config/aria-at.version | ||
| echo "Updating snapshots..." | ||
| yarn update-snapshots | ||
| - name: Stage allowed files only | ||
| if: steps.latest.outputs.latest != steps.latest.outputs.pinned | ||
| run: | | ||
| set -e | ||
| git reset | ||
| git add config/aria-at.version || true | ||
| git add client/tests/e2e/snapshots || true | ||
| echo "Staged files:" | ||
| git diff --cached --name-only | ||
| - name: Validate staged files scope | ||
| if: steps.latest.outputs.latest != steps.latest.outputs.pinned | ||
| run: | | ||
| set -e | ||
| CHANGED=$(git diff --cached --name-only) | ||
| if [ -z "$CHANGED" ]; then echo "No changes to commit"; exit 0; fi | ||
| echo "$CHANGED" | awk '{print}' | while read -r f; do | ||
| case "$f" in | ||
| config/aria-at.version) ;; | ||
| client/tests/e2e/snapshots/*|client/tests/e2e/snapshots/*/*) ;; | ||
| *) echo "Disallowed staged change: $f"; exit 1 ;; | ||
| esac | ||
| done | ||
| - name: Commit updated ARIA-AT pin and snapshots | ||
| if: steps.latest.outputs.latest != steps.latest.outputs.pinned | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| set -e | ||
| echo "Committing updated ARIA-AT pin and snapshots..." | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | ||
| git commit -m "chore: bump ARIA-AT pin to ${{ steps.latest.outputs.latest }}" | ||
| echo "Pushing to development branch..." | ||
| git push origin HEAD:development | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| 84bd6c8806b51557ff50c8574533a99810d8a5a8 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,7 +6,7 @@ | |
| - Version 14 or greater | ||
| - It is recommended to install node with [`nvm`](https://github.com/nvm-sh/nvm) | ||
| 2. Yarn | ||
| - Yarn is responsible for installing dependencies, similar to npm. This project is utilizing yarn workspaces to organize the code into a monorepo structure. | ||
|
|
||
| - For macOS, use: `brew install yarn` | ||
| - For linux, See [yarn documentation](https://classic.yarnpkg.com/en/docs/install/#debian-stable) | ||
|
|
||
|
|
@@ -17,12 +17,26 @@ | |
| yarn install | ||
| ``` | ||
| 2. Set up local database using the instructions provided in [database.md](database.md). | ||
| - Note: You must run `yarn db-import-tests:dev` after setting up your database to import the pinned test harness into | ||
| your project. | ||
| 3. Run the server | ||
| `yarn dev` | ||
| Now you can navigate your browser to: [http://localhost:3000/](http://localhost:3000/). You need to use localhost instead of `0.0.0.0` because the cookie needs to be treated as secure. | ||
|
|
||
| ## Pinned ARIA-AT version | ||
|
|
||
| The app imports test plans from the `w3c/aria-at` repository using a pinned commit. | ||
|
|
||
| - The pinned SHA lives at `config/aria-at.version`. | ||
| - Local imports without `-c` will read this file (or `ARIA_AT_PINNED_SHA`). | ||
| - CI imports historical commits for coverage and then the pinned commit. | ||
|
Contributor
There was a problem hiding this comment. This is an aside, but it's still unclear to me why exactly we need those historical commits (and now in addition to the pinned commit)... Is this some tech debt that we could also clean up before next year? cc @howard-e |
||
|
|
||
| A scheduled workflow (`.github/workflows/update-aria-at.yml`) runs daily to: | ||
|
|
||
| - Resolve the latest upstream SHA. | ||
| - Import and run tests against it. | ||
| - If tests pass, update `config/aria-at.version`, refresh client snapshots, and push directly to `development` with only those changes. | ||
|
|
||
| ### Signing in as a tester, admin, or vendor | ||
|
|
||
| ARIA-AT App determines if you are authorized to sign in as an admin, tester, or vendor based on whether your Github username is listed in the admins.txt, testers.txt, or vendors.txt file. | ||
|
|
||
|
Contributor
There was a problem hiding this comment. Wouldn't this change prevent the deployed environments from getting the latest version changes from aria-at? The Seems a cron in the deployed environment too or some exclusion of
Contributor
Author
There was a problem hiding this comment. Good point. Maybe we use the
Contributor
There was a problem hiding this comment. That sounds practical to me!
Contributor
Author
There was a problem hiding this comment. Curious if this meets your concerns 5c44b6e? It is difficult to test this but I think this should work for the cron. Let me know if you have any ideas on how I could test this
Contributor
Author
There was a problem hiding this comment. I think that this default path should work for enforcing the pinned commit on initial deploy but admittedly Ansible is unfamiliar to me
Contributor
There was a problem hiding this comment. Yep, these changes look good! After resolving the merge conflicts and reviewing my latest comment, we'd be good to move this forward |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I worry that this daily interval is too big given how often the deployed environment actually checks (and may update). Right now that's every 15mins. Could we match that?