🚀 Production Deployment

.github/workflows/deploy.yml

@@ -0,0 +1,52 @@
+name: Deploy
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions: {}
+
+jobs:
+  fast-forward:
+    if: >-
+      github.event.review.state == 'approved' &&
+      github.event.pull_request.base.ref == 'production' &&
+      github.event.pull_request.head.ref == 'main' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}
+    permissions:
+      contents: write
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: ${{ github.event.review.commit_id }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Check the approved commit is fully approved and still the deploy PR head
+        id: approved
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+          SHA: ${{ github.event.review.commit_id }}
+        run: |
+          state=$(gh pr view "$PR" --json reviewDecision,headRefOid --jq '"\(.reviewDecision) \(.headRefOid)"')
+          echo "$state"
+          if [ "$state" = "APPROVED $SHA" ]; then echo "ready=true" >> "$GITHUB_OUTPUT"; fi
+      - name: Fast-forward production and create the release
+        if: steps.approved.outputs.ready == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SHA: ${{ github.event.review.commit_id }}
+        run: |
+          if [ -n "$(git tag --points-at "$SHA" --list 'production-*')" ]; then
+            echo "$SHA is already released"
+            exit 0
+          fi
+          previous=$(git tag --list 'production-*' --sort=-refname | head -n 1)
+          notes=$(git log --no-merges --format='- %s' "$previous..$SHA")
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "$SHA:refs/heads/production"
+          name="production-$(date -u +%Y-%m-%d-%H%M%S)"
+          gh release create "$name" --target "$SHA" --title "$name" --notes "$notes"

.github/workflows/production.yml

@@ -2,13 +2,12 @@ name: Production
 
 on:
   push:
-    branches: [main, production]
+    branches: [main]
 
 permissions: {}
 
 jobs:
   deploy-pr:
-    if: github.ref_name == 'main'
     runs-on: ubuntu-latest
     concurrency:
       group: ${{ github.workflow }}-deploy-pr
@@ -25,28 +24,10 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           changes=$(git log --no-merges --format='- %s' "origin/production..$GITHUB_SHA")
-          body=$(printf 'Merging deploys these changes to https://app.talisman.xyz. QA them on staging first: https://main-talisman-portal.talismn.workers.dev\n\n%s\n' "$changes")
+          body=$(printf 'Approving deploys these changes to https://app.talisman.xyz: once the required approvals are in, the production branch fast-forwards to this commit, so there is nothing to merge. QA them on staging first: https://main-talisman-portal.talismn.workers.dev\n\n%s\n' "$changes")
           pr=$(gh pr list --base production --head main --state open --json number --jq '.[].number')
           if [ -z "$pr" ]; then
             gh pr create --base production --head main --title "🚀 Production Deployment" --body "$body"
           else
             gh pr edit "$pr" --body "$body"
           fi
-
-  release:
-    if: github.ref_name == 'production'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - env:
-          GH_TOKEN: ${{ github.token }}
-          BEFORE: ${{ github.event.before }}
-        run: |
-          notes=$(git log --no-merges --format='- %s' "$BEFORE..$GITHUB_SHA")
-          name="production-$(date -u +%Y-%m-%d-%H%M%S)"
-          gh release create "$name" --target "$GITHUB_SHA" --title "$name" --notes "$notes"

pnpm-workspace.yaml

@@ -25,16 +25,13 @@ overrides:
   "defu@<6.1.5": ^6.1.7
   "h3@<1.15.6": ^1.15.11
   "lodash@<4.18.1": ^4.18.1
-  "node-forge@<1.4.0": ^1.4.0
+  "node-forge@<1.4.2": ^1.4.2
   "picomatch@<2.3.2": ^2.3.2
   "react-use>js-cookie": ^3.0.8
   "ws@>=7.0.0 <7.5.11": ^7.5.13
   "ws@>=8.0.0 <8.21.0": ^8.22.0
 auditConfig:
   ignoreGhsas:
-    - GHSA-95m3-7q98-8xr5
-    - GHSA-86w9-cpqp-85rv
-    - GHSA-vfj7-8cjw-p6xm
     - GHSA-mrhx-c7xc-m3w5
     - GHSA-qr28-fpjm-wq7f
 minimumReleaseAgeExclude: