Setup Onyx repository actions

[Julesssss]

CC @tgolen @AndrewGable

Onyx is now a standalone package, we need to setup automated actions for versioning and linting.

Fixed Issues

Fixes: https://github.com/Expensify/Expensify/issues/145386

Tests

Added two commits to test the lint script

• First commit - introduce a linting error in one file
• Second commit - fixing the linting error

Pre-merge

• One Github check should have ran: 'Lint Javascript'
• The 'Create new version' Action should not run

Post-Merge

• After merging this PR, a 'Create new version' Action should be triggered, which should bump the version to x.x.x, push the tag and auto-merge the version bump PR
• If this does not occur, or fails, please re-open the issue

[Julesssss]

• Added the NPM Lint Action
  • Works as expected
• Added additional logic to the version Action
  • Version generation works as expected, but needs to be changed has been changed to basic semver for versioning
  • Blocked by a bad BOTIFY_TOKEN auth token, hoping to test out an alternate key sometime today

[Julesssss]

'npm version patch' is the only change from our existing ReactNativeChat Actions

[AndrewGable]

Looks great!

[sketchydroide]

dependenices typo ?

[sketchydroide]

Looks great, just a typo found I think

[sketchydroide]

LGTM

[tgolen]

Would you mind adding two commits to ensure that the linting is working?

1. First commit - introduce a linting error in one file
2. Second commit - fixing the linting error

[Julesssss]

Action failed successfully: https://github.com/Expensify/react-native-onyx/pull/4/checks?check_run_id=1413126745

[Julesssss]

Thanks for reviews and test suggestions. Please see above for example of a failing lint Action

[tgolen]

Awesome, thanks!

[AndrewGable]

As soon as I merged this I realized we were probably forgetting one workflow: https://github.com/Expensify/ReactNativeChat/blob/master/.github/workflows/automerge.yml

The version action will create the PR here: #6

But it won't automatically merge it until we have the automerge action in place.

[AndrewGable]

Also.. We might want to beef up the security checks on https://github.com/Expensify/ReactNativeChat/blob/master/.github/workflows/automerge.yml - As I believe right now any PR that is labeled "auto merge" will be merged automatically, which works for internal use, but might be a bit riskier for open source usage.

[tgolen]

Yeah, I agree. That doesn't seem very safe when it becomes open-source.

…

On Tue, Nov 17, 2020 at 11:16 AM Andrew Gable ***@***.***> wrote: Also.. We might want to beef up the security checks on https://github.com/Expensify/ReactNativeChat/blob/master/.github/workflows/automerge.yml - As I believe right now any PR that is labeled "auto merge" will be merged automatically, which works for internal use, but might be a bit riskier for open source usage. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJMAB7D5PERNYDWADVDRR3SQK4WVANCNFSM4TTTDBPQ> .

[Julesssss]

Thanks for adding the automerge Action @AndrewGable

[Julesssss]

On that note, I raised a point regarding Github Action security yesterday in Infra -- It looks like we'll need to block Actions from running on forked PRs.

[AndrewGable]

If they don't run on forked PRs, how do we verify they are linted correctly?

[Julesssss]

how do we verify they are linted correctly?

Exactly -- this is obviously not going to be acceptable, so we will need to verify the security concern or look into alternatives. The initial concern was that anyone can create Actions that run against the repo, and in theory would be able to expose our repo secrets.

[Julesssss]

Opened an issue to collect and thoughts regarding this: https://github.com/Expensify/Expensify/issues/146339