feat: Implement New Attributions Update Workflow via GitHub Actions #24390

cryptodev-2s · 2024-05-06T14:36:22Z

Description

This pull request introduces a GitHub Action workflow dedicated to managing attributions effectively within our project. The key components of this new workflow include:

Local Scripts for Attributions Management:
- yarn attributions:generate: Updates attributions to reflect current dependencies.
- yarn attributions:check: Checks if attributions are up-to-date with the latest changes.
GitHub Actions:
- A check to ensure attributions are up-to-date on all pull requests.
- An action that allows team members to update attributions directly by commenting @metamskbot update-attributions on any PR.

Related issues

Fixes: #1947

Manual testing steps

Locally

Run yarn attributions:generate to update the attributions file.
Run yarn attributions:check to ensure all attributions are current.

On GitHub (CI/PR)

Open and push changes to a PR.
Intentionally remove an entry from attribution.txt to simulate an error.
Observe that CI fails due to missing attributions.
Comment @metmaskbot update-attributions on the PR.
A bot will respond with a thumbs up, followed by a comment indicating whether the attributions were successfully updated.

For a practical demonstration, refer to the pull request in my fork: PR Demonstration

Note

This functionality is currently operational only on a fork as it depends on the integration of the bot action into the develop branch.

Screenshots/Recordings

Pre-merge author checklist

I’ve followed MetaMask Coding Standards.
I've completed the PR template to the best of my ability
I’ve included tests if applicable
I’ve documented my code using JSDoc format if applicable
I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

github-actions · 2024-05-06T14:36:40Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

socket-security · 2024-05-06T14:40:53Z

New dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@metamask/[email protected]	filesystem	`0`	106 kB	lgbot
npm/@metamask/[email protected]	filesystem Transitive: environment	`+1`	258 kB	lgbot
npm/@metamask/[email protected]	None	`0`	4 kB	lgbot
npm/@metamask/[email protected]	None	`0`	8.57 kB	lgbot
npm/[email protected]	filesystem	`0`	132 kB	szwacz
npm/[email protected]	None	`0`	0 B
npm/[email protected]	environment	`+1`	28.7 kB	gar
npm/[email protected]	None	`0`	595 kB	davidchambers
npm/[email protected]	None	`0`	5.85 kB	kemitchell
npm/[email protected]	Transitive: environment	`+3`	28.3 kB	rane
npm/[email protected]	None	`0`	22.2 kB	notatestuser

View full report↗︎

cryptodev-2s · 2024-05-06T15:25:56Z

@metamaskbot update-attributions

socket-security · 2024-05-07T13:19:54Z

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/[email protected]

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

cryptodev-2s · 2024-05-07T14:56:16Z

@metamaskbot update-attributions

cryptodev-2s · 2024-05-07T16:04:33Z

@metamaskbot update-attributions

cryptodev-2s · 2024-05-09T13:52:06Z

@metamaskbot update-policies

metamaskbot · 2024-05-09T14:01:29Z

Policies updated

cryptodev-2s · 2024-05-09T14:59:39Z

@metamaskbot update-policies

metamaskbot · 2024-05-09T15:09:03Z

Policies updated

cryptodev-2s · 2024-05-09T15:24:44Z

@metamaskbot update-attributions

cryptodev-2s · 2024-05-09T17:06:26Z

Currently Lint rule runs on every PR(create, update) once this PR is approved. I will switch the github action to run only on release branches.

metamaskbot · 2024-06-04T16:39:04Z

Builds ready [03146ea]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
builds (test): chrome, firefox
builds (test-flask): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4, 5
- common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
- content-script: 0
- offscreen: 0
- ui: 0, 1, 10, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (205 ± 213 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	76	126	93	12	6
		domContentLoaded	9	22	12	3	2
		load	43	1685	205	443	213
		domInteractive	9	22	12	3	2

Bundle size diffs

background: 0 Bytes (0.00%)
ui: 38 Bytes (0.00%)
common: 0 Bytes (0.00%)

mcmire

I had two minor suggestions, but this otherwise looks good to me.

.github/workflows/check-attributions.yml

development/attributions-check.sh

metamaskbot · 2024-06-04T17:26:16Z

Builds ready [9808d4b]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
builds (test): chrome, firefox
builds (test-flask): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4, 5
- common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
- content-script: 0
- offscreen: 0
- ui: 0, 1, 10, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (46 ± 3 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	68	98	79	7	3
		domContentLoaded	8	11	9	1	0
		load	41	67	46	5	3
		domInteractive	8	11	9	1	0

Bundle size diffs

background: 0 Bytes (0.00%)
ui: 48 Bytes (0.00%)
common: 0 Bytes (0.00%)

metamaskbot · 2024-06-04T18:50:17Z

Builds ready [ed9b467]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
builds (test): chrome, firefox
builds (test-flask): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4, 5
- common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
- content-script: 0
- offscreen: 0
- ui: 0, 1, 10, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (51 ± 3 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	66	105	81	10	5
		domContentLoaded	9	26	12	4	2
		load	42	66	51	7	3
		domInteractive	9	26	12	4	2

Bundle size diffs

background: 0 Bytes (0.00%)
ui: 48 Bytes (0.00%)
common: 0 Bytes (0.00%)

development/attributions-check.sh

metamaskbot · 2024-06-04T20:50:09Z

Builds ready [66a7d54]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
builds (test): chrome, firefox
builds (test-flask): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4, 5
- common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
- content-script: 0
- offscreen: 0
- ui: 0, 1, 10, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (48 ± 5 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	65	103	80	10	5
		domContentLoaded	8	29	11	4	2
		load	41	84	48	10	5
		domInteractive	8	29	11	4	2

Bundle size diffs

background: 0 Bytes (0.00%)
ui: 48 Bytes (0.00%)
common: 0 Bytes (0.00%)

metamaskbot · 2024-06-05T10:13:45Z

Builds ready [c4b6d02]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
builds (test): chrome, firefox
builds (test-flask): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4, 5
- common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
- content-script: 0
- offscreen: 0
- ui: 0, 1, 10, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (177 ± 182 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	71	106	87	9	4
		domContentLoaded	8	20	11	3	1
		load	40	1325	177	379	182
		domInteractive	8	20	11	3	1

Bundle size diffs

background: 0 Bytes (0.00%)
ui: 48 Bytes (0.00%)
common: 0 Bytes (0.00%)

metamaskbot · 2024-06-05T12:46:16Z

Builds ready [23ddf2c]

builds: chrome, firefox
builds (beta): chrome
builds (flask): chrome, firefox
builds (MMI): chrome, firefox
builds (test): chrome, firefox
builds (test-flask): chrome, firefox
build viz: Build System
mv3: Background Module Init Stats
mv3: UI Init Stats
mv3: Module Load Stats
mv3: Bundle Size Stats
mv2: E2e Actions Stats
code coverage: Report
storybook: Storybook
typescript migration: Dashboard
all artifacts
bundle viz:
- background: 0, 1, 2, 3, 4, 5
- common: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
- content-script: 0
- offscreen: 0
- ui: 0, 1, 10, 2, 3, 4, 5, 6, 7, 8, 9

Page Load Metrics (129 ± 159 ms)

Platform	Page	Metric	Min (ms)	Max (ms)	Average (ms)	StandardDeviation (ms)	MarginOfError (ms)
Chrome	Home	firstPaint	70	130	88	13	6
		domContentLoaded	9	22	11	3	1
		load	44	1572	129	331	159
		domInteractive	9	22	11	3	1

Bundle size diffs

background: 0 Bytes (0.00%)
ui: 48 Bytes (0.00%)
common: 0 Bytes (0.00%)

cryptodev-2s · 2024-06-05T18:30:11Z

@SocketSecurity ignore npm/[email protected]

cryptodev-2s requested review from kumavis and a team as code owners May 6, 2024 14:36

cryptodev-2s marked this pull request as draft May 6, 2024 14:36

metamaskbot added the INVALID-PR-TEMPLATE PR's body doesn't match template label May 6, 2024

metamaskbot removed the INVALID-PR-TEMPLATE PR's body doesn't match template label May 6, 2024

cryptodev-2s added team-wallet-framework type-bug Sev3-low Low severity; minimal to no impact upon users area-documentation Issues relating to documentation, in the codebase and off. labels May 6, 2024

cryptodev-2s force-pushed the fix/attributions branch from a699a22 to 09637c2 Compare May 7, 2024 13:18

cryptodev-2s marked this pull request as ready for review May 7, 2024 15:02

cryptodev-2s force-pushed the fix/attributions branch 3 times, most recently from e540fd0 to 908bb16 Compare May 9, 2024 13:44

cryptodev-2s requested review from a team as code owners May 9, 2024 14:01

cryptodev-2s changed the title ~~feat: add new attributions workflow~~ feat: Implement New Attributions Update Workflow via GitHub Actions May 9, 2024

cryptodev-2s force-pushed the fix/attributions branch from b83fed9 to e0f0dac Compare May 14, 2024 10:30

fix: yarn nopt resolution

03146ea

cryptodev-2s requested a review from mcmire June 4, 2024 16:14

fix: attribution link

9808d4b

mcmire reviewed Jun 4, 2024

View reviewed changes

.github/workflows/check-attributions.yml Outdated Show resolved Hide resolved

development/attributions-check.sh Outdated Show resolved Hide resolved

cryptodev-2s and others added 3 commits June 4, 2024 20:03

Merge branch 'develop' into fix/attributions

fc5b2e7

fix: attribution check script

e1641d6

Merge branch 'develop' into fix/attributions

ed9b467

cryptodev-2s requested a review from mcmire June 4, 2024 18:38

Merge branch 'develop' into fix/attributions

46d9181

mcmire reviewed Jun 4, 2024

View reviewed changes

development/attributions-check.sh Outdated Show resolved Hide resolved

fix: attribution bot command

66a7d54

cryptodev-2s requested a review from mcmire June 4, 2024 20:44

cryptodev-2s and others added 3 commits June 5, 2024 10:45

Merge branch 'develop' into fix/attributions

9ca6e78

Merge branch 'develop' into fix/attributions

4804726

fix: update attributio,

c4b6d02

Merge branch 'develop' into fix/attributions

23ddf2c

mcmire approved these changes Jun 5, 2024

View reviewed changes

rickycodes approved these changes Jun 5, 2024

View reviewed changes

cryptodev-2s merged commit 1763040 into develop Jun 5, 2024
77 checks passed

cryptodev-2s deleted the fix/attributions branch June 5, 2024 20:00

github-actions bot locked and limited conversation to collaborators Jun 5, 2024

metamaskbot added the release-11.18.0 label Jun 5, 2024

gauthierpetetin added the release-12.0.0 Issue or pull request that will be included in release 12.0.0 label Jun 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Implement New Attributions Update Workflow via GitHub Actions #24390

feat: Implement New Attributions Update Workflow via GitHub Actions #24390

cryptodev-2s commented May 6, 2024 •

edited

Loading

github-actions bot commented May 6, 2024

socket-security bot commented May 6, 2024 •

edited

Loading

cryptodev-2s commented May 6, 2024

socket-security bot commented May 7, 2024 •

edited

Loading

cryptodev-2s commented May 7, 2024

cryptodev-2s commented May 7, 2024

cryptodev-2s commented May 9, 2024

metamaskbot commented May 9, 2024

cryptodev-2s commented May 9, 2024

metamaskbot commented May 9, 2024

cryptodev-2s commented May 9, 2024

cryptodev-2s commented May 9, 2024

metamaskbot commented Jun 4, 2024

mcmire left a comment

metamaskbot commented Jun 4, 2024

metamaskbot commented Jun 4, 2024

metamaskbot commented Jun 4, 2024

metamaskbot commented Jun 5, 2024

metamaskbot commented Jun 5, 2024

cryptodev-2s commented Jun 5, 2024

feat: Implement New Attributions Update Workflow via GitHub Actions #24390

feat: Implement New Attributions Update Workflow via GitHub Actions #24390

Conversation

cryptodev-2s commented May 6, 2024 • edited Loading

Description

Related issues

Manual testing steps

Locally

On GitHub (CI/PR)

Note

Screenshots/Recordings

Pre-merge author checklist

Pre-merge author checklist

Pre-merge reviewer checklist

github-actions bot commented May 6, 2024

socket-security bot commented May 6, 2024 • edited Loading

cryptodev-2s commented May 6, 2024

socket-security bot commented May 7, 2024 • edited Loading

Next steps

cryptodev-2s commented May 7, 2024

cryptodev-2s commented May 7, 2024

cryptodev-2s commented May 9, 2024

metamaskbot commented May 9, 2024

cryptodev-2s commented May 9, 2024

metamaskbot commented May 9, 2024

cryptodev-2s commented May 9, 2024

cryptodev-2s commented May 9, 2024

metamaskbot commented Jun 4, 2024

mcmire left a comment

Choose a reason for hiding this comment

metamaskbot commented Jun 4, 2024

metamaskbot commented Jun 4, 2024

metamaskbot commented Jun 4, 2024

metamaskbot commented Jun 5, 2024

metamaskbot commented Jun 5, 2024

cryptodev-2s commented Jun 5, 2024

cryptodev-2s commented May 6, 2024 •

edited

Loading

socket-security bot commented May 6, 2024 •

edited

Loading

socket-security bot commented May 7, 2024 •

edited

Loading