freemium-ui 2.0.132 → 2.0.134

package/.github/workflows/pr-preview-deploy.yml

@@ -0,0 +1,300 @@
+# Ephemeral Storybook preview per PR (pattern from Freshworks preview-env post):
+# build → S3 previews/{PR} → optional CloudFront invalidation → PR comment.
+#
+# Secrets: AWS_IAM_ROLE (role ARN to assume), PREVIEW_S3_BUCKET — optional: CLOUDFRONT_DISTRIBUTION_ID
+# Variables: PREVIEW_BASE_URL (public origin, e.g. https://xxx.cloudfront.net), AWS_REGION
+
+name: Preview Deploy
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [main]
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  pull-requests: write
+  deployments: write
+
+# Prevent concurrent deploys for the same PR; never cancel an in-flight run
+# so a deploy is never left in a partial state.
+concurrency:
+  group: preview-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: false
+
+jobs:
+  preview:
+    runs-on: fw-shared
+    timeout-minutes: 30
+    # Run only for non-draft, non-NO_PREVIEW PRs from the same repo (not forks),
+    # or when a repo member manually triggers via /preview-deploy comment on an
+    # open PR. Remaining validations (base.ref, collaborator) are enforced inside
+    # the Resolve PR head step where full PR data is available.
+    if: |
+      (github.event_name == 'pull_request' && !github.event.pull_request.draft && !contains(github.event.pull_request.labels.*.name, 'NO_PREVIEW') && github.event.pull_request.head.repo.full_name == github.repository)
+      || (github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.issue.state == 'open' && contains(github.event.comment.body, '/preview-deploy') && github.event.comment.user.type != 'Bot')
+
+    steps:
+      # Resolves the PR number and head SHA for both pull_request and issue_comment
+      # events. For issue_comment, also validates that the PR is not a fork, not a
+      # draft, and does not carry the NO_PREVIEW label before proceeding.
+      - name: Resolve PR head
+        id: pr
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber =
+              context.eventName === 'pull_request'
+                ? context.payload.pull_request.number
+                : context.issue.number;
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+            if (context.eventName === 'issue_comment') {
+              if (pr.head.repo.full_name !== `${context.repo.owner}/${context.repo.repo}`)
+                core.setFailed('Preview deploy is not supported for forked PRs.');
+              if (pr.base.ref !== 'main')
+                core.setFailed(`Preview deploy is only supported for PRs targeting main (this PR targets '${pr.base.ref}').`);
+              if (pr.draft) core.setFailed('Draft PRs cannot be previewed via /preview-deploy.');
+              if (pr.labels.some((l) => l.name === 'NO_PREVIEW'))
+                core.setFailed('This PR has the NO_PREVIEW label.');
+              // Allow the PR author or any repo collaborator to trigger /preview-deploy.
+              const commenter = context.payload.comment.user.login;
+              if (commenter !== pr.user.login) {
+                try {
+                  await github.rest.repos.checkCollaborator({
+                    ...context.repo,
+                    username: commenter,
+                  });
+                } catch {
+                  core.setFailed(`User '${commenter}' is not the PR author or a repository collaborator and cannot trigger /preview-deploy.`);
+                }
+              }
+            }
+            core.setOutput('number', String(pr.number));
+            core.setOutput('sha', pr.head.sha);
+
+      # Registers a GitHub Deployment record for this PR so the native
+      # "Deployments" section on the PR page tracks the preview environment.
+      # The deployment ID is captured as an output for subsequent status updates.
+      - name: Create GitHub Deployment
+        id: deployment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { data } = await github.rest.repos.createDeployment({
+              ...context.repo,
+              ref: '${{ steps.pr.outputs.sha }}',
+              environment: 'preview',
+              auto_merge: false,
+              required_contexts: [],
+              description: 'PR #${{ steps.pr.outputs.number }} preview',
+            });
+            core.setOutput('id', String(data.id));
+
+      # Marks the deployment as in_progress immediately so the PR shows a
+      # spinning indicator while the build and upload are running.
+      - name: Set deployment in_progress
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.repos.createDeploymentStatus({
+              ...context.repo,
+              deployment_id: Number('${{ steps.deployment.outputs.id }}'),
+              state: 'in_progress',
+              log_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+            });
+
+      # Checks out the exact commit from the PR head (not the merge commit)
+      # so the preview reflects what is in the PR branch.
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.pr.outputs.sha }}
+          fetch-depth: 1
+
+      # Sets up Node.js 20 with npm cache enabled to speed up subsequent installs.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      # Configures npm to fetch @freshworks scoped packages from GitHub Packages.
+      - name: Configure npm for GitHub Packages
+        run: |
+          echo "@freshdesk:registry=https://npm.pkg.github.com/" >> .npmrc
+          echo "@freshworks:registry=https://npm.pkg.github.com/" >> .npmrc
+          echo "@freshworksinc:registry=https://npm.pkg.github.com/" >> .npmrc
+          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GH_AUTH_TOKEN }}" >> .npmrc
+
+      # Installs exact dependency versions from package-lock.json.
+      - run: npm ci
+
+      # Assumes the IAM role specified by AWS_IAM_ROLE using the runner's base
+      # credentials (instance profile). Exports temporary credentials to
+      # GITHUB_ENV so all subsequent steps can make authenticated AWS calls.
+      # Fails fast with a clear error if assume-role or any credential extraction fails.
+      - name: Configure AWS credentials
+        run: |
+          set -euo pipefail
+
+          SESSION=$(aws sts assume-role \
+            --role-arn "${{ secrets.AWS_IAM_ROLE }}" \
+            --role-session-name "GitHubActionsPreviewSession") \
+            || { echo "ERROR: aws sts assume-role failed"; exit 1; }
+
+          AWS_ACCESS_KEY_ID=$(echo "$SESSION" | jq -re '.Credentials.AccessKeyId') \
+            || { echo "ERROR: Failed to extract AccessKeyId from assume-role response"; exit 1; }
+          AWS_SECRET_ACCESS_KEY=$(echo "$SESSION" | jq -re '.Credentials.SecretAccessKey') \
+            || { echo "ERROR: Failed to extract SecretAccessKey from assume-role response"; exit 1; }
+          AWS_SESSION_TOKEN=$(echo "$SESSION" | jq -re '.Credentials.SessionToken') \
+            || { echo "ERROR: Failed to extract SessionToken from assume-role response"; exit 1; }
+
+          echo "AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}" >> $GITHUB_ENV
+          echo "AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}" >> $GITHUB_ENV
+          echo "AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}" >> $GITHUB_ENV
+          echo "AWS_DEFAULT_REGION=${{ vars.AWS_REGION || 'us-east-1' }}" >> $GITHUB_ENV
+
+      # Ensures PREVIEW_BASE_URL is set before the build so PREVIEW_URL is never
+      # constructed from an empty base, which would produce broken relative URLs.
+      - name: Validate required variables
+        run: |
+          if [ -z "${{ vars.PREVIEW_BASE_URL }}" ]; then
+            echo "ERROR: Repository variable PREVIEW_BASE_URL is not set. Set it under Settings → Variables."
+            exit 1
+          fi
+
+      # Builds the Storybook static output into storybook-static/.
+      # PREVIEW_URL tells Storybook the public base path it will be served from.
+      - name: Build Storybook
+        run: npm run build-storybook
+        env:
+          PREVIEW_URL: ${{ vars.PREVIEW_BASE_URL }}/previews/${{ steps.pr.outputs.number }}/
+
+      # Uploads the built Storybook to S3 under previews/{PR_NUM}/.
+      # Entry points (index.html, iframe.html) are uploaded with no-cache so
+      # browsers always fetch the latest HTML on each redeploy.
+      # All other assets are synced with a 1-year TTL since their filenames
+      # are content-hashed and safe to cache indefinitely.
+      - name: Upload to S3
+        env:
+          BUCKET: ${{ secrets.PREVIEW_S3_BUCKET }}
+          PR_NUM: ${{ steps.pr.outputs.number }}
+        run: |
+          if [ -z "$BUCKET" ]; then
+            echo "Set repository secret PREVIEW_S3_BUCKET."
+            exit 1
+          fi
+          # Upload entry points with no-cache so browsers always fetch the latest HTML
+          for f in index.html iframe.html; do
+            if [ -f "storybook-static/$f" ]; then
+              aws s3 cp "storybook-static/$f" "s3://${BUCKET}/previews/${PR_NUM}/$f" \
+                --cache-control "no-cache, must-revalidate"
+            else
+              echo "ERROR: Expected Storybook output file 'storybook-static/$f' is missing. Ensure the build completed successfully."
+              exit 1
+            fi
+          done
+          # Sync remaining assets with a long TTL (safe because filenames are content-hashed)
+          aws s3 sync storybook-static/ "s3://${BUCKET}/previews/${PR_NUM}/" \
+            --delete \
+            --exclude "index.html" \
+            --exclude "iframe.html" \
+            --cache-control "max-age=31536000,public"
+
+      # Invalidates the CloudFront cache for this PR's preview path so the
+      # updated files are served immediately. Skipped if CLOUDFRONT_DISTRIBUTION_ID
+      # is not configured.
+      - name: Invalidate CloudFront
+        env:
+          DIST_ID: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
+          PR_NUM: ${{ steps.pr.outputs.number }}
+        run: |
+          if [ -z "$DIST_ID" ]; then
+            echo "Skipping CloudFront invalidation (CLOUDFRONT_DISTRIBUTION_ID not set)."
+            exit 0
+          fi
+          aws cloudfront create-invalidation \
+            --distribution-id "$DIST_ID" \
+            --paths "/previews/${PR_NUM}/*"
+
+      # Marks the GitHub Deployment as success and sets the environment_url to
+      # the preview link so it appears in the native Deployments section of the PR.
+      - name: Set deployment success
+        uses: actions/github-script@v7
+        env:
+          BASE_URL: ${{ vars.PREVIEW_BASE_URL }}
+        with:
+          script: |
+            const base = (process.env.BASE_URL || '').replace(/\/$/, '');
+            const previewUrl = `${base}/previews/${{ steps.pr.outputs.number }}/index.html`;
+            await github.rest.repos.createDeploymentStatus({
+              ...context.repo,
+              deployment_id: Number('${{ steps.deployment.outputs.id }}'),
+              state: 'success',
+              environment_url: previewUrl,
+              log_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+            });
+
+      # Posts or updates a single bot comment on the PR with the preview URL.
+      # Uses a hidden HTML marker to find and update the existing comment on
+      # re-deploys instead of posting a new one each time.
+      # Paginates through all comments (100 per page) to reliably find the marker
+      # even on PRs with many comments.
+      - name: PR comment with preview URL
+        uses: actions/github-script@v7
+        env:
+          BASE_URL: ${{ vars.PREVIEW_BASE_URL }}
+        with:
+          script: |
+            const prNumber = Number('${{ steps.pr.outputs.number }}');
+            const base = (process.env.BASE_URL || '').replace(/\/$/, '');
+            const previewUrl = `${base}/previews/${prNumber}/index.html`;
+            const marker = '<!-- preview-deploy-comment -->';
+            const body = [
+              marker,
+              '### Preview environment ready',
+              '',
+              `**Preview:** [${previewUrl}](${previewUrl})`,
+              '',
+              `_Updated: ${new Date().toUTCString()}_`,
+            ].join('\n');
+
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              ...context.repo,
+              issue_number: prNumber,
+              per_page: 100,
+            });
+            const existing = comments.find((c) => c.body?.includes(marker));
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                ...context.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: prNumber,
+                body,
+              });
+            }
+
+      # Marks the GitHub Deployment as failure if any earlier step failed,
+      # so the PR's Deployments section reflects the broken state.
+      # Only runs if the deployment record was successfully created.
+      - name: Set deployment failure
+        if: failure() && steps.deployment.outputs.id != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.repos.createDeploymentStatus({
+              ...context.repo,
+              deployment_id: Number('${{ steps.deployment.outputs.id }}'),
+              state: 'failure',
+              log_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+            });

package/.github/workflows/pr-quality.yml

@@ -0,0 +1,114 @@
+name: PR Quality
+
+on:
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: pr-quality-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    name: Lint, format, test, and build
+    runs-on: fw-shared
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # SonarQube needs full history for blame attribution and new-code
+          # detection, plus the base branch to diff the pull request against.
+          fetch-depth: 0
+          # Do not leave the GITHUB_TOKEN in the workspace git config. The SonarQube
+          # scan action runs in a container with the workspace mounted, and no step
+          # here performs a git network operation that would need the credential.
+          persist-credentials: false
+
+      # Node 20 LTS — align with org runner or bump when standard changes
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      # Configures npm to fetch @freshworks scoped packages from GitHub Packages —
+      # needed here because this package depends on @freshworks/dew-styles.
+      - name: Configure npm for GitHub Packages
+        run: |
+          echo "@freshdesk:registry=https://npm.pkg.github.com/" >> .npmrc
+          echo "@freshworks:registry=https://npm.pkg.github.com/" >> .npmrc
+          echo "@freshworksinc:registry=https://npm.pkg.github.com/" >> .npmrc
+          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GH_AUTH_TOKEN }}" >> .npmrc
+
+      # --ignore-scripts: this job runs PR-controlled code, and npm ci runs
+      # lifecycle scripts (this repo's own `prepare` script, plus any
+      # dependency's install/postinstall) before the token is removed below.
+      # No dependency here has an install script that's actually needed to
+      # build or test (verified against the lockfile) — husky's `prepare` is
+      # pointless in CI anyway, since no local commit happens here.
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      # The step above appends a literal GH_AUTH_TOKEN to the workspace .npmrc.
+      # Remove it so the token does not persist into later steps — the SonarQube
+      # scan action runs in a container with the workspace mounted. No step after
+      # this one installs packages. The tracked .npmrc in this repo is empty, so
+      # there's nothing to restore — just delete the appended file.
+      - name: Remove npm auth token from workspace
+        if: ${{ always() }}
+        run: git checkout -- .npmrc || rm -f .npmrc
+
+      - name: Prettier check
+        run: npm run check
+
+      - name: ESLint
+        run: npm run lint:ci
+
+      # Coverage is collected here (not a plain test run) so SonarQube has an
+      # lcov report to read.
+      - name: Unit tests
+        timeout-minutes: 15
+        env:
+          CI: true
+        run: npm run test:coverage
+
+      # Reads sonar-project.properties for scope/exclusions; the pull request
+      # parameters below are the only per-run values.
+      # continue-on-error: the SonarQube instance is at its server-wide LOC
+      # licence limit, so analyses can fail server-side. A quality signal must
+      # not block PRs until that is resolved and the quality gate is reviewed.
+      - name: SonarQube analysis
+        id: sonar
+        continue-on-error: true
+        # Pinned to v8.2.1 rather than the mutable @master ref — this action
+        # runs with SONAR_TOKEN and the PR workspace mounted.
+        uses: sonarsource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+          SONAR_SCANNER_OPTS: >
+            -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
+            -Dsonar.pullrequest.branch=${{ github.head_ref }}
+            -Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}
+
+      # continue-on-error makes the job conclusion "success" regardless, which
+      # would hide auth, host, scanner and configuration failures. Surface the
+      # real outcome as an annotation without blocking the PR.
+      # Caveat: this only catches scanner-side failures. A server-side rejection
+      # (e.g. LICENSING_LOC) still exits 0 — verify via the SonarQube task API:
+      # /api/ce/component?component=<projectKey>
+      - name: Flag SonarQube analysis failure
+        if: steps.sonar.outcome != 'success'
+        run: |
+          echo "::warning title=SonarQube analysis did not complete::Step outcome was '${{ steps.sonar.outcome }}'. Quality data for this PR may be missing — see the SonarQube analysis step log."
+
+      # ESLint is already run as a dedicated step above. The real library build
+      # is `build` (rollup -> lib/, then a post-build script) — not
+      # `build-react-app`, which is a vestigial CRA-scaffold script.
+      - name: Production build
+        run: DISABLE_ESLINT_PLUGIN=true npm run build