Migrate CI from Travis to GitHub Actions - #429
Merged
Merged
Conversation
Replaces .travis.yml with .github/workflows/ci.yml, preserving all three things the Travis pipeline did: publish a CI prerelease of @fs/react-scripts on every run, smoke-test that prerelease by scaffolding a real app against it, and publish the committed version on frontierMaster / v7.x / next. Artifactory auth now comes from actions/setup-node's registry-url instead of three hand-written .npmrc files. `scope` is deliberately omitted so setup-node writes a bare `registry=` line and all traffic keeps resolving through the jfrog virtual registry, preserving curation enforcement. CI prereleases are relabeled X.Y.Z-prerelease.<run-number>. GITHUB_RUN_NUMBER restarts at 1, but semver compares alphanumeric prerelease identifiers in ASCII order and 'T' (84) < 'p' (112), so 8.17.0-prerelease.1 still sorts above 8.17.0-TravisPrerelease.2311 and the `next` dist-tag does not move backwards. Bumps @fs/react-scripts to 8.16.3 so the frontierInit.js change actually ships; at 8.16.2 npmPublish would no-op. Also drops upstream Facebook CI config dead since the fork: azure-pipelines*, .github/workflows/integration.yml, and the Azure badge in README. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
create-react-app's init.js git-inits the app it scaffolds and then commits it. On a GitHub Actions runner there is no git identity, so the commit failed with status 128 and init.js deleted the .git directory it had just created -- a stack trace in the log for no result. The app scaffolded in CI is a throwaway smoke test that nothing commits or pushes, so skip the git work entirely there. Gated on a new isFrontierCi() helper in frontierInit.js, which also de-duplicates the GITHUB_REPOSITORY check that setupFrontier already made. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This repo's default_workflow_permissions is "write", so without an explicit block every job gets a read/write GITHUB_TOKEN. Nothing in this workflow touches the GitHub API: checkout only reads, and both the prerelease and release publishes authenticate to Artifactory with NODE_AUTH_TOKEN. Leaving a write-scoped token in the environment while `npm install` runs lifecycle scripts across the full dependency tree of a public repo is avoidable exposure. Matches merge-lingoport-translations.yml, which already declares its permissions explicitly. Flagged by CodeQL on #429. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces
.travis.ymlwith.github/workflows/ci.yml. All three things Travis did are preserved: publish a CI prerelease of@fs/react-scriptson every run, smoke-test it by scaffolding a real app against that exact prerelease, and publish the committed version onfrontierMaster/v7.x/next.Three things worth a look:
.npmrc. Auth comes fromactions/setup-node'sregistry-url, matching how zion does it.scope: '@fs'is deliberately omitted — with a scope only@fspackages route through Artifactory, without one setup-node writes a bareregistry=line and everything does, as on Travis. That keeps jfrog curation in play, which the E403 diagnostic inpublishPrReleaseAndCreateFreshCraTemplate.jsdepends on.X.Y.Z-prerelease.<run-number>.GITHUB_RUN_NUMBERrestarts at 1, but semver compares prerelease identifiers in ASCII order and'T'(84) <'p'(112), so8.17.0-prerelease.1still sorts above8.17.0-TravisPrerelease.2311— thenextdist-tag won't move backwards.frontierInit.jsships in the package; at 8.16.2npmPublishwould no-op and the change would never reach consumers.Also deletes upstream Facebook CI config dead since the fork (
azure-pipelines*,integration.yml, the Azure badge) — all keyed to amainbranch we don't have.Before merging, out-of-repo:
NPM_PUBLISH_TOKENrepo secret (copy from Travis; must be publish-capable, not the read-only orgNPM_TOKEN). The CI check on this PR will fail until this exists.frontierMasterfromTravis CI - Pull Requesttobuild-and-publish.Note:
pushis scoped to the three release branches, so a branch with no open PR no longer gets a prerelease. If anyone relies on that,branches-ignore: [master]restores it — at the cost of duplicate same-named check runs on every PR.🤖 Generated with Claude Code