ci: Review GHA pipeline

.github/CODEOWNERS

@@ -4,4 +4,11 @@
 .github/actions/ @gpmayorga
 
 .github/workflows/ @sophialittlejohn
-.github/actions/ @sophialittlejohn
+.github/actions/ @sophialittlejohn
+
+# Workflows are less sensitive than actions
+.github/workflows/ @kattylucy
+
+# Add Jeroen for both actions and workflows
+.github/workflows/ @hieronx
+.github/actions/ @hieronx

.github/actions/archive-release/action.yml

@@ -39,13 +39,13 @@ runs:
     # Alernative: archive in a gcloud bucket:
       # - name: Auth gcloud
       #   id: gauth
-      #   uses: google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d # @v1
+      #   uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
       #   with:
       #     workload_identity_provider: '${{ secrets.GWIP }}'
       #     service_account: '${{ secrets.GSA }}'
       # # Install gcloud, `setup-gcloud` automatically picks up authentication from `auth`.
       # - name: 'Set up Cloud SDK'
-      #   uses: google-github-actions/setup-gcloud@62d4898025f6041e16b1068643bfc5a696863587 # @v1 
+      #   uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.2
 
       # - name: Archive ${{ inputs.name }} in gcloud bucket
       #   run: |

.github/actions/build-function/action.yml

@@ -13,9 +13,9 @@ runs:
   using: composite
   steps:
     - name: Setup Node
-      uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c #@v3.6.0
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a #@v4.2.0
       with:
-        node-version: '16'
+        node-version: '20'
         cache: yarn
 
     - name: Install Dependencies

.github/actions/deploy-gcs/action.yml

@@ -31,7 +31,7 @@ runs:
 
     - name: Auth gcloud
       id: gauth
-      uses: google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d # @v1
+      uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
       env:
         GSA: ${{ inputs.GSA }}
         GWIP: ${{ inputs.GWIP }}
@@ -41,7 +41,7 @@ runs:
 
     # Install gcloud, `setup-gcloud` automatically picks up authentication from `auth`.
     - name: 'Set up Cloud SDK'
-      uses: google-github-actions/setup-gcloud@62d4898025f6041e16b1068643bfc5a696863587 # @v1
+      uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2.1.2
 
     - name: Create bucket
       shell: sh

.github/actions/deploy-gfunction/action.yml

@@ -38,7 +38,7 @@ inputs:
     description: 'RAM settings for function (without unit suffix)'
     # https://cloud.google.com/sdk/gcloud/reference/functions/deploy#--memory
     # https://github.com/google-github-actions/deploy-cloud-functions?tab=readme-ov-file#inputs
-    default: 256
+    default: "256"
     required: false
 
 runs:
@@ -48,7 +48,7 @@ runs:
     # needs to be used in isolation, it won't work
     # unless the repo is checked out somewhere first
     - name: Checkout
-      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      uses: actions/checkout@v4
       with:
         path: apps # The next 3 steps use this folder
 
@@ -106,17 +106,17 @@ runs:
     ## or `run` commands that we write.
     - name: Auth gcloud
       id: gauth
-      uses: google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d # @v1
+      uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
       with:
         workload_identity_provider: ${{ inputs.GWIP }}
         service_account: ${{ inputs.GSA }}
 
     - name: Deploy to google functions
       id: gclouddeploy
-      uses: google-github-actions/deploy-cloud-functions@14509ca55199d9348161571e36c48e44f855030d #@v1
+      uses: google-github-actions/deploy-cloud-functions@b418957976ca9302f13bf31bd06aa0256b8263e1 #@v2.1.0
       with:
         name: '${{ steps.prepare.outputs.function_name }}'
-        runtime: 'nodejs18'
+        runtime: 'nodejs20'
         region: '${{ inputs.gcloud_region }}'
         source_dir: '${{ steps.download.outputs.download-path }}'
         entry_point: '${{ inputs.target }}'
@@ -133,7 +133,7 @@ runs:
       run: echo "::notice title=Function_URL::${{ steps.gclouddeploy.outputs.url }}"
 
     - name: Set up Cloud SDK
-      uses: google-github-actions/setup-gcloud@d51b5346f85640ec2aa2fa057354d2b82c2fcbce # v1.0.1
+      uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2.1.2
 
     - name: Change function to allow_unathorized calls
       shell: sh

.github/actions/deploy-ipfs/action.yml

@@ -21,7 +21,7 @@ runs:
   steps:
       - name: Setup Node
         id: setup_node
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c #@v3.6.0
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a #@v4.2.0
         with:
           node-version: '18'
           # cache: yarn

.github/actions/prepare-deploy/action.yml

@@ -60,11 +60,6 @@ runs:
           echo "front_url=app.staging.centrifuge.io" >> $GITHUB_OUTPUT
           echo "env_name=production" >> $GITHUB_OUTPUT
           # env_name is production because it needs to use the prod variable files inside each app
-        elif  ${{ inputs.deploy_to == 'catalyst' }}; then
-          # CATALYST
-          echo "function_name=${{ inputs.app_base_name }}-catalyst" >> $GITHUB_OUTPUT
-          echo "front_url=app-catalyst.k-f.dev" >> $GITHUB_OUTPUT
-          echo "env_name=catalyst" >> $GITHUB_OUTPUT
         elif ${{ inputs.deploy_to == 'demo' }}; then
           # DEMO
           echo "function_name=${{ inputs.app_base_name }}-demo" >> $GITHUB_OUTPUT
@@ -74,19 +69,19 @@ runs:
           if ${{ github.event_name == 'pull_request' }}; then
             # FF-PRODUCTION-PR
             # A build from the DEV env that points to prod
-            echo "function_name=NEVER_USED" >> $GITHUB_OUTPUT
+            # echo "function_name=NEVER_USED" >> $GITHUB_OUTPUT
             echo "front_url=pr${{ github.event.number }}-app-ff-production.k-f.dev" >> $GITHUB_OUTPUT
             echo "env_name=ff-prod" >> $GITHUB_OUTPUT 
           elif ${{ github.ref == 'refs/heads/main' }}; then
             # FF-PRODUCTION-MAIN
             # A build from the DEV env that points to prod
-            echo "function_name=NEVER_USED" >> $GITHUB_OUTPUT
+            # echo "function_name=NEVER_USED" >> $GITHUB_OUTPUT
             echo "front_url=app-ff-production.k-f.dev" >> $GITHUB_OUTPUT
             echo "env_name=ff-prod" >> $GITHUB_OUTPUT 
           fi
         elif  ${{ github.ref == 'refs/heads/main' }}; then
           # DEV
-          echo "function_name=NEVER_USED" >> $GITHUB_OUTPUT
+          # echo "function_name=NEVER_USED" >> $GITHUB_OUTPUT
           echo "front_url=app-dev.k-f.dev" >> $GITHUB_OUTPUT
           echo "env_name=development" >> $GITHUB_OUTPUT                  
         elif ${{ github.event_name == 'pull_request' }}; then

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/.github/workflows"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 2
+    assignees:
+      - sophialittlejohn
+      - gpmayorga
+    commit-message:
+      prefix: "chore"
+      include: "scope" 

.github/workflows/centrifuge-app.yml

@@ -26,7 +26,8 @@ jobs:
         working-directory: centrifuge-app
     steps:
       - name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4
+
       - name: prepare env logic
         id: prepare
         uses: ./.github/actions/prepare-deploy
@@ -35,9 +36,9 @@ jobs:
           deploy_to: ${{ inputs.deploy_env }}
 
       - name: Setup Node
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c #@v3.6.0
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
-          node-version: '16'
+          node-version: '20'
           cache: yarn
 
       - name: set PR function values
@@ -103,7 +104,7 @@ jobs:
     environment: ${{ needs.build-app.outputs.gh_env }}
     steps:
       - name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4
         with:
           path: apps
 
@@ -129,17 +130,20 @@ jobs:
     steps:
       - name: PR comment with preview URL
         id: prcomment
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
         env:
           pull_sha: ${{ github.event.pull_request.head.sha }}
+          PINNING_URL: https:\/\/${{ vars.GCLOUD_REGION  }}-${{ vars.GCP_DEV_PROJ }}.cloudfunctions.net\/pinning-api-pr${{ github.event.number }}
+          ONBOARDING_URL: https:\/\/${{ vars.GCLOUD_REGION  }}-${{ vars.GCP_DEV_PROJ }}.cloudfunctions.net\/onboarding-api-pr${{ github.event.number }}
         with:
-          comment_tag: pr_preview_url${{ inputs.deploy_env }}
+          comment-tag: pr_preview_url${{ inputs.deploy_env }}
           mode: upsert
           message: |
             PR deployed in Google Cloud
             URL: https://${{ needs.deploy-app.outputs.bucket_url }}
+            PINNING_URL: ${{ env.PINNING_URL }}
+            ONBOARDING_URL: ${{ env.ONBOARDING_URL }}
             Commit #: ${{ env.pull_sha }}   
-            To access the functions directly check the corresponding deploy Action
       - name: Check notify outputs
         run: |
           echo "id : ${{ steps.prcomment.outputs.id }}"

.github/workflows/dev-n-ffprod-deploys.yml

@@ -5,17 +5,17 @@ on:
   pull_request:
     # paths:
     #   - '.github/workflows/main-branch-deploys.yml'
-  
+# For FF and dev environments deploy only webApp, no functions
 jobs:
   development:
     if: github.ref == 'refs/heads/main'
     name: deploy-development
-    uses: ./.github/workflows/deploy_all.yml
+    uses: ./.github/workflows/centrifuge-app.yml
     secrets: inherit
     with:
-      environment: development
-# For FF-PROD deploy only webApp
+      deploy_env: development
   ff-prod:
+    name: deploy-ff-prod
     uses: ./.github/workflows/centrifuge-app.yml
     secrets: inherit
     with:

.github/workflows/e2e.yml

@@ -1,8 +1,9 @@
 name: Synpress tests
 
 on:
-  schedule:
-    - cron: '0 12 * * *'
+  workflow_dispatch:
+  # schedule:
+    # - cron: '0 12 * * *'
 
 jobs:
   cypress-run:
@@ -13,6 +14,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
       - name: Install linux deps
         run: |
           sudo apt-get install --no-install-recommends -y \
@@ -25,22 +27,21 @@ jobs:
           fluxbox &
         env:
           DISPLAY: :0.0
-      - uses: iamsauravsharma/[email protected]
-        with:
-          # input-prefix: '' # Optional (default: '')
-          file-path: 'centrifuge-app/.env' # Optional (default : '.env')
-        # output-prefix: 'OUTPUT_' # Optional (default: '')
-        env: # env available for only this steps
-          CYPRESS_PRIVATE_KEY: ${{secrets.CYPRESS_PRIVATE_KEY}}
-          PRIVATE_KEY: ${{secrets.CYPRESS_PRIVATE_KEY}}
-          NETWORK_NAME: centrifuge
-          RPC_URL: https://fullnode-apps.demo.k-f.dev
-          CHAIN_ID: 2090
-          SYMBOL: DEVEL
-          IS_TESTNET: true
-          DEBUG: true
+      - name: Create .env file
+        run: |
+          cat << EOF > centrifuge-app/.env
+          CYPRESS_PRIVATE_KEY=${{secrets.CYPRESS_PRIVATE_KEY}}
+          PRIVATE_KEY=${{secrets.CYPRESS_PRIVATE_KEY}}
+          NETWORK_NAME=centrifuge
+          RPC_URL=https://fullnode-apps.demo.k-f.dev
+          CHAIN_ID=2090
+          SYMBOL=DEVEL
+          IS_TESTNET=true
+          DEBUG=true
+          EOF
+
       - name: Synpress run
-        uses: cypress-io/github-action@v6
+        uses: cypress-io/github-action@7271bed2a170d73c0b08939cd192db51a1c46c50 # v6.7.10
         with:
           working-directory: centrifuge-app
           install-command: yarn

.github/workflows/fabric.yml

@@ -22,12 +22,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4
 
       - name: Setup Node
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c #@v3.6.0
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a #@v4.2.0
         with:
-          node-version: '16'
+          node-version: '20'
           cache: yarn
 
       - run: yarn install --immutable
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4
         with:
           path: apps
 

.github/workflows/faucet-api.yml

@@ -26,14 +26,14 @@ jobs:
         working-directory: faucet-api
     steps:
       - name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4
 
       - name: prepare env logic
         id: prepare
         uses: ./.github/actions/prepare-deploy
         with:
           app_base_name: ${{ env.app_name }}
-          deploy_to: ${{ env.deploy_to }}
+          deploy_to: ${{ inputs.deploy_env }}
 
       - name: build function
         uses: ./.github/actions/build-function
@@ -59,7 +59,7 @@ jobs:
       id-token: 'write'
     steps:
       - name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@v4
         with:
           path: apps