feat: update nextjs 16 (#2420) #1691
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release version | |
| on: | |
| push: | |
| branches: [main, next] | |
| jobs: | |
| tests: | |
| uses: "./.github/workflows/ci.yml" | |
| secrets: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| release: | |
| concurrency: | |
| group: "release-${{ github.workflow }}-${{ github.ref }}" | |
| permissions: write-all | |
| outputs: | |
| VERSION: ${{ steps.get-version.outputs.VERSION }} | |
| PREV_VERSION: ${{ steps.get-prev-version.outputs.VERSION }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout project | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: true | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: "yarn" | |
| - name: Install dependencies | |
| run: yarn install --immutable | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| platforms: linux/amd64 | |
| install: true | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Expose GitHub Runtime | |
| uses: crazy-max/ghaction-github-runtime@v2 | |
| - name: Retrieve previous version | |
| id: get-prev-version | |
| run: echo "VERSION=$(git describe --tags --abbrev=0 | cut -c2-)" >> "$GITHUB_OUTPUT" | |
| - name: bump and release | |
| run: yarn release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} | |
| GITHUB_REF_NAME: ${{ env.GITHUB_REF_NAME }} | |
| - name: Retrieve new version | |
| id: get-version | |
| run: echo "VERSION=$(git describe --tags --abbrev=0 | cut -c2-)" >> "$GITHUB_OUTPUT" | |
| build-ui-recette: | |
| needs: ["release"] | |
| if: needs.release.outputs.VERSION != needs.release.outputs.PREV_VERSION | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout project | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: "yarn" | |
| - name: Install dependencies | |
| run: yarn install --immutable | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| platforms: linux/amd64 | |
| install: true | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Expose GitHub Runtime | |
| uses: crazy-max/ghaction-github-runtime@v2 | |
| - name: Build UI recette | |
| run: .bin/scripts/build-images.sh ${{ needs.release.outputs.VERSION }} push $(git rev-parse HEAD) recette | |
| env: | |
| CI: true | |
| build-ui-pentest: | |
| needs: ["release"] | |
| if: needs.release.outputs.VERSION != needs.release.outputs.PREV_VERSION | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout project | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: "yarn" | |
| - name: Install dependencies | |
| run: yarn install --immutable | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| platforms: linux/amd64 | |
| install: true | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Expose GitHub Runtime | |
| uses: crazy-max/ghaction-github-runtime@v2 | |
| - name: Build UI pentest | |
| run: .bin/scripts/build-images.sh ${{ needs.release.outputs.VERSION }} push $(git rev-parse HEAD) pentest | |
| env: | |
| CI: true | |
| docker-scout-server: | |
| if: needs.release.outputs.VERSION != needs.release.outputs.PREV_VERSION | |
| needs: ["release"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Authenticate to Docker | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKER_USER }} | |
| password: ${{ secrets.DOCKER_PAT }} | |
| - name: Server Docker Scout | |
| uses: docker/scout-action@v1 | |
| with: | |
| command: quickview,cves,recommendations,compare | |
| image: ghcr.io/mission-apprentissage/mna_lba_server:${{ needs.release.outputs.VERSION }} | |
| to: ghcr.io/mission-apprentissage/mna_lba_server:${{ needs.release.outputs.PREV_VERSION }} | |
| sarif-file: sarif-server.output.json | |
| only-vex-affected: true | |
| only-severities: "critical,high,medium" | |
| - name: Server Docker Upload SARIF result | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: sarif-server.output.json | |
| category: Docker Server | |
| docker-scout-ui: | |
| if: needs.release.outputs.VERSION != needs.release.outputs.PREV_VERSION | |
| needs: ["release"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Authenticate to Docker | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKER_USER }} | |
| password: ${{ secrets.DOCKER_PAT }} | |
| - name: UI Docker Scout | |
| uses: docker/scout-action@v1 | |
| with: | |
| command: quickview,cves,recommendations,compare | |
| image: ghcr.io/mission-apprentissage/mna_lba_ui:${{ needs.release.outputs.VERSION }}-production | |
| to: ghcr.io/mission-apprentissage/mna_lba_ui:${{ needs.release.outputs.PREV_VERSION }}-production | |
| sarif-file: sarif-ui.output.json | |
| only-vex-affected: true | |
| only-severities: "critical,high,medium" | |
| - name: UI Docker Upload SARIF result | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: sarif-ui.output.json | |
| category: Docker UI | |
| deploy-recette: | |
| concurrency: | |
| group: "deploy-${{ github.workflow }}-${{ github.ref }}" | |
| needs: ["release", "build-ui-recette"] | |
| name: Deploy ${{ needs.release.outputs.VERSION }} on recette | |
| uses: "./.github/workflows/_deploy.yml" | |
| with: | |
| environment: recette | |
| app_version: ${{ needs.release.outputs.VERSION }} | |
| secrets: | |
| DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }} | |
| DEPLOY_PASS: ${{ secrets.DEPLOY_PASS }} | |
| SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} | |
| VAULT_PWD: ${{ secrets.VAULT_PWD }} | |
| deploy-pentest: | |
| concurrency: | |
| group: "deploy-pentest-${{ github.workflow }}-${{ github.ref }}" | |
| needs: ["release", "build-ui-pentest"] | |
| name: Deploy ${{ needs.release.outputs.VERSION }} on pentest | |
| uses: "./.github/workflows/_deploy.yml" | |
| with: | |
| environment: pentest | |
| app_version: ${{ needs.release.outputs.VERSION }} | |
| secrets: | |
| DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }} | |
| DEPLOY_PASS: ${{ secrets.DEPLOY_PASS }} | |
| SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} | |
| VAULT_PWD: ${{ secrets.VAULT_PWD }} | |
| sentry: | |
| needs: ["release"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout project | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: true | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: "yarn" | |
| - name: Install dependencies | |
| run: yarn install --immutable | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull Docker images | |
| run: | | |
| docker pull ghcr.io/mission-apprentissage/mna_lba_server:${{ needs.release.outputs.VERSION }} | |
| docker pull ghcr.io/mission-apprentissage/mna_lba_ui:${{ needs.release.outputs.VERSION }}-production | |
| - name: Extract sourcemaps from Docker images | |
| run: | | |
| # Extract server sourcemaps | |
| docker create --name temp-server ghcr.io/mission-apprentissage/mna_lba_server:${{ needs.release.outputs.VERSION }} | |
| mkdir -p server/dist | |
| docker cp temp-server:/app/server/dist ./server/dist | |
| docker rm temp-server | |
| # Extract UI sourcemaps | |
| docker create --name temp-ui ghcr.io/mission-apprentissage/mna_lba_ui:${{ needs.release.outputs.VERSION }}-production | |
| mkdir -p ui/.next | |
| docker cp temp-ui:/app/ui/.next/static ./ui/.next/static | |
| docker rm temp-ui | |
| - name: Create vault pwd file | |
| run: echo ${{ secrets.VAULT_PWD }} > .infra/.vault_pwd.txt | |
| - name: upload sourcemaps to sentry | |
| run: .bin/mna-lba sentry:release ${{ needs.release.outputs.VERSION }} | |
| env: | |
| ANSIBLE_VAULT_PASSWORD_FILE: .infra/.vault_pwd.txt | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_REF_NAME: ${{ env.GITHUB_REF_NAME }} |