Merge branch 'main' into fix-buf-version

AndrewWinterman · web-flow · commit bdd7afdc37d3 · 2025-10-13T02:52:57.000-07:00
diff --git a/.mise/tasks/docker/build b/.mise/tasks/docker/build
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+#MISE description="Builds a Docker image for the current application in the dev environment."
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+SHELL_DIR="$DIR/../../../shell"
+LIB_DIR="$SHELL_DIR/lib"
+
+# shellcheck source=../../../shell/lib/bootstrap.sh
+source "$LIB_DIR"/bootstrap.sh
+
+APP_VERSION="$(get_app_version)" "$SHELL_DIR"/docker-build.sh
diff --git a/README.md b/README.md
@@ -33,9 +33,15 @@ modules:
 ...
 ```
 
-CI will now use that branch, to use it locally re-run any `make` command. **Note**: This will not automatically update locally when the remote branch is changed, in order to do that you will need to `rm -rf .bootstrap` and re-run a `make` command. If you are testing changes to `make e2e`, you must also run
+CI will now use that branch, to use it locally re-run any `make` command.
+
+> [!NOTE]
+> This will not automatically update locally when the remote branch is changed, in order to do that you will need to `rm -rf .bootstrap` and re-run a `make` command. If you are testing changes to `make e2e`, you must also run
 `rm -rf ~/.outreach/.cache/gobin/binaries/$(go version | awk '{ print $3 }' | tr -d 'go')/github.com/getoutreach/devbase` before re-running a make command, in addition to `rm -rf .bootstrap`.
 
+> [!WARNING]
+> If you run `stencil` while using the custom build, your manual changes to `stencil.lock` will be erased and replaced with the `devbase` version specified by `service.yaml`. You will need to restore the branch name manually after `stencil` completes.
+
 ## Building Docker Images
 
 Docker images can be built by creating a `docker.yaml` file in the `deployments/` directory of a repository. The format of this file is as follows:
diff --git a/root/Makefile b/root/Makefile
@@ -212,10 +212,10 @@ debug:: pre-debug
 	@if [[ -n $$DLV_PORT ]]; then DEVBOX_LOGFMT="$(LOGFMT)" ./scripts/shell-wrapper.sh debug.sh; fi
 	@if [[ -z $$DLV_PORT ]]; then OUTREACH_ACCOUNTS_BASE_URL=$(ACCOUNTS_URL) MY_NAMESPACE=$(E2E_NAMESPACE) OUTREACH_DOMAIN=$(OUTREACH_DOMAIN) ./scripts/shell-wrapper.sh debug.sh; fi
 
-## docker-build:    build docker image for dev environment
+## docker-build:    [DEPRECATED] build docker image for dev environment
 .PHONY: docker-build
 docker-build:: pre-docker-build
-	@./scripts/shell-wrapper.sh docker-build.sh
+	@./scripts/shell-wrapper.sh deprecated-task.sh docker-build docker:build
 
 ## fmt:             run source code formatters
 .PHONY: fmt
diff --git a/shell/ci/release/dryrun.sh b/shell/ci/release/dryrun.sh
@@ -58,12 +58,13 @@ if ! git diff --quiet "$OLD_CIRCLE_BRANCH"; then
   git merge --squash "$OLD_CIRCLE_BRANCH"
   git commit -m "$COMMIT_MESSAGE"
 
-  GH_TOKEN="$(github_token)"
-  if [[ -z $GH_TOKEN ]]; then
+  GITHUB_TOKEN="$(github_token)"
+  if [[ -z $GITHUB_TOKEN ]]; then
     warn "Failed to read Github personal access token" >&2
   fi
 
-  GH_TOKEN="$GH_TOKEN" yarn --frozen-lockfile semantic-release --dry-run
+  MISE_GITHUB_TOKEN="$GITHUB_TOKEN" GH_TOKEN="$GITHUB_TOKEN" \
+    yarn --frozen-lockfile semantic-release --dry-run
 
   # Handle prereleases for CLIs, pre-conditions for this exist
   # in the script.
diff --git a/shell/ci/release/release.sh b/shell/ci/release/release.sh
@@ -8,16 +8,18 @@ LIB_DIR="${DIR}/../../lib"
 # shellcheck source=../../lib/github.sh
 source "${LIB_DIR}/github.sh"
 
+# shellcheck source=../../lib/logging.sh
+source "${LIB_DIR}/logging.sh"
+
 # Retrieve the GH_TOKEN
-GH_TOKEN="$(github_token)"
-if [[ -z $GH_TOKEN ]]; then
-  echo "Failed to read GitHub personal access token" >&2
+GITHUB_TOKEN="$(github_token)"
+if [[ -z $GITHUB_TOKEN ]]; then
+  error "Failed to read GitHub personal access token"
 fi
 
 send_failure_notification() {
   if [[ -z $RELEASE_FAILURE_SLACK_CHANNEL ]]; then
-    echo "Failed to release"
-    exit 1
+    fatal "Failed to release"
   fi
 
   curl -X POST "$RELEASE_FAILURE_WEBHOOK" \
@@ -26,9 +28,6 @@ send_failure_notification() {
   exit 1
 }
 
-# shellcheck source=../../lib/logging.sh
-source "${LIB_DIR}/logging.sh"
-
 # shellcheck source=../../lib/bootstrap.sh
 source "${LIB_DIR}/bootstrap.sh"
 
@@ -44,5 +43,5 @@ unset CI_PULL_REQUEST
 unset CI_PULL_REQUESTS
 
 # Unset NPM_TOKEN to force it to use the configured ~/.npmrc
-NPM_TOKEN='' GH_TOKEN=$GH_TOKEN \
+NPM_TOKEN='' MISE_GITHUB_TOKEN="$GITHUB_TOKEN" GH_TOKEN="$GITHUB_TOKEN" \
   yarn --frozen-lockfile semantic-release || send_failure_notification
diff --git a/shell/circleci/machine.sh b/shell/circleci/machine.sh
@@ -49,3 +49,6 @@ fi
 if ! command -v aws >/dev/null; then
   install_tool_with_mise aws-cli
 fi
+
+# Tiny app to work around GitHub token rate limits
+install_tool_with_mise wait-for-gh-rate-limit
diff --git a/shell/circleci/setup.sh b/shell/circleci/setup.sh
@@ -6,9 +6,15 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
 CI_DIR="$DIR/../ci"
 LIB_DIR="$DIR/../lib"
 
+# shellcheck source=../lib/bootstrap.sh
+source "${LIB_DIR}/bootstrap.sh"
+
 # shellcheck source=../lib/circleci.sh
 source "${LIB_DIR}/circleci.sh"
 
+# shellcheck source=../lib/github.sh
+source "${LIB_DIR}/github.sh"
+
 # shellcheck source=../lib/logging.sh
 source "${LIB_DIR}/logging.sh"
 
@@ -18,6 +24,12 @@ source "${LIB_DIR}/mise.sh"
 # shellcheck source=../lib/shell.sh
 source "${LIB_DIR}/shell.sh"
 
+if gh_installed; then
+  # shellcheck disable=SC2119
+  # Why: no extra args needed to pass to ghaccesstoken in this case.
+  bootstrap_github_token
+fi
+
 if [[ -z $ALLOW_MISE_TO_MANAGE_TOOL_VERSIONS ]]; then
   # Ensure that asdf is ready to be used
   info "🔨 Setting up asdf"
diff --git a/shell/devspace_start.sh b/shell/devspace_start.sh
@@ -6,6 +6,9 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
 # shellcheck source=./lib/box.sh
 source "$DIR/lib/box.sh"
 
+# Trust mise config in app
+mise trust --cd /home/dev/app
+
 GH_NO_UPDATE_NOTIFIER=true gh auth setup-git
 
 # SSH -> HTTPS, since we're not using SSH keys
diff --git a/shell/docker-build.sh b/shell/docker-build.sh
@@ -1,5 +1,12 @@
 #!/usr/bin/env bash
 # Builds a Docker image for the current application in the dev environment.
+#
+# External environment variables accepted:
+#
+# * `APP_VERSION` (REQUIRED)
+# * `DOCKERFILE` (defaults to `deployments/$app/Dockerfile`)
+# * `DOCKER_BUILD_EXTRA_ARGS` (extra arguments to `docker build`,
+#   defaults to empty string)
 
 set -eo pipefail
 
@@ -17,9 +24,13 @@ source "${LIB_DIR}/logging.sh"
 # shellcheck source=./lib/docker.sh
 source "${LIB_DIR}/docker.sh"
 
+if [[ -z ${APP_VERSION:-} ]]; then
+  fatal "Please specify APP_VERSION"
+fi
+
 appName="$(get_app_name)"
 
-if [[ -z $DOCKERFILE ]]; then
+if [[ -z ${DOCKERFILE:-} ]]; then
   DOCKERFILE="deployments/$appName/Dockerfile"
 fi
 
@@ -41,5 +52,5 @@ DOCKER_BUILDKIT=1 docker build \
   --ssh default "${tags[@]}" \
   -f "$DOCKERFILE" \
   . \
-  --build-arg VERSION="$APP_VERSION" \
-  $DOCKER_BUILD_EXTRA_ARGS
+  --build-arg VERSION="${APP_VERSION:-}" \
+  ${DOCKER_BUILD_EXTRA_ARGS:-}
diff --git a/shell/lib/github.sh b/shell/lib/github.sh
@@ -1,5 +1,12 @@
 #!/usr/bin/env bash
 # Contains various helper functions for interacting with Github.
+#
+# Requires the following libraries:
+# * logging.sh (required by mise.sh)
+# * mise.sh
+# * shell.sh (required by mise.sh)
+#
+# Setting the GitHub token requires bootstrap.sh.
 
 # LIB_DIR is the directory that shell script libraries live in.
 LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
@@ -14,14 +21,21 @@ source "$LIB_DIR/shell.sh"
 ghCmd=""
 
 # Looks for gh in the PATH or in the mise environment.
-run_gh() {
+gh_installed() {
   if [[ -z $ghCmd ]]; then
     ghCmd="$(find_tool gh)"
     if [[ -z $ghCmd ]]; then
-      error "gh not found in mise environment (run_gh)"
+      error "gh not found in mise environment (gh_installed)"
       return 1
     fi
   fi
+}
+
+# Runs gh if found, otherwise fails.
+run_gh() {
+  if ! gh_installed; then
+    return 1
+  fi
 
   "$ghCmd" "$@"
 }
@@ -98,6 +112,7 @@ bootstrap_github_token() {
 
 # Print the GitHub token from getoutreach/ci:ghaccesstoken. Any
 # arguments are passed to `ghaccesstoken token`.
+# Requires lib/bootstrap.sh for `get_tool_version`.
 fetch_github_token_from_ci() {
   (
     local version
@@ -115,7 +130,7 @@ fetch_github_token_from_ci() {
 ghaccesstoken_exists() {
   local version="$1"
   local ghaccesstoken_path
-  ghaccesstoken_path="$(mise which ghaccesstoken 2>/dev/null)"
+  ghaccesstoken_path="$(find_tool ghaccesstoken 2>/dev/null)"
   if [[ -z $ghaccesstoken_path ]]; then
     return 1
   fi
diff --git a/shell/lib/mise.sh b/shell/lib/mise.sh
@@ -125,7 +125,7 @@ install_tool_with_mise() {
 
   info "Installing $tool via mise"
 
-  if ! mise use --global "$tool"; then
+  if ! run_mise use --global "$tool"; then
     fatal "Error: failed to install $tool via mise" >&2
   fi
 }
@@ -170,6 +170,24 @@ find_mise() {
   fi
 }
 
+# run_mise ARGS...
+#
+# Runs `mise`. If `MISE_GITHUB_TOKEN` or `GITHUB_TOKEN` is set and
+# `wait-for-gh-rate-limit` is installed, makes sure that the token
+# isn't rate limited before calling `mise`.
+run_mise() {
+  local mise_path
+  mise_path="$(find_mise)"
+  if [[ -n ${MISE_GITHUB_TOKEN:-} || -n ${GITHUB_TOKEN:-} ]]; then
+    local wait_for_gh_rate_limit
+    wait_for_gh_rate_limit="$(find_tool wait-for-gh-rate-limit)"
+    if [[ -n $wait_for_gh_rate_limit ]]; then
+      "$wait_for_gh_rate_limit"
+    fi
+  fi
+  "$mise_path" "$@"
+}
+
 # find_tool TOOL_NAME
 #
 # Prints the path to a tool from either PATH or in the
@@ -195,14 +213,14 @@ mise_install_if_needed() {
   local tool_name="$1"
   local installed versions
 
-  versions="$(mise ls --local --json "$tool_name")"
+  versions="$(run_mise ls --local --json "$tool_name")"
   if [[ $versions == "[]" ]]; then
     fatal "mise: $tool_name is not declared in mise.toml"
   fi
   installed="$(echo "$versions" | gojq --raw-output '.[] | select(.installed and .active)')"
 
   if [[ -z $installed ]]; then
     info "mise: installing $tool_name"
-    mise install --yes "$tool_name"
+    run_mise install --yes "$tool_name"
   fi
 }
diff --git a/shell/linters/prettier.sh b/shell/linters/prettier.sh
@@ -13,7 +13,7 @@ source "$DIR/lib/mise.sh"
 extensions=(yaml yml json md ts)
 
 prettier_defined_via_mise() {
-  [[ "$(gojq --raw-output .devDependencies.prettier package.json)" == "null" ]]
+  [[ -f package.json && "$(gojq --raw-output .devDependencies.prettier package.json)" == "null" ]]
 }
 
 find_and_install_prettier_if_needed() {
