Candidate chore_release-8.5.0 cherry-pick branch

.github/CODEOWNERS

@@ -14,6 +14,6 @@
 /api-client @Opentrons/js
 /react-api-client @Opentrons/js
 /app-shell @Opentrons/js
-/components @Opentrons/js
+/components @Opentrons/js @Opentrons/components-devs
 /api @Opentrons/py
 /shared-data/js @Opentrons/js

.github/workflows/abr-testing-lint-test.yaml

@@ -7,19 +7,19 @@ on:
     paths:
       - 'Makefile'
       - 'abr-testing/**'
-      - 'scripts/**/*.mk'
-      - 'scripts/**/*.py'
+      - 'scripts/**.mk'
+      - 'scripts/**.py'
       - '.github/workflows/abr-testing-lint-test.yaml'
       - '.github/actions/python/**'
     branches:
       - 'edge'
     tags-ignore:
-      - '*'
+      - '**'
   pull_request:
     paths:
       - 'abr-testing/**'
-      - 'scripts/**/*.mk'
-      - 'scripts/**/*.py'
+      - 'scripts/**.mk'
+      - 'scripts/**.py'
       - '.github/workflows/abr-testing-lint-test.yaml'
   workflow_dispatch:
 

.github/workflows/analyses-snapshot-test.yaml

@@ -25,7 +25,7 @@ on:
       - '!api/docs/**'
       - '!api/release-notes-internal.md'
       - '!api/release-notes.md'
-      - 'shared-data/**/*'
+      - 'shared-data/**'
       - '!shared-data/js/**'
       - '.github/workflows/analyses-snapshot-test.yaml'
       - 'analyses-snapshot-testing/**'

.github/workflows/api-test-lint-deploy.yaml

@@ -7,27 +7,27 @@ on:
   # Most of the time, we run on pull requests, which lets us handle external PRs
   pull_request:
     paths:
-      - 'api/**/*'
+      - 'api/**'
       - 'Makefile'
-      - 'shared-data/**/*'
+      - 'shared-data/**'
       - '!shared-data/js/**'
-      - 'hardware/**/*'
-      - 'scripts/**/*.mk'
-      - 'scripts/**/*.py'
+      - 'hardware/**'
+      - 'scripts/**.mk'
+      - 'scripts/**.py'
       - '.github/workflows/api-test-lint-deploy.yaml'
-      - '.github/actions/python/**/*'
+      - '.github/actions/python/**'
       - '.github/workflows/utils.js'
   push:
     paths:
       - 'api/**'
       - 'Makefile'
-      - 'shared-data/**/*'
-      - '!shared-data/js/**/*'
-      - 'hardware/**/*'
-      - 'scripts/**/*.mk'
-      - 'scripts/**/*.py'
+      - 'shared-data/**'
+      - '!shared-data/js/**'
+      - 'hardware/**'
+      - 'scripts/**.mk'
+      - 'scripts/**.py'
       - '.github/workflows/api-test-lint-deploy.yaml'
-      - '.github/actions/python/**/*'
+      - '.github/actions/python/**'
       - '.github/workflows/utils.js'
     branches:
       - 'edge'

.github/workflows/app-test-build-deploy.yaml

@@ -6,14 +6,14 @@ on:
   push:
     paths:
       - 'Makefile'
-      - 'app/**/*'
-      - 'app-shell/**/*'
-      - 'app-shell-odd/**/*'
-      - 'components/**/*'
-      - 'shared-data/**/*'
-      - 'discovery-client/**/*'
+      - 'app/**'
+      - 'app-shell/**'
+      - 'app-shell-odd/**'
+      - 'components/**'
+      - 'shared-data/**'
+      - 'discovery-client/**'
       - '*.js'
-      - 'scripts/**/*'
+      - 'scripts/**'
       - '*.json'
       - 'yarn.lock'
       - '.github/workflows/app-test-build-deploy.yaml'
@@ -26,24 +26,24 @@ on:
   pull_request:
     paths:
       - 'Makefile'
-      - 'app/**/*'
-      - 'app-shell/**/*'
-      - 'app-shell-odd/**/*'
-      - 'components/**/*'
-      - 'shared-data/**/*'
-      - 'discovery-client/**/*'
+      - 'app/**'
+      - 'app-shell/**'
+      - 'app-shell-odd/**'
+      - 'components/**'
+      - 'shared-data/**'
+      - 'discovery-client/**'
       - '*.js'
       - '*.json'
       - 'yarn.lock'
-      - 'scripts/**/*'
-  workflow_dispatch:
+      - 'scripts/**'
+  workflow_dispatch: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ github.ref_name != 'edge' || github.run_id}}-${{ github.ref_type != 'tag' || github.run_id }}
   cancel-in-progress: true
 
 env:
-  CI: true
+  CI: "true"
   _APP_DEPLOY_BUCKET_ROBOTSTACK: builds.opentrons.com
   _APP_DEPLOY_FOLDER_ROBOTSTACK: app
   _APP_DEPLOY_BUCKET_OT3: ot3-development.builds.opentrons.com
@@ -57,33 +57,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: 'actions/checkout@v4'
-      - uses: 'actions/setup-node@v4'
-        with:
-          node-version: '22.11.0'
-      - name: 'install udev'
-        run: |
-          # WORKAROUND: Remove microsoft debian repo due to https://github.com/microsoft/linux-package-repositories/issues/130. Remove line below after it is resolved
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get update && sudo apt-get install libudev-dev
-      - name: 'set complex environment variables'
-        id: 'set-vars'
-        uses: actions/github-script@v6
-        with:
-          script: |
-            const { buildComplexEnvVars } = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/utils.js`)
-            buildComplexEnvVars(core, context)
-      - name: 'cache yarn cache'
-        uses: actions/cache@v3
-        with:
-          path: |
-            ${{ github.workspace }}/.npm-cache/_prebuild
-            ${{ github.workspace }}/.yarn-cache
-          key: js-${{ secrets.GH_CACHE_VERSION }}-${{ runner.os }}-yarn-${{ hashFiles('yarn.lock') }}
-      - name: 'setup-js'
-        run: |
-          npm config set cache ${{ github.workspace }}/.npm-cache
-          yarn config set cache-folder ${{ github.workspace }}/.yarn-cache
-          make setup-js
+      - uses: ./.github/actions/js/setup
       - name: 'test frontend packages'
         run: |
           make -C app test-cov
@@ -108,45 +82,12 @@ jobs:
       - uses: 'actions/checkout@v4'
         with:
           fetch-depth: 0
-      # https://github.com/actions/checkout/issues/290
-      - name: 'Fix actions/checkout odd handling of tags'
-        if: startsWith(github.ref, 'refs/tags')
-        run: |
-          git fetch -f origin ${{ github.ref }}:${{ github.ref }}
-          git checkout ${{ github.ref }}
-      - uses: 'actions/setup-node@v4'
-        with:
-          node-version: '22.11.0'
+      - uses: ./.github/actions/js/setup
       - uses: actions/setup-python@v4
         with:
           python-version: '3.10'
       - name: check make version
         run: make --version
-      - name: 'install libudev and libsystemd'
-        if: startsWith(matrix.os, 'ubuntu')
-        run: |
-          # WORKAROUND: Remove microsoft debian repo due to https://github.com/microsoft/linux-package-repositories/issues/130. Remove line below after it is resolved
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get update && sudo apt-get install libudev-dev
-      - name: 'set complex environment variables'
-        id: 'set-vars'
-        uses: actions/github-script@v6
-        with:
-          script: |
-            const { buildComplexEnvVars } = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/utils.js`)
-            buildComplexEnvVars(core, context)
-      - name: 'cache yarn cache'
-        uses: actions/cache@v3
-        with:
-          path: |
-            ${{ github.workspace }}/.npm-cache/_prebuild
-            ${{ github.workspace }}/.yarn-cache
-          key: js-${{ secrets.GH_CACHE_VERSION }}-${{ runner.os }}-yarn-${{ hashFiles('yarn.lock') }}
-      - name: setup-js
-        run: |
-          npm config set cache ${{ github.workspace }}/.npm-cache
-          yarn config set cache-folder ${{ github.workspace }}/.yarn-cache
-          make setup-js
       - name: 'test native(er) packages'
         run: make test-js-internal tests="${{matrix.shell}}/src" cov_opts="--coverage=true"
       - name: 'Upload coverage report'
@@ -264,72 +205,12 @@ jobs:
       - uses: 'actions/checkout@v4'
         with:
           fetch-depth: 0
-      # https://github.com/actions/checkout/issues/290
-      - name: 'Fix actions/checkout odd handling of tags'
-        if: startsWith(github.ref, 'refs/tags')
-        run: |
-          git fetch -f origin ${{ github.ref }}:${{ github.ref }}
-          git checkout ${{ github.ref }}
-      - uses: 'actions/setup-node@v4'
-        with:
-          node-version: '22.11.0'
+      - uses: ./.github/actions/js/setup
       - uses: actions/setup-python@v4
         with:
           python-version: '3.10'
       - name: check make version
         run: make --version
-      - name: 'install libudev and libsystemd'
-        if: startsWith(matrix.os, 'ubuntu')
-        run: |
-          # WORKAROUND: Remove microsoft debian repo due to https://github.com/microsoft/linux-package-repositories/issues/130. Remove line below after it is resolved
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get update && sudo apt-get install libudev-dev
-      - name: 'set complex environment variables'
-        id: 'set-vars'
-        uses: actions/github-script@v6
-        with:
-          script: |
-            const { buildComplexEnvVars } = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/utils.js`)
-            buildComplexEnvVars(core, context)
-      - name: 'cache yarn cache'
-        uses: actions/cache@v3
-        with:
-          path: |
-            ${{ github.workspace }}/.npm-cache/_prebuild
-            ${{ github.workspace }}/.yarn-cache
-          key: js-${{ secrets.GH_CACHE_VERSION }}-${{ runner.os }}-yarn-${{ hashFiles('yarn.lock') }}
-      - name: setup-js
-        run: |
-          npm config set cache ${{ github.workspace }}/.npm-cache
-          yarn config set cache-folder ${{ github.workspace }}/.yarn-cache
-          make setup-js
-
-      - name: 'Configure Windows code signing environment'
-        if: startsWith(matrix.os, 'windows') && contains(needs.determine-build-type.outputs.type, 'release')
-        shell: bash
-        run: |
-          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64_V2 }}" | base64 --decode > /d/Certificate_pkcs12.p12
-          echo "${{ secrets.WINDOWS_CSC_B64}}" | base64 --decode > /d/opentrons_labworks_inc.crt
-          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
-          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
-          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
-
-      - name: 'Setup Windows code signing helpers'
-        if: startsWith(matrix.os, 'windows') && contains(needs.determine-build-type.outputs.type, 'release')
-        shell: cmd
-        env:
-          SM_HOST: ${{ secrets.SM_HOST_V2 }}
-          SM_CLIENT_CERT_FILE: "D:\\Certificate_pkcs12.p12"
-          SM_CLIENT_CERT_PASSWORD: ${{secrets.SM_CLIENT_CERT_PASSWORD_V2}}
-          SM_API_KEY: ${{secrets.SM_API_KEY_V2}}
-        run: |
-          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:${{secrets.SM_API_KEY_V2}}" -o Keylockertools-windows-x64.msi
-          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
-          smksp_registrar.exe list
-          smctl.exe keypair ls
-          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
-          smksp_cert_sync.exe
-          smctl.exe healthcheck --all
 
       # Do the frontend dist bundle
       - name: 'bundle ${{matrix.variant}} frontend'
@@ -348,13 +229,9 @@ jobs:
           OT_APP_MIXPANEL_ID: ${{ secrets.OT_APP_MIXPANEL_ID }}
           OT_APP_INTERCOM_ID: ${{ secrets.OT_APP_INTERCOM_ID }}
           WINDOWS_SIGN: ${{ format('{0}', contains(needs.determine-build-type.outputs.type, 'release')) }}
-          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{secrets.SM_CODE_SIGNING_CERT_SHA1_HASH_V2}}
-          SM_KEYPAIR_ALIAS: ${{secrets.SM_KEYPAIR_ALIAS_V2}}
-          SM_HOST: ${{ secrets.SM_HOST_V2 }}
-          SM_CLIENT_CERT_FILE: "D:\\Certificate_pkcs12.p12"
-          SM_CLIENT_CERT_PASSWORD: ${{secrets.SM_CLIENT_CERT_PASSWORD_V2}}
-          SM_API_KEY: ${{secrets.SM_API_KEY_V2}}
-          WINDOWS_CSC_FILEPATH: "D:\\opentrons_labworks_inc.crt"
+          AZURE_TENANT_ID: ${{secrets.AZURE_TENANT_ID}}
+          AZURE_CLIENT_ID: ${{secrets.AZURE_CLIENT_ID}}
+          AZURE_CLIENT_SECRET: ${{secrets.AZURE_CLIENT_SECRET}}
           CSC_LINK: ${{ secrets.OT_APP_CSC_MACOS_V2 }}
           CSC_KEY_PASSWORD: ${{ secrets.OT_APP_CSC_KEY_MACOS_V2 }}
           APPLE_ID: ${{ secrets.OT_APP_APPLE_ID_V2 }}
@@ -489,52 +366,17 @@ jobs:
 
       - name: 'pull repo for scripts'
         uses: 'actions/checkout@v4'
-        with:
-          path: ./monorepo
-      # https://github.com/actions/checkout/issues/290
-      - name: 'Fix actions/checkout odd handling of tags'
-        if: startsWith(github.ref, 'refs/tags')
-        run: |
-          cd ./monorepo
-          git fetch -f origin ${{ github.ref }}:${{ github.ref }}
-          git checkout ${{ github.ref }}
-      - uses: 'actions/setup-node@v4'
-        with:
-          node-version: '22.11.0'
-      - name: 'install udev'
-        run: |
-          # WORKAROUND: Remove microsoft debian repo due to https://github.com/microsoft/linux-package-repositories/issues/130. Remove line below after it is resolved
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get update && sudo apt-get install libudev-dev
-      - name: 'set complex environment variables'
-        id: 'set-vars'
-        uses: actions/github-script@v6
-        with:
-          script: |
-            const { buildComplexEnvVars } = require(`${process.env.GITHUB_WORKSPACE}/monorepo/.github/workflows/utils.js`)
-            buildComplexEnvVars(core, context)
-      - name: 'cache yarn cache'
-        uses: actions/cache@v3
-        with:
-          path: |
-            ${{ github.workspace }}/.npm-cache/_prebuild
-            ${{ github.workspace }}/.yarn-cache
-      - name: 'setup-js'
-        run: |
-          npm config set cache ${{ github.workspace }}/.npm-cache
-          yarn config set cache-folder ${{ github.workspace }}/.yarn-cache
-          cd monorepo
-          make setup-js
+      - uses: ./.github/actions/js/setup
       - name: 'update internal-releases releases.json'
         if: needs.determine-build-type.outputs.type == 'release' && contains(fromJSON(needs.determine-build-type.outputs.variants), 'internal-release')
         run: |
           aws --profile=deploy s3 cp s3://${{ env._APP_DEPLOY_BUCKET_OT3 }}/${{ env._APP_DEPLOY_FOLDER_OT3 }}/releases.json ./to_upload_internal-release/releases.json
-          node ./monorepo/scripts/update-releases-json ./to_upload_internal-release/releases.json ot3 ./to_upload_internal-release https://ot3-development.builds.opentrons.com/app/
+          node ./scripts/update-releases-json ./to_upload_internal-release/releases.json ot3 ./to_upload_internal-release https://ot3-development.builds.opentrons.com/app/
           aws --profile=deploy s3 cp ./to_upload_internal-release/releases.json s3://${{ env._APP_DEPLOY_BUCKET_OT3 }}/${{ env._APP_DEPLOY_FOLDER_OT3 }}/releases.json
 
       - name: 'update release releases.json'
         if: needs.determine-build-type.outputs.type == 'release' && contains(fromJSON(needs.determine-build-type.outputs.variants), 'release')
         run: |
           aws --profile=deploy s3 cp s3://${{ env._APP_DEPLOY_BUCKET_ROBOTSTACK }}/${{ env._APP_DEPLOY_FOLDER_ROBOTSTACK }}/releases.json ./to_upload_release/releases.json
-          node ./monorepo/scripts/update-releases-json ./to_upload_release/releases.json robot-stack ./to_upload_release https://builds.opentrons.com/app/
+          node ./scripts/update-releases-json ./to_upload_release/releases.json robot-stack ./to_upload_release https://builds.opentrons.com/app/
           aws --profile=deploy s3 cp ./to_upload_release/releases.json s3://${{ env._APP_DEPLOY_BUCKET_ROBOTSTACK }}/${{ env._APP_DEPLOY_FOLDER_ROBOTSTACK }}/releases.json

.github/workflows/components-test-build-deploy.yaml

@@ -7,17 +7,17 @@ on:
     paths:
       - 'Makefile'
       - 'components/**'
-      - 'app/**/*.stories.*'
-      - 'app/src/atoms/**/*'
-      - 'app/src/molecules/**/*'
+      - 'app/**.stories.*'
+      - 'app/src/atoms/**'
+      - 'app/src/molecules/**'
       - 'package.json'
       - '.github/workflows/components-test-build-deploy.yaml'
   push:
     paths:
       - 'components/**'
-      - 'app/**/*.stories.*'
-      - 'app/src/atoms/**/*'
-      - 'app/src/molecules/**/*'
+      - 'app/**.stories.*'
+      - 'app/src/atoms/**'
+      - 'app/src/molecules/**'
       - 'package.json'
       - '.github/workflows/components-test-build-deploy.yaml'
     branches: