Feat/operator dashboard

.envrc

@@ -0,0 +1 @@
+use flake

.github/dependabot.yml

@@ -24,3 +24,17 @@ updates:
       nix-flake-inputs:
         patterns:
           - '*'
+  # Keeps the SHA-pinned actions in .github/workflows up to date.
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+      time: '02:00'
+      timezone: 'UTC'
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/README.md

@@ -1,23 +1,42 @@
 # GitHub Workflows
 
-This document describes the GitHub workflows used in this project.
+All tools (Node.js, yarn, actionlint, zizmor, gh) come from the flake's `ci*` dev shells; jobs run their steps through
+`nix develop .#ci-node<version> --command …`, so CI uses exactly the toolchain you get locally with `nix develop`.
 
-## Build
+Docker images are published to the GitHub Container Registry: `ghcr.io/<owner>/node-admin-ui`.
 
-- Builds, Lint, Test
-- Publishes the docker images with version `x.y.z-pr.<PR_NUMBER>`
+## PR (`pr.yaml`)
 
-## Merge PR
+- Validates the PR title (conventional commits) and applies labels
+- Runs [Checks](#checks-checksyaml)
+- Builds the Docker image and pushes it as `pr-<number>` and `sha-<short>` (build only for PRs coming from other forks)
 
-- Publishes the docker image with `latest`
+## Main (`merge.yaml`)
 
-## Close release
+Runs on every push to `main`:
 
-This is a workflow triggered manually from Github Actions [Close Release](https://github.com/hoprnet/hopr-admin/actions/workflows/release.yaml). The tasks performed by this workflow include:
+- Runs [Checks](#checks-checksyaml)
+- Pushes the Docker image as `latest`, `main` and `sha-<short>`
 
-- Publishes the docker image with `x.y.z`
-- Create a Github release
-- Tag code
-- Changelog is autogenerated by commit linear history of the release
-- Bumps the new version by opening a new PR
-- Sends a Zulip notification
+## Release (`release.yaml`)
+
+Triggered manually from the Actions tab:
+
+- Reads the version from `package.json` and fails if the tag `v<version>` already exists
+- Runs [Checks](#checks-checksyaml)
+- Pushes the Docker image as `<version>` (built without cache)
+- Creates the `v<version>` tag and a GitHub release with generated notes (marked as pre-release when the version has a
+  suffix such as `-rc.1`)
+
+Bump the version in `package.json` through a regular PR before releasing.
+
+## Reusable workflows
+
+### Checks (`checks.yaml`)
+
+- Build, lint, formatting and tests on Node.js 22 and 24
+- `actionlint` and `zizmor` on the workflows
+
+### Docker (`docker.yaml`)
+
+- Builds the `Dockerfile` for `linux/amd64` and optionally pushes it to ghcr.io

.github/workflows/checks.yaml

@@ -0,0 +1,78 @@
+---
+name: Checks
+on:
+  workflow_call:
+permissions: {}
+jobs:
+  build:
+    name: Build (node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [22, 24]
+    defaults:
+      run:
+        # Every tool comes from the flake's CI dev shell.
+        shell: nix develop .#ci-node${{ matrix.node }} --command bash -eo pipefail {0}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Cache yarn packages
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/yarn
+          key: yarn-${{ runner.os }}-node${{ matrix.node }}-${{ hashFiles('yarn.lock') }}
+          restore-keys: yarn-${{ runner.os }}-node${{ matrix.node }}-
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build
+        run: yarn build
+
+      - name: Lint
+        run: yarn lint:ci
+
+      - name: Formatting
+        run: yarn format:ci
+
+      - name: Test
+        run: yarn test
+
+  workflows:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: nix develop .#ci --command bash -eo pipefail {0}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: actionlint
+        run: actionlint
+
+      - name: zizmor
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: zizmor --format github .github/workflows

.github/workflows/docker.yaml

@@ -0,0 +1,76 @@
+---
+name: Docker
+on:
+  workflow_call:
+    inputs:
+      push:
+        description: Push the image to ghcr.io (otherwise only build it)
+        type: boolean
+        default: false
+      version:
+        description: Explicit release version to tag the image with
+        type: string
+        default: ''
+      cache:
+        description: Use the GitHub Actions build cache (disable for releases)
+        type: boolean
+        default: true
+permissions: {}
+jobs:
+  image:
+    name: Build image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
+      - name: Log in to GitHub Container Registry
+        if: inputs.push
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute tags
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=ref,event=pr
+            type=ref,event=branch
+            type=sha,format=short
+            type=raw,value=latest,enable=${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+            type=raw,value=${{ inputs.version }},enable=${{ inputs.version != '' }}
+
+      - name: Build and push
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          platforms: linux/amd64
+          push: ${{ inputs.push }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: ${{ inputs.cache && 'type=gha' || '' }}
+          cache-to: ${{ inputs.cache && 'type=gha,mode=max' || '' }}
+
+      - name: Summary
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+          PUSHED: ${{ inputs.push }}
+        run: |
+          {
+            if [ "$PUSHED" = "true" ]; then echo "### Pushed image"; else echo "### Built image (not pushed)"; fi
+            echo '```'
+            echo "$TAGS"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/merge.yaml

@@ -1,59 +1,29 @@
-name: Merge
+---
+name: Main
 on:
-  pull_request:
-    types:
-      - closed
+  push:
     branches:
       - main
-      # - synchronize
+
 concurrency:
-  group: merge-${{ github.event.pull_request.base.ref }}
+  group: main
   cancel-in-progress: false
-permissions:
-  contents: read
-  pull-requests: write
-  id-token: write
+
+permissions: {}
+
 jobs:
-  build-docker:
+  checks:
+    name: Checks
+    uses: ./.github/workflows/checks.yaml
+    permissions:
+      contents: read
+
+  docker:
     name: Docker
-    if: github.event.pull_request.merged == true
-    uses: hoprnet/hopr-workflows/.github/workflows/build-docker.yaml@fa71078959cf9f892185e8df16551720693a2cd1 # 0.9.3
+    needs: checks
+    uses: ./.github/workflows/docker.yaml
     permissions:
       contents: read
-      pull-requests: write
-      id-token: write
+      packages: write
     with:
-      source_branch: ${{ github.event.pull_request.base.ref }}
-      version_type: pr
-      build_matrix: >-
-        [
-          {
-            "runner": "depot-ubuntu-24.04-4",
-            "architecture": "x86_64-linux",
-            "build_command": "nix run .#docker-x86_64-linux"
-          }
-        ]
-      build_file: package.json
-      docker_image_name: ${{ vars.DOCKER_IMAGE_NAME }}
-      docker_image_format: docker
-      fail_on_scan_vulnerabilities: ${{ vars.FAIL_ON_SCAN_VULNERABILITIES }}
-    secrets:
-      cachix_auth_token: ${{ secrets.CACHIX_AUTH_TOKEN }}
-  notify:
-    name: Notify failure
-    needs:
-      - build-docker
-    if: ${{ always() && failure() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Notify failed merge pipeline
-        uses: zulip/github-actions-zulip/send-message@e4c8f27c732ba9bd98ac6be0583096dea82feea5 # v1.0.2
-        with:
-          api-key: ${{ secrets.ZULIP_API_KEY }}
-          email: ${{ secrets.ZULIP_EMAIL }}
-          organization-url: https://hopr.zulipchat.com
-          type: stream
-          to: Products
-          topic: main
-          content: |
-            The merge pipeline has failed for pull request [#${{ github.event.pull_request.number }}: ${{ github.event.pull_request.title }}](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      push: true