From 1d677215ee047967dc5e6f25ccb09e0225c16f1a Mon Sep 17 00:00:00 2001
From: Joey Perrott <josephperrott@gmail.com>
Date: Fri, 6 Oct 2023 18:58:50 +0000
Subject: [PATCH] ci: migrate snapshot publishing job to GHA

Migrate the snapshot publishing job from CircleCI to Github Actions
---
 .circleci/config.yml     | 44 ----------------------------------------
 .github/workflows/ci.yml | 35 ++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 44 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5ed99f580f3e..29fe19cd1f2a 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -232,46 +232,6 @@ jobs:
       - run: yarn ci-push-deploy-docs-app
       - *slack_notify_on_failure
 
-  # ----------------------------------------
-  # Job that publishes the build snapshots
-  # ----------------------------------------
-  publish_snapshots:
-    <<: *job_defaults
-    resource_class: xlarge
-    environment:
-      GCP_DECRYPT_TOKEN: *gcp_decrypt_token
-    steps:
-      - checkout_and_rebase
-      - *restore_cache
-      - *attach_release_output
-      - *setup_bazel_ci_config
-      - *setup_bazel_remote_execution
-      - *yarn_install
-      - *setup_bazel_binary
-
-      # CircleCI has a config setting to enforce SSH for all github connections.
-      # This is not compatible with our mechanism of using a Personal Access Token
-      # to publish the build snapshots. In order to fix this, we unset the global option.
-      - run: git config --global --unset "url.ssh://git@github.com.insteadof"
-
-      # The components examples package is not a release package, but we publish it
-      # as part of this job to the docs-content repository. It's not contained in the
-      # attached release output, so we need to build it here.
-      - run: yarn build-docs-content
-
-      # Ensures that we do not push the snapshot artifacts upstream until all previous
-      # snapshot build jobs have completed. This helps avoiding conflicts when multiple
-      # commits have been pushed (resulting in multiple concurrent snapshot publish jobs).
-      # We increase the confidence threshold so that it queries the CircleCI API a second time
-      # after a delay. We do this as the CircleCI API does not refresh immediately when a job
-      # completes/starts, and this will improve stability of the queue step. See source:
-      # https://github.com/eddiewebb/circleci-queue/commit/5d42add5bbcff5e8ac7fe189448a61fea98b0839.
-      - queue/until_front_of_line:
-          confidence: '2'
-
-      - run: ./scripts/circleci/publish-snapshots.sh
-      - *slack_notify_on_failure
-
 # ----------------------------------------------------------------------------------------
 # Workflow definitions. A workflow usually groups multiple jobs together. This is useful if
 # one job depends on another.
@@ -292,10 +252,6 @@ workflows:
           filters: *only_on_pull_requests_filter
           requires:
             - build_release_packages
-      - publish_snapshots:
-          filters: *publish_branches_filter
-          requires:
-            - build_release_packages
       - deploy_docs_site:
           filters: *publish_branches_filter
           requires:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac8df873c870..349e831d7c2d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -235,3 +235,38 @@ jobs:
           slack-message: 'Build job failed for ${{ github.base_ref }} branch failed on build ${{ github.event.after }}: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
         env:
           SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
+
+  publish_snapshots:
+    if: ${{ github.event_name == 'push'}}
+    runs-on: ubuntu-latest-4core
+    steps:
+      - name: Initialize environment
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@9931e1a8d1b62fcd2267e89f9993a494856cc1cd
+        with:
+          cache-node-modules: true
+      - name: Setup Bazel
+        uses: angular/dev-infra/github-actions/bazel/setup@9931e1a8d1b62fcd2267e89f9993a494856cc1cd
+      - name: Setup Bazel RBE
+        uses: angular/dev-infra/github-actions/bazel/configure-remote@9931e1a8d1b62fcd2267e89f9993a494856cc1cd
+      - name: Install node modules
+        run: yarn install --frozen-lockfile
+      - name: Build and Verify Release Output
+        run: yarn build-and-check-release-output
+      - name: Verify tooling setup
+        run: yarn check-tooling-setup
+      - name: Build Docs Content
+        run: yarn build-docs-content
+      - name: Build Docs Content
+        run: yarn build-docs-content
+      - name: Publish Snapshots
+        run: ./scripts/circleci/publish-snapshots.sh
+        env:
+          SNAPSHOT_BUILDS_GITHUB_TOKEN: ${{ secrets.SNAPSHOT_BUILDS_GITHUB_TOKEN }}
+      - name: Notify about failed publish
+        if: ${{ failure() }}
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v=v1.24.0
+        with:
+          channel-id: 'C015EBF2XB6'
+          slack-message: 'Snapshot publishing failed for ${{ github.base_ref }} branch failed on build ${{ github.event.after }}: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}