refactor (actions): make better use of variables, secrets and versions

[gustavovalverde]

Motivation

ENV and Secrets: Using regex to extract information from GitHub environments is noisy and error-prone, and it restrict flexibility or increases complexity when more specific versions of specific variables are needed, for example, using a cleaned version of the branch name without special characters and with a specific max length (to be used in URL or image tags).

Actions versions: As actions get recurrent fixes, using a specific version causes more maintenance on the pipelines. And using master versions could make some action unreliable, as breaking changes might be included without further notice, and even change behavior on a daily basis.

Designs

A whole step with regex was being used to extract different variables from GitHub's environment. This gets deprecated in favor of using rlespinasse/github-slug-action@v4 which has slug URL variables.

A SLUG on a variable will:

• put the variable content in lower case
• replace any character by - except 0-9, a-z, ., and _
• remove leading and trailing - character
• limit the string size to 63 characters

This change also takes care of using the Head or Base branch for deployments. This will allow us to potentially merge workflows, as most steps on this deployment actions are very similar, with little variations between workflows.

Related: #3359

Solution

• Remove repeated instances of global environment variables.
• Do not print ENV variables on the terminal as GitHub Actions already shows it.
• Use secrets for sensitive information
• Use fixed major versions for actions
• Implement rlespinasse/github-slug-action@v4

Review

@conradoplg @dconnolly @teor2345

Reviewer Checklist

• Validate design
• Check for Errors

Follow Up Work

Accomplish the same behavior of CD, Manual Deploy, Regenerate test state, Test and Zcashd Manual Deploy with fewer YAMLs

[codecov]

Codecov Report

Merging #3393 (2d92e65) into main (499ae89) will decrease coverage by 0.03%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main    #3393      +/-   ##
==========================================
- Coverage   78.34%   78.30%   -0.04%     
==========================================
  Files         267      267              
  Lines       31526    31576      +50     
==========================================
+ Hits        24698    24727      +29     
- Misses       6828     6849      +21     

[teor2345]

I think @dconnolly and @conradoplg have the most experience with this CI configs, so I'll leave the reviews to them.

I just want to make sure we're going to check all these jobs work after the refactor?
(Particularly the ones that are only run manually.)

[dconnolly]

Actions versions: As actions get recurrent fixes, using a specific version causes more maintenance on the pipelines. And using master versions could make some action unreliable, as breaking changes might be included without further notice, and even change behavior on a daily basis.

Agreed on moving away from action@master/main. The other actions are pinned to specific versions but only because we have Dependabot configured to propose Action updates as they become available

[conradoplg]

Looks good!

As @dconnolly mentioned I think we can keep referring to specific versions and bump them with dependabot, so that we can review the changes in the actions before using new versions. I'll leave approval to @dconnolly

[gustavovalverde]

@dconnolly reverted to specific action versions for approval

[dconnolly]

LGTM!

[dconnolly]

@gustavovalverde the Google Cloud Build may have timed out again, I've kicked it off, if it fails again maybe rebase this branch onto main the get the timeout bump

[teor2345]

@gustavovalverde the Google Cloud Build may have timed out again, I've kicked it off, if it fails again maybe rebase this branch onto main the get the timeout bump

I've opened #3416 for this bug, and nominated it for the stable release candidate epic.

Can you please copy and paste one or two failure logs into that ticket?
And tag #3416 every time it happens?