Automate actions we take to release GOV.UK Frontend

[romaricpascal]

Brief

Identify which of the actions we take for releasing that we currently run on developers' machines on the day of the release could be automated and run through GitHub Actions.

Once identified, design and implement GitHub Actions workflows to automate them.

Two things to particularly keep in mind for this:

• security: especially if we automate publishing the package to npm, we don't want the automation to make it easier to compromise our package or reduce auditability
• resumability: if the automated action fails on GitHub Actions, how can we resume from it either on GitHub Actions itself or on developers' machines
• maintainability: implementing something as a GitHub Actions may make it harder to change in the future, as we'll need to update code, not just guidance so we'll need to consider this picking what to implement and how

From a planning perspective, it'd be great if we manage to break down the work in such a way that even if we don't automate the whole of what we want to automate by the end of the cycle, we're at least able to have some of the automation we'd like to have running for future releases. We'd then schedule the implementations of the ones we couldn't do in future cycles or as small stories.

Epic lead

@domoscargin

Driving role(s)

@owenatgov

Supporting roles

@Izabela-16

Further detail

A couple of repositories in our space have some automation for their release:

• govuk-prototype-kit, for which we have a breakdown of what the scripts do. There's a few intersting things around pulling PR content from the CHANGELOG (on top of publishing the package itself).
• stylelint-config-gds, which pushes to npm when the package version changes through this GitHub action

Many other open-source projects will also have automations for releasing new versions which we could take a look at (though being carefull not to bring too many dependencies to achieve it).

GitHub features that might be useful:

• workflow_dispatch in GitHub Actions could help us run things on GitHub action (and can even receive inputs, for example the version to publish)
• npm has a way to mark a package's provenance with possibly some integration with GitHub Actions which could be worth looking into.

Tasks

Preview Give feedback

1. Add standups - @domoscargin
2. Audit release process docs and determine what could be automated #5582
   documentation research +2
   
3. Run a release, and make notes #5583
   research 🚀 release +2
   
4. Desk research on release automation #5584
   research +1
   
5. Define and prioritise tasks for automation #5585
   github_actions +1
6. Automate the release build #5603
   github_actions 🚀 release +2
7. Automate npm publish #5604
   github_actions 🚀 release +2
8. Automate GitHub release #5608
   github_actions 🚀 release +2
9. Share changes with team
10. Run a release with these changes
11. Create small stories for future automation tasks