CircleCI build broken: can't clone // permissions

[lwasser]

Currently, all pr's will fail because Circle CI builds (I'm not sure what it's building yet), and it fails because of an ssh issue.

It could be that we could use GitHub Actions instead!
Or we need to set up an SSH key to allow CircleCI to clone.

I think the next step is to closely examine what Circle CI is doing and whether we can do the same here in GitHub Actions. At a minimum, I know that the circle ci image is dated - fixed in #375, but that is a large pr!! i'd love to break out the pieces and fix things one by one to separate concerns.

[lwasser]

I think we actually just want to migrate this over to GitHub Actions. It will be much simpler, and we can then add a human "approval" to release to npm. In fact, maybe we just want to release on release, not even on merge into main. That is likely the best thing we can do!

[lwasser]

OK - so CircleCI has several tokens/secrets set up for publishing to NPM, code coverage, etc., and all were created before 2023! Codecov is easy to recreate, but npm is not.

So... for now, we might try to update permissions so Circle CI can clone as a first step. But I suggest we

1. move to GitHub actions
2. gain access to npm - (email Jake? unless @gr2m has access to npm?!)
3. Set up a deployment that is released based on a protected environment and a maintainer-based trigger to push to npm for security.

In the meantime, we can try to get Circle CI working. I've never seen it get stuck on simply cloning the project tho! That's odd
below are the tokens that it has stored:

The saga of accounts continues, but sagas are what make life interesting. 🙃

[lwasser]

oh but i definitely CAN update the gh token - maybe that is in our control looking at the above but we just can't push releases yet ... open to any and all feedback here!

[JoshuaKGoldberg]

FWIW I'm in favor of this general direction: moving from CircleCI to GHA. GHA in my experience is a lot smoother and more "normal" / what people tend to do these days (read: better community docs & other resources).

I think you mentioned this in another issue, but I don't remember where: we can always have it run everything except publishes, pending the tokens.

[lwasser]

Thanks! Yes, that way we can at least get tests up and running. It's super easy to separate publishing from running tests and checks! I emailed the three owners of the npm all-contributors-cli package.

Once we get permissions there, we can then add the publish step!! I'll move forward with a pr maybe soon!! There is something really fun about setting up CI - it always feels like a superpower to me.

[lwasser]

Ok, I'm going to start with a small pr that just runs the test in Circle CI. Hopefully that won't be too hard.

[lwasser]

Ok I'm going to remove circle ci from our build and then we can build out GHA more. it's just blocking pr's at this point.

[lwasser]

Closing this because we moved away from circle ci in #419