Skip to content

Commit 8fd9054

Browse files
verbanicmverbanicm
authored
fix: use create-pull-request action for update checksums (#98)
1 parent 01166e7 commit 8fd9054

File tree

2 files changed

+23
-223
lines changed

2 files changed

+23
-223
lines changed

‎.github/workflows/update-checksums.yml‎

Lines changed: 23 additions & 209 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,12 @@
1313
# limitations under the License.
1414

1515
name: 'update-checksums-file'
16+
1617
on:
1718
workflow_dispatch:
1819
schedule:
1920
- cron: '0 0 */1 * *'
21+
2022
jobs:
2123
update-checksums:
2224
permissions:
@@ -29,11 +31,13 @@ jobs:
2931
steps:
3032
- name: 'Checkout'
3133
id: 'checkout'
32-
uses: 'actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8' # ratchet:actions/checkout@v3
34+
uses: 'actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11' # ratchet:actions/checkout@v4
35+
3336
# Generate updates to the checksum file if there are new released versions of terraform
3437
- name: 'Generate Updates'
3538
id: 'generate-updates'
3639
run: './.github/generate_version_checksums.sh $GITHUB_WORKSPACE/terraform-checksums.json;'
40+
3741
# Generate a token that has permission to author a pull request
3842
- name: 'Mint Token'
3943
id: 'mint-token'
@@ -44,217 +48,27 @@ jobs:
4448
wif_service_account: '${{ vars.TOKEN_MINTER_WIF_SERVICE_ACCOUNT }}'
4549
service_audience: '${{ vars.TOKEN_MINTER_SERVICE_AUDIENCE }}'
4650
service_url: '${{ vars.TOKEN_MINTER_SERVICE_URL }}'
47-
requested_permissions: '{"repositories":["secure-setup-terraform"],"permissions":{"pull_requests":"write","contents":"write"}}'
48-
# Create a pull request branch using the GitHub API
49-
- name: 'Create/Update Pull Request Branch'
50-
id: 'create-branch-ref'
51-
if: '${{ env.CHANGES }}'
52-
uses: 'actions/github-script@98814c53be79b1d30f795b907e553d8679345975' # ratchet:actions/github-script@v6
53-
with:
54-
github-token: '${{ steps.mint-token.outputs.token }}'
55-
result-encoding: 'string'
56-
retries: '3'
57-
script: |-
58-
const githubSHA = "${{ github.sha }}";
59-
const pullRequestPartialRef = `heads/${process.env.PR_BRANCH}`;
60-
const pullRequestFullRef = `refs/${pullRequestPartialRef}`;
61-
62-
try {
63-
core.info(
64-
`Checking for existing pull request reference:
65-
owner: ${context.repo.owner}
66-
repo: ${context.repo.repo}
67-
ref: ${pullRequestPartialRef}
68-
`
69-
);
70-
71-
const { data: existingRef } = await github.rest.git.getRef({
72-
owner: context.repo.owner,
73-
repo: context.repo.repo,
74-
ref: pullRequestPartialRef,
75-
});
76-
77-
return existingRef.object.sha;
78-
} catch (err) {
79-
if (err.status !== 404) {
80-
core.setFailed(`Failed to get existing pull request reference: ${err}`);
81-
core.error(err);
82-
process.exit(1);
51+
requested_permissions: |-
52+
{
53+
"repositories": ["secure-setup-terraform"],
54+
"permissions": {
55+
"pull_requests": "write",
56+
"contents": "write"
8357
}
84-
core.info("Existing pull request reference not found");
85-
}
86-
87-
try {
88-
core.info(
89-
`Creating new pull request reference:
90-
owner: ${context.repo.owner}
91-
repo: ${context.repo.repo}
92-
ref: ${pullRequestFullRef}
93-
sha: ${githubSHA}
94-
`
95-
);
96-
97-
const { data: newRef } = await github.rest.git.createRef({
98-
owner: context.repo.owner,
99-
repo: context.repo.repo,
100-
ref: pullRequestFullRef,
101-
sha: githubSHA,
102-
});
103-
104-
return newRef.object.sha;
105-
} catch (err) {
106-
core.setFailed(
107-
`Failed to create/update pull request branch reference: ${err}`
108-
);
109-
core.error(err);
110-
}
111-
112-
# Create a pull request for review
113-
# Use the GitHub API to ensure commits are signed
114-
- name: 'Create Commits'
115-
id: 'create-commits'
116-
if: '${{ env.CHANGES }}'
117-
uses: 'actions/github-script@98814c53be79b1d30f795b907e553d8679345975' # ratchet:actions/github-script@v6
118-
with:
119-
github-token: '${{ steps.mint-token.outputs.token }}'
120-
retries: '3'
121-
script: |-
122-
try {
123-
const fs = require("fs/promises");
124-
125-
const githubWorkspace = "${{ github.workspace }}";
126-
const githubSHA = "${{ github.sha }}";
127-
128-
const parentSHA = "${{ steps.create-branch-ref.outputs.result }}";
129-
const pullRequestPartialRef = `heads/${process.env.PR_BRANCH}`;
130-
const pullRequestFullRef = `refs/${pullRequestPartialRef}`;
131-
132-
core.info(`Creating new tree:
133-
owner: ${context.repo.owner}
134-
repo: ${context.repo.repo}
135-
base_tree: ${githubSHA}
136-
`);
137-
138-
// read the file content
139-
const checksumFilePath = `${githubWorkspace}/terraform-checksums.json`;
140-
const content = await fs.readFile(checksumFilePath, { encoding: "utf8" });
141-
142-
// create new git tree from the pr branch
143-
const { data: tree } = await github.rest.git.createTree({
144-
owner: context.repo.owner,
145-
repo: context.repo.repo,
146-
base_tree: githubSHA,
147-
tree: [
148-
{
149-
path: "terraform-checksums.json",
150-
mode: "100644",
151-
type: "blob",
152-
content: content,
153-
},
154-
],
155-
});
156-
157-
core.debug("tree: ", tree);
158-
159-
core.info(`Creating new commit:
160-
owner: ${context.repo.owner}
161-
repo: ${context.repo.repo}
162-
parents: ${parentSHA}
163-
tree: ${tree.sha}
164-
`);
165-
166-
// create a commit from on the git tree
167-
const { data: commit } = await github.rest.git.createCommit({
168-
owner: context.repo.owner,
169-
repo: context.repo.repo,
170-
message: "chore: [automated] checksum updates",
171-
parents: [parentSHA],
172-
tree: tree.sha,
173-
});
174-
175-
core.debug("commit: ", commit);
176-
177-
core.info(`Updating PR branch ref
178-
owner: ${context.repo.owner}
179-
repo: ${context.repo.repo}
180-
ref: ${pullRequestPartialRef}
181-
sha: ${commit.sha}
182-
`);
183-
184-
// update the pr branch reference with the new git tree
185-
await github.rest.git.updateRef({
186-
owner: context.repo.owner,
187-
repo: context.repo.repo,
188-
ref: pullRequestPartialRef,
189-
sha: commit.sha,
190-
});
191-
} catch (err) {
192-
core.error(err);
193-
core.setFailed(`Failed to create commits for pull request branch: ${err}`);
19458
}
19559
60+
# Create a pull request with updated files
19661
- name: 'Create/Update Pull Request'
197-
id: 'create-update-pull-request'
19862
if: '${{ env.CHANGES }}'
199-
uses: 'actions/github-script@98814c53be79b1d30f795b907e553d8679345975' # ratchet:actions/github-script@v6
63+
uses: 'abcxyz/pkg/.github/actions/create-pull-request@main' # ratchet:exclude
20064
with:
201-
github-token: '${{ steps.mint-token.outputs.token }}'
202-
retries: '3'
203-
script: |-
204-
try {
205-
const headRef = process.env.PR_BRANCH;
206-
const baseRef = "${{ github.ref_name }}";
207-
208-
const listResponse = await github.rest.pulls.list({
209-
owner: context.repo.owner,
210-
repo: context.repo.repo,
211-
state: "open",
212-
head: context.repo.owner + ":" + process.env.PR_BRANCH,
213-
base: process.env.DEFAULT_BRANCH,
214-
});
215-
216-
core.debug(`listResponse: ${listResponse}`);
217-
218-
if (!listResponse.data.length) {
219-
core.info(`Creating pull request:
220-
owner: ${context.repo.owner}
221-
repo: ${context.repo.repo}
222-
head: ${headRef}
223-
base: ${baseRef}
224-
`);
225-
226-
const createResponse = await github.rest.pulls.create({
227-
owner: context.repo.owner,
228-
repo: context.repo.repo,
229-
head: headRef,
230-
base: baseRef,
231-
title: `chore: [automated] Terraform checksum updates for ${process.env.UPDATE_DATE}`,
232-
body: `Adds Terraform binary checksums for ${process.env.CHANGES} versions: ${process.env.VERSIONS}`,
233-
});
234-
235-
core.info(
236-
`Created PR #${createResponse.data.number} at ${createResponse.data.html_url}`
237-
);
238-
} else {
239-
core.info(`Updating pull request:
240-
owner: ${context.repo.owner}
241-
repo: ${context.repo.repo}
242-
pull_number: ${listResponse.data[0].number}
243-
`);
244-
245-
const updateResponse = await github.rest.pulls.update({
246-
owner: context.repo.owner,
247-
repo: context.repo.repo,
248-
pull_number: listResponse.data[0].number,
249-
title: `chore: [automated] Terraform checksum updates for ${process.env.UPDATE_DATE}`,
250-
body: `Adds Terraform binary checksums for ${process.env.CHANGES} versions: ${process.env.VERSIONS}`,
251-
});
252-
253-
core.info(
254-
`Updated PR #${updateResponse.data.number} at ${updateResponse.data.html_url}`
255-
);
256-
}
257-
} catch (err) {
258-
core.error(err);
259-
core.setFailed(`Failed to create/update pull request: ${err}`);
260-
}
65+
token: '${{ steps.mint-token.outputs.token }}'
66+
base_branch: '${{ github.event.repository.default_branch }}'
67+
head_branch: '${{ env.PR_BRANCH }}' # set via mint-token step
68+
title: 'chore: [automated] Terraform checksum updates for ${{ env.UPDATE_DATE }}' # set via mint-token step
69+
body: 'Adds Terraform binary checksums for ${process.env.CHANGES} versions: ${{ env.VERSIONS }}' # set via mint-token step
70+
changed_paths: |-
71+
[
72+
"terraform-checksums.json",
73+
"VERSION"
74+
]

‎terraform-checksums.json‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -923,20 +923,6 @@
923923
"binary_checksum": "bac6bb1fb9383249b40afa46b83a4a78fa9f581347195f0e12bd1967d14a4823",
924924
"os": "linux",
925925
"arch": "arm64"
926-
},
927-
{
928-
"version": "1.7.0",
929-
"archive_checksum": "2bac080244845ebd434baf5e8557bd06d53b3c8bc01b7e496b390a56cb40ac5c",
930-
"binary_checksum": "2c8d8692b13cdf64f661b8bdde20994e9fc7ca9f8a1aeda362564b0fb907ef07",
931-
"os": "linux",
932-
"arch": "amd64"
933-
},
934-
{
935-
"version": "1.7.0",
936-
"archive_checksum": "33094b8c677460e7c6496a89770ae702bb8d9c6613d4a8485897da006d1919b5",
937-
"binary_checksum": "90d689e317ae30d1c04bdd872d66bd8663f95609975ca13a1788ee7f06548cd8",
938-
"os": "linux",
939-
"arch": "arm64"
940926
}
941927
]
942928
}

0 commit comments

Comments
 (0)