Skip to content

Commit 870df5e

Browse files
tamalsahatamalsaha
authored
Harden CI workflows
/cherry-pick Signed-off-by: Tamal Saha <tamal@appscode.com>
1 parent 5276435 commit 870df5e

8 files changed

Lines changed: 50 additions & 54 deletions

File tree

‎.github/.kodiak.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@ strip_html_comments = true # default: false
1515
always = true # default: false
1616

1717
[approve]
18-
auto_approve_usernames = ["1gtm", "tamalsaha"]
18+
auto_approve_usernames = ["tamalsaha", "1gtm", "1gtm-app[bot]"]

‎.github/workflows/cherry-pick.yml‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,25 +10,20 @@ jobs:
1010
runs-on: ubuntu-24.04
1111

1212
steps:
13-
- uses: actions/checkout@v1
13+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1414

1515
- name: Prepare git
1616
env:
17-
GITHUB_USER: 1gtm
18-
GITHUB_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }}
17+
GITHUB_USER: ${{ github.actor }}
18+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1919
run: |
2020
git config --global user.name "${GITHUB_USER}"
2121
git config --global user.email "${GITHUB_USER}@appscode.com"
2222
git remote set-url origin https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git
2323
24-
- name: Install GitHub CLI
25-
run: |
26-
curl -fsSL https://github.com/github/hub/raw/master/script/get | bash -s 2.14.1
27-
sudo mv bin/hub /usr/local/bin
28-
2924
- name: Update release branches
3025
env:
31-
GITHUB_USER: 1gtm
32-
GITHUB_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }}
26+
GITHUB_USER: ${{ github.actor }}
27+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3328
run: |
3429
./hack/scripts/cherry-pick.sh

‎.github/workflows/ci.yml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,31 +14,35 @@ jobs:
1414
runs-on: ubuntu-24.04
1515
steps:
1616
- name: Set up Go 1.25
17-
uses: actions/setup-go@v5
17+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
1818
with:
1919
go-version: '1.25'
2020
id: go
2121

22-
- uses: actions/checkout@v4
22+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2323

2424
- name: Set up QEMU
2525
id: qemu
26-
uses: docker/setup-qemu-action@v3
26+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
2727
with:
2828
cache-image: false
2929

3030
- name: Set up Docker Buildx
31-
uses: docker/setup-buildx-action@v3
31+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
3232

3333
- name: Run checks
3434
run: |
3535
make ci
3636
37+
- name: Login to GitHub Container Registry
38+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
39+
with:
40+
registry: ghcr.io
41+
username: 1gtm
42+
password: ${{ secrets.LGTM_GITHUB_TOKEN }}
43+
3744
- name: Build
3845
env:
3946
REGISTRY: ghcr.io/appscodeci
40-
DOCKER_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }}
41-
USERNAME: 1gtm
4247
run: |
43-
docker login ghcr.io --username ${USERNAME} --password ${DOCKER_TOKEN}
4448
make push

‎.github/workflows/release-tracker.yml‎

Lines changed: 13 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,31 +6,25 @@ on:
66

77
jobs:
88
build:
9+
if: github.event.pull_request.merged == true
910
runs-on: ubuntu-24.04
1011

1112
steps:
12-
- uses: actions/checkout@v4
13+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1314

14-
- name: Prepare git
15-
env:
16-
GITHUB_USER: 1gtm
17-
GITHUB_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }}
18-
run: |
19-
git config --global user.name "${GITHUB_USER}"
20-
git config --global user.email "${GITHUB_USER}@appscode.com"
21-
git remote set-url origin https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git
22-
23-
- name: Install GitHub CLI
24-
run: |
25-
curl -fsSL https://github.com/github/hub/raw/master/script/get | bash -s 2.14.1
26-
sudo mv bin/hub /usr/local/bin
15+
- name: Generate LGTM App token
16+
id: lgtm-app-token
17+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
18+
with:
19+
client-id: ${{ secrets.LGTM_APP_CLIENT_ID }}
20+
private-key: ${{ secrets.LGTM_APP_PRIVATE_KEY }}
21+
owner: ${{ github.repository_owner }}
22+
repositories: CHANGELOG
23+
permission-pull-requests: write
2724

2825
- name: Update release tracker
29-
if: |
30-
github.event.action == 'closed' &&
31-
github.event.pull_request.merged == true
3226
env:
33-
GITHUB_USER: 1gtm
34-
GITHUB_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }}
27+
GITHUB_USER: ${{ github.actor }}
28+
GITHUB_TOKEN: ${{ steps.lgtm-app-token.outputs.token }}
3529
run: |
3630
./hack/scripts/update-release-tracker.sh

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,13 @@ jobs:
99
build:
1010
name: Build
1111
runs-on: ubuntu-24.04
12+
permissions:
13+
contents: write
1214
steps:
1315
- name: Check out code into the Go module directory
14-
uses: actions/checkout@v1
15-
16-
- name: Install GitHub CLI
17-
run: |
18-
curl -fsSL https://github.com/github/hub/raw/master/script/get | bash -s 2.14.1
19-
sudo mv bin/hub /usr/local/bin
16+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
17+
with:
18+
fetch-depth: 0
2019

2120
- name: Print version info
2221
id: semver
@@ -25,19 +24,23 @@ jobs:
2524
2625
- name: Set up QEMU
2726
id: qemu
28-
uses: docker/setup-qemu-action@v3
27+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
2928
with:
3029
cache-image: false
3130

3231
- name: Set up Docker Buildx
33-
uses: docker/setup-buildx-action@v3
32+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
33+
34+
- name: Log in to the GitHub Container registry
35+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
36+
with:
37+
registry: ghcr.io
38+
username: 1gtm
39+
password: ${{ secrets.LGTM_GITHUB_TOKEN }}
3440

3541
- name: Publish to GitHub Container Registry
3642
env:
3743
REGISTRY: ghcr.io/stashed
38-
DOCKER_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }}
39-
USERNAME: 1gtm
4044
APPSCODE_ENV: prod
4145
run: |
42-
docker login ghcr.io --username ${USERNAME} --password ${DOCKER_TOKEN}
4346
make release

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ REGISTRY ?= stashed
2424

2525
# This version-strategy uses git tags to set the version string
2626
git_branch := $(shell git rev-parse --abbrev-ref HEAD)
27-
git_tag := $(shell git describe --exact-match --abbrev=0 2>/dev/null || echo "")
27+
git_tag := $(shell git describe --tags --exact-match --abbrev=0 2>/dev/null || echo "")
2828
commit_hash := $(shell git rev-parse --verify HEAD)
2929
commit_timestamp := $(shell date --date="@$$(git show -s --format=%ct)" --utc +%FT%T)
3030

‎hack/scripts/cherry-pick.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@ while IFS=/ read -r -u9 repo branch; do
3737
git checkout -b $pr_branch
3838
git cherry-pick --strategy=recursive -X theirs $GITHUB_SHA
3939
git push -u origin HEAD -f
40-
hub pull-request \
40+
gh pr create \
4141
--base $branch \
42-
--labels automerge \
43-
--message "[cherry-pick] $(git show -s --format=%s)" \
44-
--message "$(git show -s --format=%b | sed --expression='/\/cherry-pick/d')" || true
42+
--label automerge \
43+
--title "[cherry-pick] $(git show -s --format=%s)" \
44+
--body "$(git show -s --format=%b | sed --expression='/\/cherry-pick/d')" || true
4545
sleep 15
4646
done 9< <(git branch -r | grep release)

‎hack/scripts/update-release-tracker.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,4 +69,4 @@ case $GITHUB_BASE_REF in
6969
;;
7070
esac
7171

72-
hub api "$api_url" -f body="$msg"
72+
gh api "$api_url" -f body="$msg"

0 commit comments

Comments
 (0)