From d0637bba5b605612c246e474ad8bc79df33cf054 Mon Sep 17 00:00:00 2001 From: Kevin Minehart <5140827+kminehart@users.noreply.github.com> Date: Fri, 16 May 2025 19:39:17 -0500 Subject: [PATCH] CI: Update patch check event to use `workflow_call` (#105478) * add pr-patch-check-event workflow_call * remove unneded permission * sender -> sender_login * Add my branch as a target for testing * fix branch name * use pull_request event * fix repo in list * maybe repositories not prefixedby org? * fix permissions * remove my branch * Missing @ * Add missing CODEOWNER entry * call workflow from my branch and add oidc debugger * add my branch to list for testing * remove my branch; use workflow from main; remove oidc debug * retrigger CI --- .github/CODEOWNERS | 1 + .github/workflows/pr-patch-check-event.yml | 73 ++++++-------------- .github/workflows/pr-patch-check.yml | 78 ++++++++++++++++++++++ 3 files changed, 99 insertions(+), 53 deletions(-) create mode 100644 .github/workflows/pr-patch-check.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index ac95f56e43c..7cc3cee981c 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -794,6 +794,7 @@ embed.go @grafana/grafana-as-code /.github/workflows/pr-commands.yml @tolzhabayev /.github/workflows/pr-external-labelling.yml @Proximyst /.github/workflows/pr-patch-check-event.yml @grafana/grafana-developer-enablement-squad +/.github/workflows/pr-patch-check.yml @grafana/grafana-developer-enablement-squad /.github/workflows/pr-test-integration.yml @grafana/grafana-backend-group /.github/workflows/reject-gh-secrets.yml @grafana/grafana-operator-experience-squad /.github/workflows/sync-mirror-event.yml @grafana/grafana-developer-enablement-squad diff --git a/.github/workflows/pr-patch-check-event.yml b/.github/workflows/pr-patch-check-event.yml index 0e2e21085f4..2b30e0fa375 100644 --- a/.github/workflows/pr-patch-check-event.yml +++ b/.github/workflows/pr-patch-check-event.yml @@ -1,60 +1,27 @@ name: Dispatch check for patch conflicts on: - push: - branches-ignore: + pull_request: + types: + - opened + - reopened + - synchronize + branches: - "main" - - "release-*.*.*" - tags-ignore: - - "*" + - "release-*" -permissions: {} +permissions: + id-token: write + contents: read +# Since this is run on a pull request, we want to apply the patches intended for the +# target branch onto the source branch, to verify compatibility before merging. jobs: dispatch-job: - permissions: - id-token: write - contents: read - actions: write - env: - REPO: ${{ github.repository }} - SENDER: ${{ github.event.sender.login }} - SHA: ${{ github.sha }} - runs-on: ubuntu-latest - if: github.repository == 'grafana/grafana' - steps: - - name: "Get vault secrets" - id: vault-secrets - uses: grafana/shared-workflows/actions/get-vault-secrets@main - with: - # Secrets placed in the ci/data/repo/grafana/grafana/delivery-bot-app path in Vault - repo_secrets: | - GRAFANA_DELIVERY_BOT_APP_PEM=delivery-bot-app:PRIVATE_KEY - - name: "Generate token" - id: generate_token - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a - with: - # App needs Actions: Read/Write for the grafana/security-patch-actions repo - app_id: ${{ vars.DELIVERY_BOT_APP_ID }} - private_key: ${{ env.GRAFANA_DELIVERY_BOT_APP_PEM }} - - name: "Dispatch job" - uses: actions/github-script@v7 - with: - github-token: ${{ steps.generate_token.outputs.token }} - script: | - const {REPO, SENDER, SHA} = process.env; - - await github.rest.actions.createWorkflowDispatch({ - owner: 'grafana', - repo: 'security-patch-actions', - workflow_id: 'test-patches-event.yml', - ref: 'main', - inputs: { - src_repo: REPO, - src_ref: 'main', - src_merge_sha: SHA, - src_pr_commit_sha: SHA, - patch_repo: REPO + '-security-patches', - patch_ref: 'main', - triggering_github_handle: SENDER - } - }) + uses: grafana/grafana/.github/workflows/pr-patch-check.yml@main + with: + head_ref: ${{ github.head_ref }} + base_ref: ${{ github.base_ref }} + repo: ${{ github.repository }} + sender_login: ${{ github.event.sender.login }} + sha: ${{ github.sha }} + pr_commit_sha: ${{ github.event.pull_request.head.sha }} diff --git a/.github/workflows/pr-patch-check.yml b/.github/workflows/pr-patch-check.yml new file mode 100644 index 00000000000..5de7fcf89ed --- /dev/null +++ b/.github/workflows/pr-patch-check.yml @@ -0,0 +1,78 @@ +name: Dispatch check for patch conflicts +on: + workflow_call: + inputs: + head_ref: + type: string + required: true + base_ref: + type: string + required: true + repo: + type: string + required: true + sender_login: + type: string + required: true + sha: + type: string + required: true + pr_commit_sha: + type: string + required: true + +permissions: + id-token: write + contents: read + +# Since this is run on a pull request, we want to apply the patches intended for the +# target branch onto the source branch, to verify compatibility before merging. +jobs: + dispatch-job: + env: + HEAD_REF: ${{ inputs.head_ref }} + BASE_REF: ${{ github.base_ref }} + REPO: ${{ inputs.repo }} + SENDER: ${{ inputs.sender_login }} + SHA: ${{ inputs.sha }} + PR_COMMIT_SHA: ${{ inputs.pr_commit_sha }} + runs-on: ubuntu-latest + steps: + - name: "Get vault secrets" + id: vault-secrets + uses: grafana/shared-workflows/actions/get-vault-secrets@main + with: + # Secrets placed in the ci/data/repo/grafana/grafana/delivery-bot-app path in Vault + repo_secrets: | + GRAFANA_DELIVERY_BOT_APP_PEM=delivery-bot-app:PRIVATE_KEY + - name: "Generate token" + id: generate_token + uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a + with: + # App needs Actions: Read/Write for the grafana/security-patch-actions repo + app_id: ${{ vars.DELIVERY_BOT_APP_ID }} + private_key: ${{ env.GRAFANA_DELIVERY_BOT_APP_PEM }} + permissions: "{\"actions\": \"write\", \"workflows\": \"write\"}" + repositories: "[\"security-patch-actions\"]" + - name: "Dispatch job" + uses: actions/github-script@v7 + with: + github-token: ${{ steps.generate_token.outputs.token }} + script: | + const {HEAD_REF, BASE_REF, REPO, SENDER, SHA, PR_COMMIT_SHA} = process.env; + + await github.rest.actions.createWorkflowDispatch({ + owner: 'grafana', + repo: 'security-patch-actions', + workflow_id: 'test-patches-event.yml', + ref: 'main', + inputs: { + src_repo: REPO, + src_ref: HEAD_REF, + src_merge_sha: SHA, + src_pr_commit_sha: PR_COMMIT_SHA, + patch_repo: REPO + '-security-patches', + patch_ref: BASE_REF, + triggering_github_handle: SENDER + } + })