CI: Update patch check event to use workflow_call (#105478)

* add pr-patch-check-event workflow_call * remove unneded permission * sender -> sender_login * Add my branch as a target for testing * fix branch name * use pull_request event * fix repo in list * maybe repositories not prefixedby org? * fix permissions * remove my branch * Missing @ * Add missing CODEOWNER entry * call workflow from my branch and add oidc debugger * add my branch to list for testing * remove my branch; use workflow from main; remove oidc debug * retrigger CI
2025-05-16 18:39:17 -06:00
parent feaaf96269
commit d0637bba5b
3 changed files with 99 additions and 53 deletions
@@ -0,0 +1,78 @@
+name: Dispatch check for patch conflicts
+on:
+  workflow_call:
+    inputs:
+      head_ref:
+        type: string
+        required: true
+      base_ref:
+        type: string
+        required: true
+      repo:
+        type: string
+        required: true
+      sender_login:
+        type: string
+        required: true
+      sha:
+        type: string
+        required: true
+      pr_commit_sha:
+        type: string
+        required: true
+
+permissions:
+  id-token: write
+  contents: read
+
+# Since this is run on a pull request, we want to apply the patches intended for the
+# target branch onto the source branch, to verify compatibility before merging.
+jobs:
+  dispatch-job:
+    env:
+      HEAD_REF: ${{ inputs.head_ref }}
+      BASE_REF: ${{ github.base_ref }}
+      REPO: ${{ inputs.repo }}
+      SENDER: ${{ inputs.sender_login }}
+      SHA: ${{ inputs.sha }}
+      PR_COMMIT_SHA: ${{ inputs.pr_commit_sha }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Get vault secrets"
+        id: vault-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main
+        with:
+          # Secrets placed in the ci/data/repo/grafana/grafana/delivery-bot-app path in Vault
+          repo_secrets: |
+            GRAFANA_DELIVERY_BOT_APP_PEM=delivery-bot-app:PRIVATE_KEY
+      - name: "Generate token"
+        id: generate_token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
+        with:
+          # App needs Actions: Read/Write for the grafana/security-patch-actions repo
+          app_id: ${{ vars.DELIVERY_BOT_APP_ID }}
+          private_key: ${{ env.GRAFANA_DELIVERY_BOT_APP_PEM }}
+          permissions: "{\"actions\": \"write\", \"workflows\": \"write\"}"
+          repositories: "[\"security-patch-actions\"]"
+      - name: "Dispatch job"
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ steps.generate_token.outputs.token }}
+          script: |
+            const {HEAD_REF, BASE_REF, REPO, SENDER, SHA, PR_COMMIT_SHA} = process.env;
+
+            await github.rest.actions.createWorkflowDispatch({
+                owner: 'grafana',
+                repo: 'security-patch-actions',
+                workflow_id: 'test-patches-event.yml',
+                ref: 'main',
+                inputs: {
+                  src_repo: REPO,
+                  src_ref: HEAD_REF,
+                  src_merge_sha: SHA,
+                  src_pr_commit_sha: PR_COMMIT_SHA,
+                  patch_repo: REPO + '-security-patches',
+                  patch_ref: BASE_REF,
+                  triggering_github_handle: SENDER
+                }
+            })