From 357c61bf3ccccf6dae008481de243d729f2c1f01 Mon Sep 17 00:00:00 2001 From: Michal Kinas <113341662+MichalKinas@users.noreply.github.com> Date: Fri, 10 Jul 2026 13:29:04 +0200 Subject: [PATCH] [ACS-12108] Introduce signed commits for ACA workflows (#5273) * [ACS-12108] Introduce signed commits for ACA workflows * [ACS-12108] CR fixes * [ACS-12108] CR fix * [ACS-12108] Migrate PR creation to create-pull-request * [ACS-12108] Use read-only token --- .github/workflows/pull-from-crowdin.yml | 12 ++- .github/workflows/upstream-adf.yml | 105 ++++++++++-------------- 2 files changed, 54 insertions(+), 63 deletions(-) diff --git a/.github/workflows/pull-from-crowdin.yml b/.github/workflows/pull-from-crowdin.yml index 1143eeb36..c8f2f2908 100644 --- a/.github/workflows/pull-from-crowdin.yml +++ b/.github/workflows/pull-from-crowdin.yml @@ -7,8 +7,18 @@ jobs: pull-from-crowdin: runs-on: ubuntu-latest steps: + - name: Generate app token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write - name: Checkout uses: actions/checkout@v7 + with: + token: ${{ steps.app-token.outputs.token }} - name: Pull translations from Crowdin uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3 with: @@ -22,5 +32,5 @@ jobs: github_user_email: ${{ vars.HXPS_GIT_EMAIL }} gpg_private_key: ${{ secrets.HXPS_GIT_COMMIT_SIGNING_PRIVATE_KEY }} env: - GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} CROWDIN_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }} diff --git a/.github/workflows/upstream-adf.yml b/.github/workflows/upstream-adf.yml index 6e0b143f5..787813c6f 100644 --- a/.github/workflows/upstream-adf.yml +++ b/.github/workflows/upstream-adf.yml @@ -10,9 +10,6 @@ on: type: string default: 'alpha' -env: - GH_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }} - jobs: upstream: runs-on: ubuntu-latest @@ -29,11 +26,20 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 1 + - name: Generate app token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.GH_APP_ENGINEERING_RO_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_ENGINEERING_RO_PRIVATE_KEY }} + permission-contents: read + permission-packages: read + permission-pull-requests: read - id: fetchLatestPkg name: Fetch the latest package version uses: actions/github-script@v9 with: - github-token: ${{ secrets.BOT_GITHUB_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} script: | const getLatestVersionOf = require('./scripts/gh/update/latest-version-of.js'); const { hasNewVersion: hasNewADFVersion , remoteVersion: latestADFVersion } = await getLatestVersionOf({exec, github, dependencyName: 'adf-core', tag: '${{ inputs.tag }}'}); @@ -74,7 +80,7 @@ jobs: HAS_NEW_JS_VERSION: ${{ steps.fetchLatestPkg.outputs.hasNewJSVersion }} LATEST_JS_VERSION: ${{ steps.fetchLatestPkg.outputs.latestJSVersion }} with: - github-token: ${{ secrets.BOT_GITHUB_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} script: | // verify if there is already an Upstream PR pending const hasNewADFVersion = process.env.HAS_NEW_ADF_VERSION; @@ -103,10 +109,17 @@ jobs: runs-on: ubuntu-latest needs: upstream steps: + - name: Generate app token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write - name: Checkout repository uses: actions/checkout@v7 with: - token: ${{ secrets.BOT_GITHUB_TOKEN }} fetch-depth: 1 - name: setup NPM uses: actions/setup-node@v6 @@ -120,7 +133,6 @@ jobs: IS_JS_AFFECTED: ${{ needs.upstream.outputs.hasNewJSVersion }} PACKAGE_VERSION_ADF: ${{ needs.upstream.outputs.latestADFVersion }} PACKAGE_VERSION_JS: ${{ needs.upstream.outputs.latestJSVersion }} - BRANCH_TO_CREATE: "upstream-dependencies" run: | migrateDependenciesADF() { echo "Update ADF dependencies to: ${PACKAGE_VERSION_ADF}" @@ -137,10 +149,6 @@ jobs: ./scripts/update-version.sh -v ${PACKAGE_VERSION_ADF} -vj ${PACKAGE_VERSION_JS} echo "Migration done" } - if git checkout ${BRANCH_TO_CREATE} 2>/dev/null ; then - git reset --hard origin/develop - echo "Reset branch" - fi if [[ "$IS_ADF_AFFECTED" == "true" ]] && [[ "$IS_JS_AFFECTED" == "true" ]]; then migrateAllDependencies elif [[ "$IS_ADF_AFFECTED" == "true" ]]; then @@ -148,58 +156,31 @@ jobs: elif [[ "$IS_JS_AFFECTED" == "true" ]]; then migrateDependenciesJS fi - - name: Commit Code - if: ${{ needs.upstream.outputs.hasNewVersion == 'true' }} - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d #v6 - with: - commit_message: "[ci:force][auto-commit] Update dependencies ADF:${{ needs.upstream.outputs.latestADFVersion }} JS:${{ needs.upstream.outputs.latestJSVersion }}" - branch: upstream-dependencies - push_options: '--force' - create_branch: true - - - name: Create a Pull request - uses: actions/github-script@v9 + - name: Prepare PR title + id: pr-meta + if: ${{ needs.upstream.outputs.hasNewVersion == 'true' }} env: PACKAGE_VERSION_ADF: ${{ needs.upstream.outputs.latestADFVersion }} PACKAGE_VERSION_JS: ${{ needs.upstream.outputs.latestJSVersion }} + run: | + if [[ "$PACKAGE_VERSION_ADF" == "next" || "$PACKAGE_VERSION_ADF" == "latest" ]]; then + title="GH Auto: Upstream dependencies ADF and JS-API using Tag:${PACKAGE_VERSION_ADF}" + else + title="GH Auto: Upstream dependencies ADF:${PACKAGE_VERSION_ADF} JS-API:${PACKAGE_VERSION_JS} using Tag:${PACKAGE_VERSION_ADF}" + fi + echo "title=$title" >> "$GITHUB_OUTPUT" + + - name: Create a Pull request + if: ${{ needs.upstream.outputs.hasNewVersion == 'true' }} + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: - github-token: ${{ secrets.BOT_GITHUB_TOKEN }} - script: | - const { PACKAGE_VERSION_ADF } = process.env; - const { PACKAGE_VERSION_JS } = process.env; - const BRANCH_TO_CREATE = 'upstream-dependencies'; - let title = `GH Auto: Upstream dependencies ADF:${PACKAGE_VERSION_ADF} JS-API:${PACKAGE_VERSION_JS} using Tag:${PACKAGE_VERSION_ADF}`; - if (PACKAGE_VERSION_ADF === 'next' || PACKAGE_VERSION_ADF === 'latest') { - title = `GH Auto: Upstream dependencies ADF and JS-API using Tag:${PACKAGE_VERSION_ADF}`; - } - const { data: prs } = await github.rest.pulls.list({ - owner: context.repo.owner, - repo: context.repo.repo, - state: 'open', - head: `${context.repo.owner}:${BRANCH_TO_CREATE}`, - base: 'develop' - }); - if (prs.length < 1) { - const payloadPullRequest = { - owner: context.repo.owner, - repo: context.repo.repo, - title: title, - head: `${context.repo.owner}:${BRANCH_TO_CREATE}`, - base: 'develop', - body: `Automatic PR` - }; - console.log('Payload: ',payloadPullRequest); - const { data: pr } = await github.rest.pulls.create(payloadPullRequest); - return pr.number; - } else { - const upstreamPrOpen = prs[0]; - // override the title to contains the latest adf dep number - const payloadUpdatePullRequest = { - owner: context.repo.owner, - repo: context.repo.repo, - pull_number: upstreamPrOpen.number, - title: title, - }; - await github.rest.pulls.update(payloadUpdatePullRequest); - return upstreamPrOpen.number; - } + token: ${{ steps.app-token.outputs.token }} + base: develop + branch: upstream-dependencies + sign-commits: true + commit-message: "[ci:force][auto-commit] Update dependencies ADF:${{ needs.upstream.outputs.latestADFVersion }} JS:${{ needs.upstream.outputs.latestJSVersion }}" + title: ${{ steps.pr-meta.outputs.title }} + body: Automatic PR + add-paths: | + package.json + package-lock.json