Skip to content

Commit 4789e89

Browse files
sarahchen6sarahchen6
authored
Combine release branch GHA workflows (DataDog#10518)
Combine scripts Add trust policy Merge branch 'master' into sarahchen6/combine-release-branch-workflows Clean up file Merge branch 'master' into sarahchen6/combine-release-branch-workflows Add workflow to create-release-branch instead of new file Merge branch 'master' into sarahchen6/combine-release-branch-workflows Merge branch 'master' into sarahchen6/combine-release-branch-workflows Update README Merge branch 'master' into sarahchen6/combine-release-branch-workflows Revert workflow name Merge branch 'master' into sarahchen6/combine-release-branch-workflows Co-authored-by: sarah.chen <sarah.chen@datadoghq.com>
1 parent 9553001 commit 4789e89

3 files changed

Lines changed: 96 additions & 13 deletions

File tree

‎.github/chainguard/self.pin-system-tests.create-pr.sts.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
issuer: https://token.actions.githubusercontent.com
22

3-
subject_pattern: repo:DataDog/dd-trace-java:ref:refs/heads/(master|release/v.+)
3+
subject_pattern: repo:DataDog/dd-trace-java:ref:refs/(heads/master|tags/v\d+\.\d+\.0)
44

55
claim_pattern:
6-
event_name: (create|workflow_dispatch)
7-
ref: refs/heads/(master|release/v.+)
8-
job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/pin-system-tests\.yaml@refs/heads/(master|release/v.+)
6+
event_name: (workflow_dispatch|push)
7+
ref: refs/(heads/master|tags/v\d+\.\d+\.0)
8+
job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/create-release-branch\.yaml@refs/heads/master
99

1010
permissions:
1111
contents: write

‎.github/workflows/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,9 @@ This redirects GitHub's "Merge when ready" button to the Datadog merge queue sys
5353

5454
_Trigger:_ When a git tag matching the pattern "vM.N.0" is pushed (e.g. for a minor release).
5555

56-
_Action:_ Create a release branch that corresponds to the pushed tag (e.g. "release/vM.N.x").
56+
_Action:_ Create a release branch that corresponds to the pushed tag (e.g. "release/vM.N.x"). Then open a PR against the release branch that pins system tests.
5757

58-
_Recovery:_ Manually create the branch from the "vM.N.0" git tag.
58+
_Recovery:_ Manually create the release branch from the "vM.N.0" git tag, and pin system tests to this branch by running the `./tooling/update_system_test_reference.sh` script.
5959

6060
### draft-release-notes-on-tag [🔗](draft-release-notes-on-tag.yaml)
6161

‎.github/workflows/create-release-branch.yaml‎

Lines changed: 90 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ jobs:
1616
runs-on: ubuntu-latest
1717
permissions:
1818
contents: write # Allow pushing the release branch
19+
outputs:
20+
release-branch-name: ${{ steps.define-release-branch.outputs.branch }}
1921
steps:
2022
- name: Determine tag
2123
id: determine-tag
@@ -31,8 +33,8 @@ jobs:
3133
fi
3234
echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
3335
34-
- name: Define branch name from tag
35-
id: define-branch
36+
- name: Define release branch name from tag
37+
id: define-release-branch
3638
run: |
3739
TAG=${{ steps.determine-tag.outputs.tag }}
3840
echo "branch=release/${TAG%.0}.x" >> "$GITHUB_OUTPUT"
@@ -43,9 +45,9 @@ jobs:
4345
ref: ${{ steps.determine-tag.outputs.tag }}
4446

4547
- name: Check if branch already exists
46-
id: check-branch
48+
id: check-release-branch
4749
run: |
48-
BRANCH=${{ steps.define-branch.outputs.branch }}
50+
BRANCH=${{ steps.define-release-branch.outputs.branch }}
4951
if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
5052
echo "creating_new_branch=false" >> "$GITHUB_OUTPUT"
5153
echo "Branch $BRANCH already exists - skipping creation"
@@ -55,7 +57,88 @@ jobs:
5557
fi
5658
5759
- name: Create and push release branch
58-
if: steps.check-branch.outputs.creating_new_branch == 'true'
60+
if: steps.check-release-branch.outputs.creating_new_branch == 'true'
5961
run: |
60-
git checkout -b "${{ steps.define-branch.outputs.branch }}"
61-
git push -u origin "${{ steps.define-branch.outputs.branch }}"
62+
git checkout -b "${{ steps.define-release-branch.outputs.branch }}"
63+
git push -u origin "${{ steps.define-release-branch.outputs.branch }}"
64+
65+
pin-system-tests:
66+
needs: create-release-branch
67+
runs-on: ubuntu-latest
68+
permissions:
69+
contents: write
70+
id-token: write # required for OIDC token federation
71+
steps:
72+
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
73+
id: octo-sts
74+
with:
75+
scope: DataDog/dd-trace-java
76+
policy: self.pin-system-tests.create-pr
77+
78+
- name: Checkout dd-trace-java at release branch
79+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
80+
with:
81+
ref: ${{ needs.create-release-branch.outputs.release-branch-name }}
82+
83+
- name: Get latest commit SHA of base release branch
84+
id: get-latest-commit-sha
85+
run: |
86+
echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
87+
88+
- name: Define pin-system-tests branch name
89+
id: define-pin-branch
90+
run: echo "branch=ci/pin-system-tests-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
91+
92+
- name: Check if pin-system-tests branch already exists
93+
id: check-pin-branch
94+
run: |
95+
BRANCH=${{ steps.define-pin-branch.outputs.branch }}
96+
if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
97+
echo "ERROR: Branch $BRANCH already exists - please delete it and re-run the workflow."
98+
exit 1
99+
else
100+
echo "Branch $BRANCH does not exist - creating it now."
101+
fi
102+
103+
- name: Update system-tests references to latest commit SHA of system-tests main
104+
run: ./tooling/update_system_test_reference.sh
105+
106+
- name: Check if changes should be committed
107+
id: check-changes
108+
run: |
109+
if [[ -z "$(git status -s)" ]]; then
110+
echo "ERROR: No changes to commit - the system-tests reference was not updated."
111+
exit 1
112+
else
113+
echo "Changes to commit:"
114+
git status -s
115+
fi
116+
117+
- name: Commit changes
118+
id: create-commit
119+
run: |
120+
git config user.name "github-actions[bot]"
121+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
122+
git commit -m "chore: Pin system-tests for release branch" .github/workflows/run-system-tests.yaml
123+
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
124+
125+
- name: Push changes
126+
uses: DataDog/commit-headless@05d7b7ee023e2c7d01c47832d420c2503cd416f3 # action/v2.0.3
127+
with:
128+
token: "${{ steps.octo-sts.outputs.token }}"
129+
branch: "${{ steps.define-pin-branch.outputs.branch }}"
130+
head-sha: "${{ steps.get-latest-commit-sha.outputs.sha }}"
131+
create-branch: true
132+
command: push
133+
commits: "${{ steps.create-commit.outputs.commit }}"
134+
135+
- name: Create pull request
136+
env:
137+
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
138+
run: |
139+
gh pr create --title "Pin system tests for release branch" \
140+
--base ${{ needs.create-release-branch.outputs.release-branch-name }} \
141+
--head ${{ steps.define-pin-branch.outputs.branch }} \
142+
--label "tag: dependencies" \
143+
--label "tag: no release notes" \
144+
--body "This PR pins the system-tests reference for the release branch."

0 commit comments

Comments
 (0)