Skip to content

Commit 7f8ae12

Browse files
Doug DyrengDoug Dyreng
Doug Dyreng
authored and
Doug Dyreng
committed
Merge branch 'elated-felidae' into ITHD-239408
2 parents 5af8184 + 43a6829 commit 7f8ae12

3 files changed

Lines changed: 124 additions & 126 deletions

File tree

‎.github/workflows/build-and-review-pr.yml‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ jobs:
3838

3939
steps:
4040
- name: Checkout
41+
uses: actions/checkout@v4
4142
uses: actions/checkout@v4
4243
with:
4344
fetch-depth: 0
@@ -257,7 +258,7 @@ jobs:
257258
ref: main
258259
repository: ${{ env.TESTING_REPO }}
259260
ssh-key: ${{ secrets.SSH_KEY_TESTING_REPO }}
260-
# fetch-depth: 0 # Do not use this because we want to test what happens when fetch-depth is not set
261+
fetch-depth: 0
261262

262263
- name: Setup - Checkout this action (git-version-lite) into a 'gvl' subdirectory
263264
if: always()
@@ -326,10 +327,7 @@ jobs:
326327
- name: '-------------------------------------------------------------------------------------------------------'
327328
run: echo ""
328329

329-
- name: When a repo has all of its tags locally
330-
run: git fetch -t
331-
332-
- name: And a new version is requested with fallback-to-no-prefix set
330+
- name: When a new version is requested with fallback-to-no-prefix set
333331
if: always()
334332
uses: ./gvl
335333
id: fallback

‎.github/workflows/increment-version-on-merge.yml‎

Lines changed: 120 additions & 120 deletions
Original file line numberDiff line numberDiff line change
@@ -1,120 +1,120 @@
1-
name: Increment Version on Merge
2-
run-name: "${{ github.event.pull_request.merged && 'Increment version for' || 'Closing' }} PR #${{ github.event.pull_request.number }}"
3-
on:
4-
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
5-
# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
6-
#
7-
# GitHub's standard pull_request workflow trigger prevents write permissions and
8-
# secrets access when the PR is from a public fork. PRs from branches and forks of
9-
# internal/private repos are not limited the same way for the pull_request trigger.
10-
#
11-
# The pull_request_target trigger (which this workflow is using) relaxes some of those
12-
# restrictions and allows PRs from public forks to have write permissions through the
13-
# GH_TOKEN which we need in order to push new tags to the repo through this workflow.
14-
#
15-
# For this workflow, the elevated permissions should not be a problem because:
16-
# • This workflow is only triggered when a PR is closed and the reusable workflow it
17-
# calls only executes if it has been merged to the default branch. This means the PR
18-
# has been reviewed and approved by a CODEOWNER and merged by someone with Write
19-
# access before this workflow with its elevated permissions gets executed. Any code
20-
# that doesn't meet our standards should be caught before it gets to this point.
21-
# • The "Require approval for all outside collaborators" setting is set at the org-level.
22-
# Before a workflow can execute for a PR generated by an outside collaborator, a user
23-
# with Write access must manually approve the request to execute the workflow run.
24-
# Prior to doing so they should have had a chance to review any changes in the PR
25-
pull_request_target:
26-
types: [closed]
27-
# paths:
28-
# Do not include specific paths here. reusable-increment-version-on-merge.yml will decide
29-
# if this action should be incremented and if new tags should be pushed to the repo based
30-
# on the same criteria used in the build-and-review-pr.yml workflow.
31-
32-
33-
# ------------------------------------------------------------------------------------
34-
# NOTE: This repo duplicates the reusable increment workflow in im-open/.github that
35-
# the rest of the actions use. If changes are needed in this workflow they
36-
# should also be made in im-open/.github. This workflow is duplicated because
37-
# it uses the local copy of itself in the workflow which allows us to test the
38-
# increment build with git-version-lite changes before we merge those changes.
39-
# ------------------------------------------------------------------------------------
40-
41-
jobs:
42-
increment-version:
43-
runs-on: ubuntu-latest
44-
env:
45-
MERGE_TO_MAIN: 'false'
46-
47-
steps:
48-
- name: Check if merge to default branch
49-
id: merge
50-
uses: actions/github-script@v6
51-
with:
52-
script: |
53-
const defaultBranch = 'main';
54-
const baseRef = '${{ github.event.pull_request.base.ref }}';
55-
const merged = ${{ github.event.pull_request.merged }};
56-
57-
if (!merged){
58-
console.log('PR is not merged. Skipping subsequent steps.');
59-
core.exportVariable('MERGE_TO_MAIN', false);
60-
return;
61-
}
62-
if (baseRef !== defaultBranch){
63-
console.log(`PR is merged to ${baseRef} and not ${defaultBranch}. Skipping subsequent steps.`);
64-
core.exportVariable('MERGE_TO_MAIN', false);
65-
return;
66-
}
67-
console.log(`PR is merged to ${defaultBranch}. Proceed with subsequent steps.`);
68-
core.exportVariable('MERGE_TO_MAIN', true);
69-
70-
- name: Checkout
71-
if: env.MERGE_TO_MAIN == 'true'
72-
uses: actions/checkout@v3
73-
74-
- name: If PR is merged to main - Check for code changes to the action source code
75-
if: env.MERGE_TO_MAIN == 'true'
76-
id: source-code
77-
uses: im-open/did-custom-action-code-change@v1
78-
with:
79-
files-with-code: 'action.yml,package.json,package-lock.json'
80-
folders-with-code: 'src,dist'
81-
token: ${{ secrets.GITHUB_TOKEN }}
82-
83-
- name: If PR is merged to main - Print whether Action Source Code Changed (open for details)
84-
if: env.MERGE_TO_MAIN == 'true'
85-
run: |
86-
if [ "${{ steps.source-code.outputs.HAS_CHANGES }}" == "true" ]; then
87-
echo "This PR changes the action's source code. Proceed with subsequent steps."
88-
else
89-
echo "This PR does not change the action's source code. Skipping subsequent steps."
90-
fi
91-
92-
- name: If PR is merged to main & PR has source code changes - Checkout
93-
if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true'
94-
uses: actions/checkout@v3
95-
with:
96-
ref: main
97-
fetch-depth: 0
98-
99-
- name: If PR is merged to main & PR has source code changes - Get the next version for the repo
100-
if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true'
101-
id: version
102-
uses: ./
103-
104-
- name: If PR is merged to main & PR has source code changes - Print action version (${{ steps.version.outputs.NEXT_VERSION || 'N/A'}})
105-
if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true'
106-
run: echo "The next action version will be - ${{ steps.version.outputs.NEXT_VERSION }}"
107-
108-
- name: If PR is merged to main & PR has source code changes - Push tags to repo
109-
if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true'
110-
run: |
111-
git config user.name github-actions
112-
git config user.email github-actions@github.com
113-
114-
git tag ${{ steps.version.outputs.NEXT_VERSION }} ${{ github.sha }}
115-
git tag -f ${{ steps.version.outputs.NEXT_MAJOR_VERSION }} ${{ github.sha }}
116-
git tag -f ${{ steps.version.outputs.NEXT_MINOR_VERSION }} ${{ github.sha }}
117-
118-
git push origin ${{ steps.version.outputs.NEXT_VERSION }}
119-
git push origin ${{ steps.version.outputs.NEXT_MAJOR_VERSION }} -f
120-
git push origin ${{ steps.version.outputs.NEXT_MINOR_VERSION }} -f
1+
name: Increment Version on Merge
2+
run-name: "${{ github.event.pull_request.merged && 'Increment version for' || 'Closing' }} PR #${{ github.event.pull_request.number }}"
3+
on:
4+
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
5+
# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
6+
#
7+
# GitHub's standard pull_request workflow trigger prevents write permissions and
8+
# secrets access when the PR is from a public fork. PRs from branches and forks of
9+
# internal/private repos are not limited the same way for the pull_request trigger.
10+
#
11+
# The pull_request_target trigger (which this workflow is using) relaxes some of those
12+
# restrictions and allows PRs from public forks to have write permissions through the
13+
# GH_TOKEN which we need in order to push new tags to the repo through this workflow.
14+
#
15+
# For this workflow, the elevated permissions should not be a problem because:
16+
# • This workflow is only triggered when a PR is closed and the reusable workflow it
17+
# calls only executes if it has been merged to the default branch. This means the PR
18+
# has been reviewed and approved by a CODEOWNER and merged by someone with Write
19+
# access before this workflow with its elevated permissions gets executed. Any code
20+
# that doesn't meet our standards should be caught before it gets to this point.
21+
# • The "Require approval for all outside collaborators" setting is set at the org-level.
22+
# Before a workflow can execute for a PR generated by an outside collaborator, a user
23+
# with Write access must manually approve the request to execute the workflow run.
24+
# Prior to doing so they should have had a chance to review any changes in the PR
25+
pull_request_target:
26+
types: [closed]
27+
# paths:
28+
# Do not include specific paths here. reusable-increment-version-on-merge.yml will decide
29+
# if this action should be incremented and if new tags should be pushed to the repo based
30+
# on the same criteria used in the build-and-review-pr.yml workflow.
31+
32+
33+
# ------------------------------------------------------------------------------------
34+
# NOTE: This repo duplicates the reusable increment workflow in im-open/.github that
35+
# the rest of the actions use. If changes are needed in this workflow they
36+
# should also be made in im-open/.github. This workflow is duplicated because
37+
# it uses the local copy of itself in the workflow which allows us to test the
38+
# increment build with git-version-lite changes before we merge those changes.
39+
# ------------------------------------------------------------------------------------
40+
41+
jobs:
42+
increment-version:
43+
runs-on: ubuntu-latest
44+
env:
45+
MERGE_TO_MAIN: 'false'
46+
47+
steps:
48+
- name: Check if merge to default branch
49+
id: merge
50+
uses: actions/github-script@v7
51+
with:
52+
script: |
53+
const defaultBranch = 'main';
54+
const baseRef = '${{ github.event.pull_request.base.ref }}';
55+
const merged = ${{ github.event.pull_request.merged }};
56+
57+
if (!merged){
58+
console.log('PR is not merged. Skipping subsequent steps.');
59+
core.exportVariable('MERGE_TO_MAIN', false);
60+
return;
61+
}
62+
if (baseRef !== defaultBranch){
63+
console.log(`PR is merged to ${baseRef} and not ${defaultBranch}. Skipping subsequent steps.`);
64+
core.exportVariable('MERGE_TO_MAIN', false);
65+
return;
66+
}
67+
console.log(`PR is merged to ${defaultBranch}. Proceed with subsequent steps.`);
68+
core.exportVariable('MERGE_TO_MAIN', true);
69+
70+
- name: Checkout
71+
if: env.MERGE_TO_MAIN == 'true'
72+
uses: actions/checkout@v4
73+
74+
- name: If PR is merged to main - Check for code changes to the action source code
75+
if: env.MERGE_TO_MAIN == 'true'
76+
id: source-code
77+
uses: im-open/did-custom-action-code-change@v1
78+
with:
79+
files-with-code: 'action.yml,package.json,package-lock.json'
80+
folders-with-code: 'src,dist'
81+
token: ${{ secrets.GITHUB_TOKEN }}
82+
83+
- name: If PR is merged to main - Print whether Action Source Code Changed (open for details)
84+
if: env.MERGE_TO_MAIN == 'true'
85+
run: |
86+
if [ "${{ steps.source-code.outputs.HAS_CHANGES }}" == "true" ]; then
87+
echo "This PR changes the action's source code. Proceed with subsequent steps."
88+
else
89+
echo "This PR does not change the action's source code. Skipping subsequent steps."
90+
fi
91+
92+
- name: If PR is merged to main & PR has source code changes - Checkout
93+
if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true'
94+
uses: actions/checkout@v4
95+
with:
96+
ref: main
97+
fetch-depth: 0
98+
99+
- name: If PR is merged to main & PR has source code changes - Get the next version for the repo
100+
if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true'
101+
id: version
102+
uses: ./
103+
104+
- name: If PR is merged to main & PR has source code changes - Print action version (${{ steps.version.outputs.NEXT_VERSION || 'N/A'}})
105+
if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true'
106+
run: echo "The next action version will be - ${{ steps.version.outputs.NEXT_VERSION }}"
107+
108+
- name: If PR is merged to main & PR has source code changes - Push tags to repo
109+
if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true'
110+
run: |
111+
git config user.name github-actions
112+
git config user.email github-actions@github.com
113+
114+
git tag ${{ steps.version.outputs.NEXT_VERSION }} ${{ github.sha }}
115+
git tag -f ${{ steps.version.outputs.NEXT_MAJOR_VERSION }} ${{ github.sha }}
116+
git tag -f ${{ steps.version.outputs.NEXT_MINOR_VERSION }} ${{ github.sha }}
117+
118+
git push origin ${{ steps.version.outputs.NEXT_VERSION }}
119+
git push origin ${{ steps.version.outputs.NEXT_MAJOR_VERSION }} -f
120+
git push origin ${{ steps.version.outputs.NEXT_MINOR_VERSION }} -f

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ jobs:
110110
NEXT_VERSION: ${{ steps.get-version.outputs.NEXT_VERSION }}
111111

112112
steps:
113-
- uses: actions/checkout@v3
113+
- uses: actions/checkout@v4
114114
with:
115115
fetch-depth: 0 # Includes all history for all branches and tags
116116

0 commit comments

Comments
 (0)