Skip to content

Commit b7d8732

Browse files
author
Frederic Spiers
committed
Merge commit '6544ddf' into fspiers/ENT-3334/incremental-sync-batch-1
2 parents eec0511 + 6544ddf commit b7d8732

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+1942
-560
lines changed

‎.github/dependabot.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
version: 2
2+
updates:
3+
# Maintain dependencies for GitHub Actions
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
labels:
10+
- "dependencies"
11+
- "github-actions"
12+
commit-message:
13+
prefix: "chore(deps)"
14+
include: "scope"
15+
open-pull-requests-limit: 10
16+
assignees:
17+
- "CloudPirates-io/maintainers"
18+
# Group all GitHub Actions updates into a single PR
19+
groups:
20+
github-actions:
21+
patterns:
22+
- "*"

‎.github/workflows/auto-label.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,20 @@ on:
55
pull_request:
66
types: [opened]
77

8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number }}
10+
cancel-in-progress: true
11+
812
jobs:
913
label:
1014
runs-on: ubuntu-latest
15+
timeout-minutes: 5
1116
permissions:
1217
issues: write
1318
pull-requests: write
1419
steps:
1520
- name: Apply labels
16-
uses: actions/github-script@v7
21+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
1722
with:
1823
script: |
1924
let content = "";

‎.github/workflows/check-signed-commits.yaml‎

Lines changed: 44 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -1,139 +1,75 @@
1-
name: "Check Signed Commits"
1+
name: Check signed commits in PR
2+
on: pull_request_target
23

3-
on:
4-
pull_request:
5-
types:
6-
- opened
7-
- synchronize
8-
- reopened
9-
branches:
10-
- main
4+
concurrency:
5+
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
6+
cancel-in-progress: true
117

128
jobs:
139
check-signed-commits:
10+
name: Check signed commits in PR
1411
runs-on: ubuntu-latest
12+
timeout-minutes: 10
1513
permissions:
1614
contents: read
1715
pull-requests: write
18-
issues: write
1916
steps:
20-
- name: Checkout repository
21-
uses: actions/checkout@v5.0.0
17+
- name: Checkout code
18+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2219
with:
23-
fetch-depth: 0
2420
ref: ${{ github.event.pull_request.head.sha }}
21+
fetch-depth: 0
2522

26-
- name: Configure Git for SSH signature verification
27-
run: |
28-
# Create a temporary allowed signers file (not used for actual verification)
29-
# This allows git to recognize SSH signatures exist without requiring key validation
30-
touch /tmp/allowed_signers
31-
git config --global gpg.ssh.allowedSignersFile /tmp/allowed_signers
32-
# Configure git to recognize SSH signing format
33-
git config --global gpg.format ssh
34-
35-
- name: Check for verified commits
36-
id: check-commits
23+
- name: Check for bot commits
24+
id: check-bots
3725
run: |
3826
# Get all commits in the PR
3927
git fetch origin ${{ github.event.pull_request.base.ref }}
40-
COMMITS=$(git rev-list origin/${{ github.event.pull_request.base.ref }}..${{ github.event.pull_request.head.sha }})
41-
42-
UNSIGNED_COMMITS=""
43-
UNSIGNED_COUNT=0
44-
TOTAL_COUNT=0
45-
46-
for commit in $COMMITS; do
47-
TOTAL_COUNT=$((TOTAL_COUNT + 1))
48-
# Check if commit is signed (GPG or SSH signature)
49-
# %G? returns signature status
50-
# %GF returns the signing key fingerprint (empty if not signed)
51-
SIGNATURE=$(git log -1 --format='%G?' $commit)
52-
FINGERPRINT=$(git log -1 --format='%GF' $commit)
53-
54-
# %G? returns:
55-
# G = good GPG signature
56-
# U = unverified signature (has signature but can't verify - common for SSH)
57-
# B = bad signature
58-
# N = no signature
59-
# E = signature expired
60-
# Y = good signature (expired key)
61-
62-
# A commit is considered SIGNED if it has any signature present
63-
# We check for a fingerprint to confirm a signature exists
64-
# For SSH signatures, %G? will be "U" but %GF will have the fingerprint
65-
66-
if [[ -z "$FINGERPRINT" ]]; then
67-
# No fingerprint means no signature at all
68-
UNSIGNED_COMMITS="${UNSIGNED_COMMITS}${commit}\n"
69-
UNSIGNED_COUNT=$((UNSIGNED_COUNT + 1))
70-
fi
71-
done
72-
73-
echo "total_commits=${TOTAL_COUNT}" >> $GITHUB_OUTPUT
74-
echo "unsigned_commits=${UNSIGNED_COUNT}" >> $GITHUB_OUTPUT
75-
76-
if [ $UNSIGNED_COUNT -gt 0 ]; then
77-
echo "has_unsigned=true" >> $GITHUB_OUTPUT
78-
else
79-
echo "has_unsigned=false" >> $GITHUB_OUTPUT
80-
fi
28+
COMMITS=$(git log origin/${{ github.event.pull_request.base.ref }}..HEAD --format="%an")
8129
82-
- name: Check if comment already exists
83-
if: steps.check-commits.outputs.has_unsigned == 'true'
84-
id: check-comment
85-
env:
86-
GH_TOKEN: ${{ github.token }}
87-
run: |
88-
# Check if our bot has already commented on this PR
89-
COMMENT_EXISTS=$(gh api \
90-
-H "Accept: application/vnd.github+json" \
91-
-H "X-GitHub-Api-Version: 2022-11-28" \
92-
"/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
93-
| jq -r '.[] | select(.user.login == "github-actions[bot]" and (.body | contains("⚠️ Unsigned Commits Detected"))) | .id' | head -1)
94-
95-
if [ -n "$COMMENT_EXISTS" ]; then
96-
echo "comment_exists=true" >> $GITHUB_OUTPUT
97-
echo "comment_id=${COMMENT_EXISTS}" >> $GITHUB_OUTPUT
30+
echo "Commits in PR:"
31+
echo "$COMMITS"
32+
33+
# Check if any commits are NOT from bots
34+
# grep -v returns 0 (true) if it finds lines NOT matching the pattern
35+
# grep -v returns 1 (false) if all lines match the pattern (all are bots)
36+
if echo "$COMMITS" | grep -qv '\[bot\]'; then
37+
echo "Found human commits"
38+
echo "has_human_commits=true" >> $GITHUB_OUTPUT
9839
else
99-
echo "comment_exists=false" >> $GITHUB_OUTPUT
40+
echo "All commits are from bots"
41+
echo "has_human_commits=false" >> $GITHUB_OUTPUT
10042
fi
10143
102-
- name: Post warning comment
103-
if: steps.check-commits.outputs.has_unsigned == 'true' && steps.check-comment.outputs.comment_exists == 'false'
104-
env:
105-
GH_TOKEN: ${{ github.token }}
106-
run: |
107-
cat << 'EOF' | gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} -F -
108-
## ⚠️ Unsigned Commits Detected
109-
110-
This pull request contains unsigned commits.
44+
- name: Check signed commits in PR
45+
if: steps.check-bots.outputs.has_human_commits == 'true'
46+
continue-on-error: true
47+
uses: 1Password/check-signed-commits-action@ed2885f3ed2577a4f5d3c3fe895432a557d23d52 # v1.2.0
48+
with:
49+
comment: |
50+
## ⚠️ Unsigned Commits Detected
11151
112-
### What does this mean?
52+
This pull request contains unsigned commits.
11353
114-
Signed commits help ensure the authenticity and traceability of contributions. They allow us to verify that commits actually came from the stated author, even if GitHub accounts are deleted or modified in the future.
54+
### What does this mean?
11555
116-
### Current Policy (Grace Period)
56+
Signed commits help ensure the authenticity and traceability of contributions. They allow us to verify that commits actually came from the stated author, even if GitHub accounts are deleted or modified in the future.
11757
118-
**This is currently a warning only.** We are in a transition period to give all contributors time to set up commit signing.
58+
### Current Policy (Grace Period)
11959
120-
After this grace period, **all commits will be required to be signed** before PRs can be merged.
60+
**This is currently a warning only.** We are in a transition period to give all contributors time to set up commit signing.
12161
122-
### How to sign your commits
62+
After this grace period, **all commits will be required to be signed** before PRs can be merged.
12363
124-
Please see our [Contributing Guide](../blob/main/CONTRIBUTING.md#setting-up-your-development-environment) for detailed instructions on setting up commit signing.
64+
### How to sign your commits
12565
126-
### Resources
66+
Please see our [Contributing Guide](../blob/main/CONTRIBUTING.md#setting-up-your-development-environment) for detailed instructions on setting up commit signing.
12767
128-
- [Contributing Guide: Development Setup](../blob/main/CONTRIBUTING.md#setting-up-your-development-environment)
129-
- [GitHub Docs: About Commit Signature Verification](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
68+
### Resources
13069
131-
---
70+
- [Contributing Guide: Development Setup](../blob/main/CONTRIBUTING.md#setting-up-your-development-environment)
71+
- [GitHub Docs: About Commit Signature Verification](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
13272
133-
_This check will become mandatory in the future. Please start signing your commits now to avoid issues later._
134-
EOF
73+
---
13574
136-
- name: Success message
137-
if: steps.check-commits.outputs.has_unsigned == 'false'
138-
run: |
139-
echo "✅ All ${{ steps.check-commits.outputs.total_commits }} commits in this PR are signed!"
75+
_This check will become mandatory in the future. Please start signing your commits now to avoid issues later._

‎.github/workflows/post-merge.yaml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
name: "Post-Merge Changelog Update"
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'charts/**'
9+
10+
concurrency:
11+
group: ${{ github.workflow }}
12+
cancel-in-progress: false
13+
14+
jobs:
15+
update-changelog:
16+
runs-on: ubuntu-latest
17+
timeout-minutes: 15
18+
permissions:
19+
contents: write
20+
steps:
21+
- name: Checkout main branch
22+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
23+
with:
24+
fetch-depth: 0
25+
token: ${{ secrets.GITHUB_TOKEN }}
26+
27+
- name: Configure Git
28+
run: |
29+
git config user.name 'github-actions[bot]'
30+
git config user.email 'github-actions[bot]@users.noreply.github.com'
31+
32+
- name: Fetch all tags
33+
run: |
34+
git fetch --tags --force
35+
echo "Available tags:"
36+
git tag -l | head -20
37+
38+
- name: Install yq
39+
run: |
40+
sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
41+
sudo chmod +x /usr/local/bin/yq
42+
43+
- name: Setup Helm
44+
uses: Azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
45+
46+
# Python is required because `ct` uses Python-based tools
47+
- name: Set up Python
48+
uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
49+
with:
50+
python-version: 3.x
51+
52+
- name: Set up chart-testing-action
53+
uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
54+
55+
- name: Get changed charts from last commit
56+
id: list-changed
57+
run: |
58+
# Get the commit SHA before the merge
59+
BEFORE_SHA="${{ github.event.before }}"
60+
61+
# Use chart-testing to find changed charts
62+
changed=$(ct list-changed --target-branch main --since "${BEFORE_SHA}")
63+
64+
if [[ -n "$changed" ]]; then
65+
echo "Changed charts:"
66+
echo "$changed"
67+
echo "changed=true" >> $GITHUB_OUTPUT
68+
echo 'changedCharts<<EOF' >> $GITHUB_OUTPUT
69+
echo $changed >> $GITHUB_OUTPUT
70+
echo 'EOF' >> $GITHUB_OUTPUT
71+
else
72+
echo "No chart changes detected"
73+
echo "changed=false" >> $GITHUB_OUTPUT
74+
fi
75+
76+
- name: Get PR information
77+
id: pr-info
78+
if: steps.list-changed.outputs.changed == 'true'
79+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
80+
with:
81+
github-token: ${{ secrets.GITHUB_TOKEN }}
82+
script: |
83+
const commit = context.payload.head_commit;
84+
const commitSha = commit.id;
85+
86+
// Find the PR that was merged
87+
const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
88+
owner: context.repo.owner,
89+
repo: context.repo.repo,
90+
commit_sha: commitSha
91+
});
92+
93+
const mergedPR = prs.find(pr => pr.merged_at);
94+
95+
if (mergedPR) {
96+
core.setOutput('pr_number', mergedPR.number);
97+
core.setOutput('pr_title', mergedPR.title);
98+
core.setOutput('pr_url', mergedPR.html_url);
99+
console.log(`Found merged PR #${mergedPR.number}: ${mergedPR.title}`);
100+
} else {
101+
console.log('No merged PR found for this commit');
102+
core.setOutput('pr_number', '');
103+
core.setOutput('pr_title', commit.message.split('\n')[0]);
104+
core.setOutput('pr_url', '');
105+
}
106+
107+
- name: Generate changelog
108+
id: generate-changelog
109+
if: steps.list-changed.outputs.changed == 'true'
110+
env:
111+
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
112+
GITHUB_REPOSITORY: "${{ github.repository }}"
113+
GITHUB_REPOSITORY_URL: "${{ github.server_url }}/${{ github.repository }}"
114+
CHANGED_CHARTS: ${{ steps.list-changed.outputs.changedCharts }}
115+
PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }}
116+
PR_TITLE: ${{ steps.pr-info.outputs.pr_title }}
117+
PR_URL: ${{ steps.pr-info.outputs.pr_url }}
118+
run: |
119+
set -e
120+
121+
# Extract chart names from changed chart directories
122+
CHART_NAMES=()
123+
for chart_directory in ${CHANGED_CHARTS}; do
124+
CHART_NAME=${chart_directory#charts/}
125+
CHART_NAMES+=("--chart" "$CHART_NAME")
126+
done
127+
128+
# Build arguments for the changelog script
129+
CHANGELOG_ARGS=("${CHART_NAMES[@]}")
130+
131+
if [[ -n "$PR_TITLE" ]]; then
132+
CHANGELOG_ARGS+=("--pr-title" "${PR_TITLE}")
133+
fi
134+
135+
if [[ -n "$PR_NUMBER" ]]; then
136+
CHANGELOG_ARGS+=("--pr-number" "${PR_NUMBER}")
137+
fi
138+
139+
if [[ -n "$PR_URL" ]]; then
140+
CHANGELOG_ARGS+=("--pr-url" "${PR_URL}")
141+
fi
142+
143+
# Run the changelog generation script
144+
./generate-changelog.sh "${CHANGELOG_ARGS[@]}"
145+
146+
# Check if there are changes
147+
if git status --porcelain | grep -q 'CHANGELOG.md'; then
148+
echo "has_changes=true" >> $GITHUB_OUTPUT
149+
echo "Changelog changes detected"
150+
else
151+
echo "No CHANGELOG changes"
152+
echo "has_changes=false" >> $GITHUB_OUTPUT
153+
fi
154+
155+
- name: Commit and push changelog updates
156+
if: steps.generate-changelog.outputs.has_changes == 'true'
157+
run: |
158+
git add charts/*/CHANGELOG.md
159+
git commit -m "chore: update CHANGELOG.md for merged changes" \
160+
-m "Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
161+
git push origin main

0 commit comments

Comments
 (0)