👷 sign chrome-bump commits with commit-headless (#4838)

Author: thomas-lebeau

.github/chainguard/self.gitlab.commit.sts.yaml

@@ -0,0 +1,11 @@
+issuer: https://gitlab.ddbuild.io
+
+subject_pattern: 'project_path:DataDog/browser-sdk:ref_type:branch:ref:main'
+
+claim_pattern:
+  project_path: 'DataDog/browser-sdk'
+  ref_type: 'branch'
+  ref: 'main'
+
+permissions:
+  contents: write

Dockerfile

@@ -76,6 +76,9 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o
 # DD Octo STS to get security token
 COPY --from=registry.ddbuild.io/dd-octo-sts:v1.8.1@sha256:eb2895829cdcb1f41cc4fc9d1f3f329c7d8f6fa72b0e8bb915d8195717e02bfa /usr/local/bin/dd-octo-sts /usr/local/bin/dd-octo-sts
 
+# Commit Headless to create signed (Verified) commits from CI bots
+COPY --from=registry.ddbuild.io/commit-headless /commit-headless /usr/local/bin/commit-headless
+
 RUN apt-get update && apt-get install -y jq
 
 # Webdriverio deps

scripts/lib/gitUtils.ts

@@ -6,6 +6,7 @@ import {
   getGithubReadToken,
   getGithubReleaseToken,
   getGithubPullRequestToken,
+  getGithubCommitToken,
   type OctoStsToken,
 } from './secrets.ts'
 import { FetchError, fetchHandlingError, findError } from './executionUtils.ts'
@@ -74,6 +75,26 @@ export function createPullRequest(mainBranch: string, labels?: string[]) {
   return pullRequestUrl.trim()
 }
 
+/**
+ * Push the current HEAD commit to a new remote branch as a signed (Verified) commit, using
+ * commit-headless to create it through the GitHub API instead of a plain `git push`. Since the
+ * remote commit is re-signed, its SHA differs from the local one: `--reset` resets the local
+ * branch to it, so callers (e.g. `gh pr create`) see it as fully pushed and don't attempt an
+ * unsigned push of their own.
+ */
+export function pushSignedCommit(branch: string): void {
+  // `--create-branch` has no default branch point, so `--head-sha` must be given explicitly: the
+  // parent of HEAD, i.e. the commit the local branch was created from.
+  const headSha = command`git rev-parse HEAD^`.run().trim()
+
+  using token = getGithubCommitToken()
+  command`commit-headless push -T DataDog/browser-sdk --branch ${branch} --create-branch --head-sha ${headSha} --reset`
+    .withEnvironment({ GITHUB_TOKEN: token.value })
+    .withLogs()
+    .run()
+  command`git branch --set-upstream-to=origin/${branch} ${branch}`.run()
+}
+
 export function getLastCommonCommit(baseBranch: string): string {
   try {
     command`git fetch --depth=100 origin ${baseBranch}`.run()

scripts/lib/secrets.ts

@@ -34,6 +34,13 @@ export function getGithubReadToken() {
   return new OctoStsToken('read')
 }
 
+/**
+ * This token is scoped to main branch only.
+ */
+export function getGithubCommitToken() {
+  return new OctoStsToken('commit')
+}
+
 export function getOrg2ApiKey(): string {
   return getSecretKey('ci.browser-sdk.datadog_ci_api_key')
 }

scripts/test/bump-chrome-version.ts

@@ -2,7 +2,7 @@ import fs from 'node:fs'
 import { printLog, runMain, fetchHandlingError } from '../lib/executionUtils.ts'
 import { command } from '../lib/command.ts'
 import { CI_FILE, replaceCiFileVariable } from '../lib/filesUtils.ts'
-import { initGitConfig, createPullRequest } from '../lib/gitUtils.ts'
+import { initGitConfig, createPullRequest, pushSignedCommit } from '../lib/gitUtils.ts'
 
 const REPOSITORY = process.env.GIT_REPOSITORY
 const MAIN_BRANCH = process.env.MAIN_BRANCH
@@ -51,7 +51,7 @@ runMain(async () => {
 
   command`git add ${CI_FILE}`.run()
   command`git commit -m ${commitMessage}`.run()
-  command`git push origin ${chromeVersionBranch}`.run()
+  pushSignedCommit(chromeVersionBranch)
 
   printLog('Create PR...')