Skip to content

Commit 793bf95

Browse files
andhreljaKernandhreljaKern
committed
feat: admin update repo settings scripts
1 parent 212cdd9 commit 793bf95

File tree

10 files changed

+333
-0
lines changed

10 files changed

+333
-0
lines changed

‎.github/workflows/admin_update_repo_settings.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: 'Admin: Update GitHub Repositories Settings'
2+
3+
on:
4+
workflow_dispatch:
5+
6+
# Special permissions required for OIDC authentication
7+
permissions:
8+
id-token: write
9+
contents: read
10+
actions: read
11+
12+
env:
13+
GH_TOKEN: ${{ secrets.GH_TOKEN }}
14+
15+
jobs:
16+
admin-update-repo-settings:
17+
name: 'GitHub: Update Repo Settings'
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Update Repository Settings
21+
run: |
22+
bash admin/update_repo_settings.sh \
23+
-e ${{ github.ref_name }}
24+
25+
echo "::notice::Release Published"

‎mgmt/azrm.sh renamed to ‎admin/azrm.sh

File renamed without changes.

‎mgmt/misc.sh renamed to ‎admin/misc.sh

File renamed without changes.

‎admin/repo_list/app_iac.sh

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/bin/bash
2+
3+
# template-tf-azure-application-iac - manual maintanence
4+
5+
export REPO_LIST_APP_IAC=(
6+
tf-azure-admin-dashboard
7+
tf-azure-cognition-exec-env
8+
tf-azure-cognition-gateway
9+
tf-azure-cognition-pdf2md
10+
tf-azure-cognition-task-master
11+
tf-azure-cognition-ui
12+
tf-azure-ecosystem-welcome-screen
13+
tf-azure-external-data-mapper
14+
tf-azure-gates-gateway
15+
tf-azure-gates-runtime
16+
tf-azure-gates-ui
17+
tf-azure-hosted-inference-api
18+
tf-azure-platform-monitoring
19+
tf-azure-refinery-ac-exec-env
20+
tf-azure-refinery-authorizer
21+
tf-azure-refinery-commercial-proxy
22+
tf-azure-refinery-config
23+
tf-azure-refinery-doc-ock
24+
tf-azure-refinery-embedder
25+
tf-azure-refinery-entry
26+
tf-azure-refinery-gateway
27+
tf-azure-refinery-gateway-proxy
28+
tf-azure-refinery-lf-exec-env
29+
tf-azure-refinery-ml-exec-env
30+
tf-azure-refinery-model-provider
31+
tf-azure-refinery-neural-search
32+
tf-azure-refinery-record-ide-env
33+
tf-azure-refinery-tokenizer
34+
tf-azure-refinery-ui
35+
tf-azure-refinery-updater
36+
tf-azure-refinery-weak-supervisor
37+
tf-azure-refinery-websocket
38+
tf-azure-refinery-zero-shot
39+
)

‎admin/repo_list/tf_iac.sh

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/bin/bash
2+
3+
# template-tf-azure - manual maintanence
4+
5+
export REPO_LIST_TF_IAC=(
6+
tf-azure-sso
7+
tf-azure-admin
8+
tf-azure-container-registry
9+
tf-azure-core
10+
tf-azure-do2az-migration
11+
tf-azure-fnapp-github-runner-monitor
12+
tf-azure-github-runner
13+
tf-azure-k8-cluster
14+
tf-azure-k8-cluster-cognition
15+
tf-azure-k8-cluster-freeapi
16+
)

‎admin/repo_list/tf_module.sh

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
3+
# template-tf-azure-module - manual maintanence
4+
5+
export REPO_LIST_TF_MODULE=(
6+
tf-azure-module-github-oidc
7+
tf-azure-module-k8
8+
tf-azure-module-k8-key-vault
9+
tf-azure-module-k8-secret-provider
10+
tf-azure-module-vm
11+
tf-azure-module-vnet
12+
)

‎admin/repo_static/dev/ruleset.json.tmpl

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"name": "${ENVIRONMENT_NAME}",
3+
"target": "branch",
4+
"enforcement": "active",
5+
"bypass_actors": [
6+
{
7+
"actor_id": ${DEV_ADMIN_GITHUB_TEAM_ID},
8+
"actor_type": "Team",
9+
"bypass_mode": "always"
10+
},
11+
{
12+
"actor_id": ${DEVOPS_ADMIN_GITHUB_TEAM_ID},
13+
"actor_type": "Team",
14+
"bypass_mode": "always"
15+
}
16+
],
17+
"conditions": {
18+
"ref_name": {
19+
"include": [
20+
"refs/heads/${ENVIRONMENT_NAME}"
21+
],
22+
"exclude": []
23+
}
24+
},
25+
"rules": [
26+
{
27+
"type": "deletion"
28+
},
29+
{
30+
"type": "non_fast_forward"
31+
},
32+
{
33+
"type": "creation"
34+
},
35+
{
36+
"type": "pull_request",
37+
"parameters": {
38+
"required_approving_review_count": 1,
39+
"dismiss_stale_reviews_on_push": true,
40+
"require_code_owner_review": false,
41+
"require_last_push_approval": false,
42+
"required_review_thread_resolution": true
43+
}
44+
},
45+
{
46+
"type": "required_status_checks",
47+
"parameters": {
48+
"strict_required_status_checks_policy": true,
49+
"do_not_enforce_on_create": true,
50+
"required_status_checks": [
51+
{
52+
"context": "call-tofu-plan-apply / OpenTofu Plan"
53+
}
54+
]
55+
}
56+
}
57+
]
58+
}

‎admin/repo_static/prod/ruleset.json.tmpl

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"name": "${ENVIRONMENT_NAME}",
3+
"target": "branch",
4+
"enforcement": "active",
5+
"bypass_actors": [
6+
{
7+
"actor_id": ${DEV_ADMIN_GITHUB_TEAM_ID},
8+
"actor_type": "Team",
9+
"bypass_mode": "always"
10+
},
11+
{
12+
"actor_id": ${DEVOPS_ADMIN_GITHUB_TEAM_ID},
13+
"actor_type": "Team",
14+
"bypass_mode": "always"
15+
}
16+
],
17+
"conditions": {
18+
"ref_name": {
19+
"include": [
20+
"refs/heads/${ENVIRONMENT_NAME}"
21+
],
22+
"exclude": []
23+
}
24+
},
25+
"rules": [
26+
{
27+
"type": "deletion"
28+
},
29+
{
30+
"type": "non_fast_forward"
31+
},
32+
{
33+
"type": "creation"
34+
},
35+
{
36+
"type": "pull_request",
37+
"parameters": {
38+
"required_approving_review_count": 1,
39+
"dismiss_stale_reviews_on_push": true,
40+
"require_code_owner_review": true,
41+
"require_last_push_approval": false,
42+
"required_review_thread_resolution": true
43+
}
44+
},
45+
{
46+
"type": "required_deployments",
47+
"parameters": {
48+
"required_deployment_environments": [
49+
"dev"
50+
]
51+
}
52+
},
53+
{
54+
"type": "required_status_checks",
55+
"parameters": {
56+
"strict_required_status_checks_policy": true,
57+
"do_not_enforce_on_create": true,
58+
"required_status_checks": [
59+
{
60+
"context": "call-tofu-plan-apply / OpenTofu Plan"
61+
}
62+
]
63+
}
64+
}
65+
]
66+
}

‎mgmt/tfdocs.py renamed to ‎admin/tfdocs.py

File renamed without changes.

‎admin/update_repo_settings.sh

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
REPOSITORY_OWNER="code-kern-ai"
6+
REPOSITORY_NAME=""
7+
DEV_ADMIN_GITHUB_TEAM_ID=10188509
8+
DEVOPS_ADMIN_GITHUB_TEAM_ID=10188507
9+
10+
ENVIRONMENT_NAME="dev"
11+
12+
while getopts o: flag
13+
do
14+
case "${flag}" in
15+
o) REPOSITORY_OWNER=${OPTARG};;
16+
esac
17+
done
18+
19+
source admin/repo_list/app_iac.sh
20+
source admin/repo_list/tf_iac.sh
21+
source admin/repo_list/tf_module.sh
22+
23+
RULESET_CONTENT=$(echo $(sed \
24+
-e "s|\${ENVIRONMENT_NAME}|${ENVIRONMENT_NAME}|g" \
25+
-e "s|\${DEV_ADMIN_GITHUB_TEAM_ID}|${DEV_ADMIN_GITHUB_TEAM_ID}|g" \
26+
-e "s|\${DEVOPS_ADMIN_GITHUB_TEAM_ID}|${DEVOPS_ADMIN_GITHUB_TEAM_ID}|g" \
27+
admin/repo_static/${ENVIRONMENT_NAME}/ruleset.json.tmpl))
28+
29+
30+
function get_ruleset_by_name() {
31+
RULESET_NAME=${1}
32+
33+
echo $(gh api \
34+
-H "Accept: application/vnd.github+json" \
35+
-H "X-GitHub-Api-Version: 2022-11-28" \
36+
/repos/${REPOSITORY_OWNER}/${REPOSITORY_NAME}/rulesets \
37+
--jq '.[] | select(.name == "'${RULESET_NAME}'") | .id')
38+
}
39+
40+
function create_ruleset() {
41+
REPOSITORY_NAME=${1}
42+
43+
echo "${RULESET_CONTENT}" | gh api \
44+
--method POST \
45+
-H "Accept: application/vnd.github+json" \
46+
-H "X-GitHub-Api-Version: 2022-11-28" \
47+
/repos/${REPOSITORY_OWNER}/${REPOSITORY_NAME}/rulesets \
48+
--input - 1>/dev/null
49+
}
50+
51+
function update_ruleset() {
52+
REPOSITORY_NAME=${1}
53+
RULESET_ID=${2}
54+
55+
echo "${RULESET_CONTENT}" | gh api \
56+
--method PUT \
57+
-H "Accept: application/vnd.github+json" \
58+
-H "X-GitHub-Api-Version: 2022-11-28" \
59+
/repos/${REPOSITORY_OWNER}/${REPOSITORY_NAME}/rulesets/${RULESET_ID} \
60+
--input - 1>/dev/null
61+
}
62+
63+
echo "::group::Updating repository settings"
64+
COMBINED_ARRAY=(${REPO_LIST_APP_IAC[@]} ${REPO_LIST_TF_IAC[@]} ${REPO_LIST_TF_MODULE[@]})
65+
for REPOSITORY_NAME in ${COMBINED_ARRAY[@]}; do
66+
echo "Updating ${REPOSITORY_OWNER}/${REPOSITORY_NAME}"
67+
gh api \
68+
--method PATCH \
69+
-H "Accept: application/vnd.github+json" \
70+
-H "X-GitHub-Api-Version: 2022-11-28" \
71+
/repos/${REPOSITORY_OWNER}/${REPOSITORY_NAME} \
72+
-F "has_issues=true" \
73+
-F "has_projects=false" \
74+
-F "has_wiki=false" \
75+
-F "allow_squash_merge=true" \
76+
-F "allow_merge_commit=true" \
77+
-F "allow_rebase_merge=false" \
78+
-F "allow_auto_merge=false" \
79+
-F "delete_branch_on_merge=true" \
80+
-F "allow_update_branch=true" 1>/dev/null
81+
done
82+
echo "::endgroup::"
83+
84+
echo "::group::tf-module repository rulesets"
85+
86+
for REPOSITORY_NAME in ${REPO_LIST_TF_MODULE[@]}; do
87+
if [ "${ENVIRONMENT_NAME}" = "prod" ]; then
88+
# Module repositories do not need a prod ruleset
89+
continue
90+
fi
91+
92+
ruleset_id=$(get_ruleset_by_name ${ENVIRONMENT_NAME})
93+
if [ -z "${ruleset_id}" ]; then
94+
echo "Creating ruleset for ${REPOSITORY_NAME}/${ENVIRONMENT_NAME}"
95+
create_ruleset ${REPOSITORY_NAME}
96+
else
97+
echo "Updating ruleset for ${REPOSITORY_NAME}/${ENVIRONMENT_NAME}"
98+
update_ruleset ${REPOSITORY_NAME} ${ruleset_id}
99+
fi
100+
done
101+
102+
echo "::endgroup::"
103+
104+
105+
echo "::group::app-tf-iac repository rulesets"
106+
COMBINED_ARRAY=(${REPO_LIST_APP_IAC[@]} ${REPO_LIST_TF_IAC[@]}})
107+
for REPOSITORY_NAME in ${COMBINED_ARRAY[@]}; do
108+
ruleset_id=$(get_ruleset_by_name ${ENVIRONMENT_NAME})
109+
if [ -z "${ruleset_id}" ]; then
110+
echo "Creating ruleset for ${REPOSITORY_NAME}/${ENVIRONMENT_NAME}"
111+
create_ruleset ${REPOSITORY_NAME}
112+
else
113+
echo "Updating ruleset for ${REPOSITORY_NAME}/${ENVIRONMENT_NAME}"
114+
update_ruleset ${REPOSITORY_NAME} ${ruleset_id}
115+
fi
116+
done
117+
echo "::endgroup::"

0 commit comments

Comments
 (0)