Skip to content

Commit 0eac466

Browse files
ericcornelissenericcornelissen
committed
Trigger GHA release immutability check on dependabot branches only
Avoid skipped status check when it not necessary by pulling the branch- based filtering up to the workflow trigger. Also, merge two Dependabot-related jobs into one workflow.
1 parent 15f42c1 commit 0eac466

3 files changed

Lines changed: 102 additions & 102 deletions

File tree

‎.github/workflows/checks.yml‎

Lines changed: 0 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -72,71 +72,6 @@ jobs:
7272
languages: ${{ matrix.what }}
7373
- name: Perform CodeQL analysis
7474
uses: github/codeql-action/analyze@v4.32.0
75-
gha-release:
76-
name: GitHub Actions Release Immutability
77-
runs-on: ubuntu-24.04
78-
if: ${{ github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.ref || github.ref_name, 'dependabot/github_actions/') }}
79-
permissions:
80-
pull-requests: write # To comment on a Pull Request
81-
steps:
82-
- name: Parse
83-
id: parse
84-
shell: bash
85-
env:
86-
TITLE: ${{ github.event.pull_request.title }}
87-
run: |
88-
REPO=$(echo "${TITLE}" | awk -F' ' '{print $2}')
89-
OLD=$(echo "${TITLE}" | awk -F' ' '{print $4}')
90-
NEW=$(echo "${TITLE}" | awk -F' ' '{print $6}')
91-
92-
{
93-
echo "repo=$REPO"
94-
echo "new=$NEW"
95-
echo "old=$OLD"
96-
} >>"$GITHUB_OUTPUT"
97-
- name: Check
98-
id: check
99-
shell: bash
100-
env:
101-
GH_TOKEN: ${{ github.token }}
102-
NEW: ${{ steps.parse.outputs.new }}
103-
OLD: ${{ steps.parse.outputs.old }}
104-
REPO: ${{ steps.parse.outputs.repo }}
105-
run: |
106-
set -euo pipefail
107-
108-
WAS_IMMUTABLE=$(gh release view "v${OLD}" --repo "${REPO}" --json isImmutable | jq .isImmutable)
109-
IS_IMMUTABLE=$(gh release view "v${NEW}" --repo "${REPO}" --json isImmutable | jq .isImmutable)
110-
111-
echo "::debug::was ${WAS_IMMUTABLE}; is ${IS_IMMUTABLE}"
112-
{
113-
case "${WAS_IMMUTABLE};${IS_IMMUTABLE}" in
114-
'true;true')
115-
echo "comment="
116-
;;
117-
'false;false')
118-
echo "comment=${OLD} was not an immutable release and ${NEW} still is not. :neutral_face:"
119-
;;
120-
'true;false')
121-
echo "comment=${OLD} was an immutable release but ${NEW} is not. :cry:"
122-
;;
123-
'false;true')
124-
echo "comment=${OLD} was not an immutable release but ${NEW} is! :smile:"
125-
;;
126-
esac
127-
} >>"$GITHUB_OUTPUT"
128-
- name: Comment
129-
if: ${{ steps.check.outputs.comment != '' }}
130-
shell: bash
131-
env:
132-
GH_TOKEN: ${{ github.token }}
133-
GH_URL: ${{ github.server_url }}
134-
COMMENT: ${{ steps.check.outputs.comment }}
135-
NUMBER: ${{ github.event.pull_request.number }}
136-
REPO: ${{ github.repository }}
137-
run: |
138-
URL="${GH_URL}/${REPO}/pull/${NUMBER}"
139-
gh pr comment "${URL}" --body "${COMMENT}"
14075
reproducible:
14176
name: Reproducible build
14277
runs-on: ubuntu-24.04

‎.github/workflows/dependabot.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: ghasum
2+
on:
3+
push:
4+
branches:
5+
- dependabot/github_actions/**
6+
7+
permissions: read-all
8+
9+
jobs:
10+
gha-release:
11+
name: GitHub Actions Release Immutability
12+
runs-on: ubuntu-24.04
13+
if: ${{ github.actor == 'dependabot[bot]' }}
14+
permissions:
15+
pull-requests: write # To comment on a Pull Request
16+
steps:
17+
- name: Parse
18+
id: parse
19+
shell: bash
20+
env:
21+
TITLE: ${{ github.event.pull_request.title }}
22+
run: |
23+
REPO=$(echo "${TITLE}" | awk -F' ' '{print $2}')
24+
OLD=$(echo "${TITLE}" | awk -F' ' '{print $4}')
25+
NEW=$(echo "${TITLE}" | awk -F' ' '{print $6}')
26+
27+
{
28+
echo "repo=$REPO"
29+
echo "new=$NEW"
30+
echo "old=$OLD"
31+
} >>"$GITHUB_OUTPUT"
32+
- name: Check
33+
id: check
34+
shell: bash
35+
env:
36+
GH_TOKEN: ${{ github.token }}
37+
NEW: ${{ steps.parse.outputs.new }}
38+
OLD: ${{ steps.parse.outputs.old }}
39+
REPO: ${{ steps.parse.outputs.repo }}
40+
run: |
41+
set -euo pipefail
42+
43+
WAS_IMMUTABLE=$(gh release view "v${OLD}" --repo "${REPO}" --json isImmutable | jq .isImmutable)
44+
IS_IMMUTABLE=$(gh release view "v${NEW}" --repo "${REPO}" --json isImmutable | jq .isImmutable)
45+
46+
echo "::debug::was ${WAS_IMMUTABLE}; is ${IS_IMMUTABLE}"
47+
{
48+
case "${WAS_IMMUTABLE};${IS_IMMUTABLE}" in
49+
'true;true')
50+
echo "comment="
51+
;;
52+
'false;false')
53+
echo "comment=${OLD} was not an immutable release and ${NEW} still is not. :neutral_face:"
54+
;;
55+
'true;false')
56+
echo "comment=${OLD} was an immutable release but ${NEW} is not. :cry:"
57+
;;
58+
'false;true')
59+
echo "comment=${OLD} was not an immutable release but ${NEW} is! :smile:"
60+
;;
61+
esac
62+
} >>"$GITHUB_OUTPUT"
63+
- name: Comment
64+
if: ${{ steps.check.outputs.comment != '' }}
65+
shell: bash
66+
env:
67+
GH_TOKEN: ${{ github.token }}
68+
GH_URL: ${{ github.server_url }}
69+
COMMENT: ${{ steps.check.outputs.comment }}
70+
NUMBER: ${{ github.event.pull_request.number }}
71+
REPO: ${{ github.repository }}
72+
run: |
73+
URL="${GH_URL}/${REPO}/pull/${NUMBER}"
74+
gh pr comment "${URL}" --body "${COMMENT}"
75+
ghasum:
76+
name: Update gha.sum
77+
runs-on: ubuntu-24.04
78+
if: ${{ github.actor == 'dependabot[bot]' }}
79+
permissions:
80+
contents: write # To push a commit
81+
steps:
82+
- name: Create automation token
83+
uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
84+
id: automation-token
85+
with:
86+
app-id: ${{ secrets.AUTOMATION_APP_ID }}
87+
private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
88+
- name: Checkout repository
89+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
90+
with:
91+
token: ${{ steps.automation-token.outputs.token }}
92+
- name: Install ghasum
93+
uses: ./.github/actions/ghasum
94+
with:
95+
mode: install
96+
- name: Update gha.sum
97+
run: ghasum update
98+
- name: Commit gha.sum
99+
uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # v7.0.0
100+
with:
101+
commit_message: Update ghasum checksums
102+
file_pattern: .github/workflows/gha.sum

‎.github/workflows/ghasum.yml‎

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +0,0 @@
1-
name: ghasum
2-
on:
3-
push:
4-
branches:
5-
- dependabot/github_actions/**
6-
7-
permissions: read-all
8-
9-
jobs:
10-
update:
11-
name: Update gha.sum
12-
runs-on: ubuntu-24.04
13-
if: ${{ github.actor == 'dependabot[bot]' }}
14-
permissions:
15-
contents: write # To push a commit
16-
steps:
17-
- name: Create automation token
18-
uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
19-
id: automation-token
20-
with:
21-
app-id: ${{ secrets.AUTOMATION_APP_ID }}
22-
private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
23-
- name: Checkout repository
24-
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
25-
with:
26-
token: ${{ steps.automation-token.outputs.token }}
27-
- name: Install ghasum
28-
uses: ./.github/actions/ghasum
29-
with:
30-
mode: install
31-
- name: Update gha.sum
32-
run: ghasum update
33-
- name: Commit gha.sum
34-
uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # v7.0.0
35-
with:
36-
commit_message: Update ghasum checksums
37-
file_pattern: .github/workflows/gha.sum

0 commit comments

Comments
 (0)