Skip to content

Commit 897ce5e

Browse files
yosefAlsuhaibaniyosefAlsuhaibani
authored
Merge pull request #16 from semgrep/yosef/automate
Add work from other fork
2 parents 366f6f1 + a149ace commit 897ce5e

File tree

4 files changed

+162
-0
lines changed

4 files changed

+162
-0
lines changed

‎.github/workflows/bump_version.yml

+130
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
jobs:
2+
bump-version:
3+
runs-on: ubuntu-latest
4+
permissions:
5+
id-token: write
6+
contents: write
7+
pull-requests: write
8+
checks: write
9+
env:
10+
NEW_SEMGREP_VERSION: ${{ github.event.inputs.version }}
11+
steps:
12+
- id: jwt
13+
env:
14+
EXPIRATION: 600
15+
ISSUER: ${{ secrets.SEMGREP_CI_APP_ID }}
16+
PRIVATE_KEY: ${{ secrets.SEMGREP_CI_APP_KEY }}
17+
name: Get JWT for semgrep-ci GitHub App
18+
uses: docker://public.ecr.aws/y9k7q4m1/devops/cicd:latest
19+
20+
- id: token
21+
name: Get token for semgrep-ci GitHub App
22+
run: |
23+
TOKEN="$(curl -X POST \
24+
-H "Authorization: Bearer ${{ steps.jwt.outputs.jwt }}" \
25+
-H "Accept: application/vnd.github.v3+json" \
26+
"https://api.github.com/app/installations/${{ secrets.SEMGREP_CI_APP_INSTALLATION_ID }}/access_tokens" | \
27+
jq -r .token)"
28+
echo "::add-mask::$TOKEN"
29+
echo "token=$TOKEN" >> $GITHUB_OUTPUT
30+
31+
- uses: actions/checkout@v3
32+
with:
33+
token: ${{ steps.token.outputs.token }}
34+
35+
- name: Bump version in this repo
36+
run: scripts/bump-version.sh "$NEW_SEMGREP_VERSION"
37+
38+
- name: Commit and push
39+
id: commit
40+
env:
41+
BRANCH: "gha/bump-version-${{ github.event.inputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}"
42+
SUBJECT: "Bump semgrep to ${{ github.event.inputs.version }}"
43+
run: |
44+
git config user.name ${{ github.actor }}
45+
git config user.email ${{ github.actor }}@users.noreply.github.com
46+
git checkout -b $BRANCH
47+
git add setup.py README.md
48+
git commit -m "$SUBJECT"
49+
git tag "v$NEW_SEMGREP_VERSION" HEAD
50+
git push --set-upstream origin $BRANCH
51+
echo "branch=$BRANCH" >> $GITHUB_OUTPUT
52+
echo "subject=$SUBJECT" >> $GITHUB_OUTPUT
53+
54+
- name: Create PR
55+
id: open-pr
56+
env:
57+
SOURCE: "${{ steps.commit.outputs.branch }}"
58+
TARGET: "${{ github.event.repository.default_branch }}"
59+
TITLE: "chore: Release Version ${{ inputs.version }}"
60+
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
61+
VERSION: "${{ inputs.version }}"
62+
run: |
63+
# check if the branch already has a pull request open
64+
if gh pr list --head ${SOURCE} | grep -vq "no pull requests"; then
65+
# pull request already open
66+
echo "pull request from SOURCE ${SOURCE} to TARGET ${TARGET} is already open";
67+
echo "cancelling release"
68+
exit 1
69+
fi
70+
# open new pull request with the body of from the local template.
71+
res=$(gh pr create --title "${TITLE}" --body "Bump Semgrep Version to ${VERSION}" \
72+
--base "${TARGET}" --head "${SOURCE}" --reviewer semgrep/cdx)
73+
74+
- name: Approve & Merge PR
75+
run: |
76+
gh pr review --approve ${{ steps.commit.branch }}
77+
gh pr merge --auto --squash ${{ steps.commit.branch }}
78+
79+
- name: bump-yaml
80+
run: scripts/bump-version-yaml.sh "$NEW_SEMGREP_VERSION"
81+
82+
- name: Commit and push
83+
id: commit-yaml
84+
env:
85+
BRANCH: "gha/bump-version-yaml-${NEW_SEMGREP_VERSION}-${{ github.run_id }}-${{ github.run_attempt }}"
86+
SUBJECT: "Bump semgrep to ${NEW_SEMGREP_VERSION}"
87+
run: |
88+
git config user.name ${{ github.actor }}
89+
git config user.email ${{ github.actor }}@users.noreply.github.com
90+
git checkout -b $BRANCH
91+
git add .
92+
git commit -m "$SUBJECT"
93+
git push --set-upstream origin $BRANCH
94+
echo "branch=$BRANCH" >> $GITHUB_OUTPUT
95+
echo "subject=$SUBJECT" >> $GITHUB_OUTPUT
96+
97+
- name: Create PR
98+
id: open-2nd-pr
99+
env:
100+
SOURCE: "${{ steps.commit-yaml.outputs.branch }}"
101+
TARGET: "${{ github.event.repository.default_branch }}"
102+
TITLE: "chore: Release Version ${{ inputs.version }}"
103+
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
104+
VERSION: "${{ inputs.version }}"
105+
run: |
106+
# check if the branch already has a pull request open
107+
if gh pr list --head ${SOURCE} | grep -vq "no pull requests"; then
108+
# pull request already open
109+
echo "pull request from SOURCE ${SOURCE} to TARGET ${TARGET} is already open";
110+
echo "cancelling release"
111+
exit 1
112+
fi
113+
# open new pull request with the body of from the local template.
114+
res=$(gh pr create --title "${TITLE}" --body "Bump Semgrep Version to ${VERSION}" \
115+
--base "${TARGET}" --head "${SOURCE}" --reviewer semgrep/cdx)
116+
117+
- name: Approve & Merge yaml PR
118+
run: |
119+
gh pr review --approve ${{ steps.commit-yaml.branch }}
120+
gh pr merge --auto --squash ${{ steps.commit-yaml.branch }}
121+
122+
123+
name: bump-version
124+
on:
125+
workflow_dispatch:
126+
inputs:
127+
version:
128+
description: "Version of semgrep to use"
129+
required: true
130+
type: string

‎.github/workflows/inc-version.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: inc-version
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
commit-sha-to-release:
6+
description: The full commit SHA in semgrep-pro that you'd like to release. It must match the output of the push-pr-binaries job after it runs successfully on the 'develop' branch. It is used to name the release candidate binaries uploaded to S3.
7+
required: true
8+
type: string
9+
dry-run:
10+
default: false
11+
description: Whether a dry-run (e.g., print tags to push) should be peformed. Actually push images if false.
12+
required: true
13+
type: boolean
14+
semgrep-version:
15+
description: The version of Semgrep OSS that this Pro release is built for. This is the version that is about to be released and should be what the previous version bump step set the OSS version to in the previous step. This is only really required as a safety check, failing to get the version correct here will only cause this step to fail and should not break anything.
16+
required: true
17+
type: string
18+
jobs:
19+
jobs:
20+
test-hooks:
21+
runs-on: ubuntu-latest
22+
steps:
23+
- uses: actions/checkout@v3

‎scripts/bump-version-yaml.sh

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
VERSION=$1
2+
3+
sed -ie "s/\(rev\:*\) \'v[0-9.]*\'/\1 \'v$VERSION\'/" .pre-commit-config.yaml

‎scripts/bump-version.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
VERSION=$1
2+
3+
# Do text substitution in setup.py & README.md
4+
sed -ie "s/\(version\)=\"[0-9.]*\"\,/\1=\"$VERSION\"\,/" setup.py
5+
sed -ie "s/\(semgrep\)==[0-9.]*/\1==$VERSION/" setup.py
6+
sed -ie "s/\(rev\:\)\ 'v[0-9.]*'/\1\ \'v$VERSION\'/" README.md

0 commit comments

Comments
 (0)