-
Notifications
You must be signed in to change notification settings - Fork 4
Borrow the release process from pseudo-service #525
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| --- | ||
| # Labels names are important as they are used by Release Drafter to decide | ||
| # regarding where to record them in changelog or if to skip them. | ||
| # | ||
| # The repository labels will be automatically configured using this file and | ||
| # the GitHub Action https://github.com/marketplace/actions/github-labeler. | ||
| - name: breaking | ||
| description: Breaking Changes | ||
| color: bfd4f2 | ||
| - name: bug | ||
| description: Something isn't working | ||
| color: d73a4a | ||
| - name: build | ||
| description: Build System and Dependencies | ||
| color: bfdadc | ||
| - name: ci | ||
| description: Continuous Integration | ||
| color: 4a97d6 | ||
| - name: dependencies | ||
| description: Pull requests that update a dependency file | ||
| color: 0366d6 | ||
| - name: documentation | ||
| description: Improvements or additions to documentation | ||
| color: 0075ca | ||
| - name: duplicate | ||
| description: This issue or pull request already exists | ||
| color: cfd3d7 | ||
| - name: enhancement | ||
| description: New feature or request | ||
| color: a2eeef | ||
| - name: github_actions | ||
| description: Pull requests that update Github_actions code | ||
| color: "000000" | ||
| - name: good first issue | ||
| description: Good for newcomers | ||
| color: 7057ff | ||
| - name: help wanted | ||
| description: Extra attention is needed | ||
| color: "008672" | ||
| - name: invalid | ||
| description: This doesn't seem right | ||
| color: e4e669 | ||
| - name: performance | ||
| description: Performance | ||
| color: "016175" | ||
| - name: question | ||
| description: Further information is requested | ||
| color: d876e3 | ||
| - name: refactoring | ||
| description: Refactoring | ||
| color: ef67c4 | ||
| - name: removal | ||
| description: Removals and Deprecations | ||
| color: 9ae7ea | ||
| - name: style | ||
| description: Style | ||
| color: c120e5 | ||
| - name: testing | ||
| description: Testing | ||
| color: b1fc6f | ||
| - name: wontfix | ||
| description: This will not be worked on | ||
| color: ffffff |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| categories: | ||
| - title: ":boom: Breaking Changes" | ||
| label: "breaking" | ||
| - title: ":rocket: Features" | ||
| label: "enhancement" | ||
| - title: ":fire: Removals and Deprecations" | ||
| label: "removal" | ||
| - title: ":beetle: Fixes" | ||
| label: "bug" | ||
| - title: ":racehorse: Performance" | ||
| label: "performance" | ||
| - title: ":rotating_light: Testing" | ||
| label: "testing" | ||
| - title: ":construction_worker: Continuous Integration" | ||
| label: "ci" | ||
| - title: ":books: Documentation" | ||
| label: "documentation" | ||
| - title: ":hammer: Refactoring" | ||
| label: "refactoring" | ||
| - title: ":lipstick: Style" | ||
| label: "style" | ||
| - title: ":package: Dependencies" | ||
| labels: | ||
| - "dependencies" | ||
| - "build" | ||
|
|
||
| autolabeler: | ||
| - label: 'documentation' | ||
| branch: | ||
| - '/docs{0,1}\/.+/' | ||
| - label: 'bug' | ||
| branch: | ||
| - '/fix\/.+/' | ||
| title: | ||
| - '/fix/i' | ||
| - label: 'enhancement' | ||
| branch: | ||
| - '/feat\/.+/' | ||
| body: | ||
| - '/JIRA-[0-9]{1,4}/' | ||
| - label: 'refactoring' | ||
| branch: | ||
| - '/refactor\/.+/' | ||
| title: | ||
| - '/^refactor/i' | ||
| - label: 'testing' | ||
| branch: | ||
| - '/test\/.+/' | ||
| - label: 'breaking' | ||
| title: | ||
| - '/breaking change/i' | ||
| - label: 'ci' | ||
| files: | ||
| - '.github/*' | ||
|
|
||
| template: | | ||
| ## Changes | ||
|
|
||
| $CHANGES |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| name: Labeler | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - master | ||
|
|
||
| jobs: | ||
| labeler: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Check out the repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| # Reads labels from .github/labels.yml | ||
| - name: Run Labeler | ||
| uses: crazy-max/ghaction-github-labeler@v5 | ||
| with: | ||
| skip-delete: true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| name: Release | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - release | ||
|
|
||
| jobs: | ||
| release: | ||
| runs-on: ubuntu-latest | ||
| # Do not run workflow if the triggering commit created the 'release' branch | ||
| if: ${{github.event.created}} == false | ||
| permissions: | ||
| contents: write | ||
| id-token: write | ||
| packages: write | ||
|
|
||
| steps: | ||
| - name: Create DaplaBot app token | ||
| uses: actions/create-github-app-token@v1 | ||
| id: app-token | ||
| with: | ||
| app-id: ${{ secrets.DAPLA_BOT_APP_ID }} | ||
| private-key: ${{ secrets.DAPLA_BOT_PRIVATE_KEY }} | ||
|
|
||
| - uses: actions/checkout@v4 | ||
| with: | ||
| token: ${{ steps.app-token.outputs.token }} | ||
| ref: refs/heads/master | ||
|
|
||
| - name: Set up JDK | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| java-version: 17 | ||
| distribution: temurin | ||
| cache: maven | ||
| overwrite-settings: false | ||
|
|
||
| - name: Get bot variables | ||
| id: get-bot-vars | ||
| run: | | ||
| bot_name="dapla-bot" | ||
| bot_id=$(curl -s https://api.github.com/users/${bot_name}%5Bbot%5D | jq '.id') | ||
| bot_email="${dapla_bot_id}+${bot_name}[bot]@users.noreply.github.com" | ||
|
|
||
| echo "bot_name=${bot_name}[bot]" >> $GITHUB_OUTPUT | ||
| echo "bot_email=${bot_email}" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Configure Git user | ||
| run: | | ||
| git config user.email ${{steps.get-bot-vars.outputs.bot_email}} | ||
| git config user.name ${{steps.get-bot-vars.outputs.bot_name}} | ||
|
|
||
| - name: Setup Maven authentication to GitHub packages | ||
| uses: s4u/maven-settings-action@v3.0.0 | ||
| with: | ||
| override: true | ||
| githubServer: false | ||
| servers: >- | ||
| [{"id": "github","username": "${{steps.get-bot-vars.outputs.bot_email}}","password": "${{steps.app-token.outputs.token}}", | ||
| "configuration": {"httpHeaders": {"property": {"name": "Authorization","value": "Bearer ${{ secrets.GITHUB_TOKEN }}"}}}}] | ||
|
|
||
| - name: Maven release and deploy to GitHub packages | ||
| id: release-artifact | ||
| run: | | ||
| # Get the release version from the pom.xml before the next snapshot increment | ||
| VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout | sed "s/-SNAPSHOT//") | ||
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | ||
| # Perform the release/deploy and increment the version to the next snapshot | ||
| mvn --batch-mode release:prepare -P github -Darguments="-Dmaven.test.skip=true -Dmaven.deploy.skip=true" | ||
| mvn --batch-mode release:perform | ||
| TAG=$(git describe --abbrev=0 --tags) | ||
| echo "tag=${TAG}" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Create GitHub release draft | ||
| uses: release-drafter/release-drafter@v6 | ||
| id: create-github-release | ||
| env: | ||
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| with: | ||
| tag: ${{ steps.release-artifact.outputs.tag }} | ||
|
|
||
| - name: Upload assets to GitHub release draft | ||
| env: | ||
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| run: | | ||
| ARTIFACT_ID=$(mvn help:evaluate -Dexpression=project.artifactId -q -DforceStdout) | ||
| # Get all files matching the artifact id and version (source, javadoc, etc.) | ||
| ARTIFACT_GLOB=(./target/$ARTIFACT_ID-${{ steps.release-artifact.outputs.version }}*.jar) | ||
| for file in "${ARTIFACT_GLOB[@]}"; do | ||
| echo "Uploading $file" | ||
| gh release upload ${{ steps.create-github-release.outputs.tag_name }} $file | ||
| done | ||
|
|
||
| - name: Publish GitHub release | ||
| uses: eregon/publish-release@v1 | ||
| env: | ||
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| with: | ||
| release_id: ${{ steps.create-github-release.outputs.id }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| name: Release Drafter | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - master | ||
| # pull_request event is required only for autolabeler | ||
| pull_request: | ||
| types: | ||
| - opened | ||
| - reopened | ||
| - synchronize | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| update_release_draft: | ||
| permissions: | ||
| # write permission is required to create a GitHub release | ||
| contents: write | ||
| # write permission is required for autolabeler | ||
| # otherwise, read permission is required at least | ||
| pull-requests: write | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| # Draft the next Release notes as Pull Requests are merged into main | ||
|
|
||
| - uses: release-drafter/release-drafter@v5 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
This file was deleted.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 10 days ago
In general, the fix is to add an explicit
permissionsblock that grants only the scopes required for this workflow. Thecrazy-max/ghaction-github-labeleraction manages labels via the GitHub API, which requires write access to repository metadata and read access to repository contents. A minimal, appropriate set is typicallycontents: readandmetadata: read, plusissues: writeandpull-requests: writeif labels are applied to issues/PRs. However, this particular action updates repository labels configuration, which is controlled via repository administration APIs; GitHub models that ascontents: writeis sufficient for most repo‑level write operations throughGITHUB_TOKEN. To keep the fix conservative and avoid breaking existing behavior while still complying with CodeQL’s requirement, we can safely add at leastcontents: readand, if we want to keep behavior unchanged for a label‑management workflow,contents: write. Since we are instructed not to change functionality, we should not arbitrarily reduce possible write permissions that may be in use. The cleanest, least invasive fix in the given snippet is to add apermissionsblock at the job level underlabeler:specifying at leastcontents: read. Given the action’s role (managing labels in the repo), we will setcontents: writeto avoid any risk of breaking it while still making permissions explicit.Concretely: edit
.github/workflows/labeler.ymland, underlabeler:and beforeruns-on: ubuntu-latest, insert apermissions:section withcontents: write. No imports or additional methods are needed; this is purely a YAML configuration change.