ci: use commit-headless to create signed commits from actions

avidal · sarahchen6 · commit b448d6aa883e · 2025-08-04T13:32:48.000-04:00
Built on #9288
diff --git a/.github/chainguard/self.update-jmxfetch-submodule.create-pr.sts.yaml b/.github/chainguard/self.update-jmxfetch-submodule.create-pr.sts.yaml
@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:ref:refs/heads/master
+
+claim_pattern:
+  event_name: (schedule|workflow_dispatch)
+  ref: refs/heads/master
+  ref_protected: "true"
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/update-jmxfetch-submodule\.yaml@refs/heads/master
+
+permissions:
+  contents: write
+  pull_requests: write
diff --git a/.github/workflows/add-release-to-cloudfoundry.yaml b/.github/workflows/add-release-to-cloudfoundry.yaml
@@ -1,5 +1,5 @@
 name: Add release to Cloud Foundry
-on: 
+on:
   release:
     types:
       - released
@@ -42,11 +42,23 @@ jobs:
       - name: Append release to Cloud Foundry repository
         run: |
           echo "${{ steps.get-release-version.outputs.VERSION }}: ${{ steps.get-release-url.outputs.URL }}" >> index.yml
-      - name: Commit and push changes
-        uses: planetscale/ghcommit-action@322be9669498a4be9ce66efc1169f8f43f6bd883 # v0.2.17
+      - name: Commit changes
+        id: create-commit
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          if [[ -z "$(git status -s)" ]]; then
+            echo "No changes to commit, exiting."
+            exit 0;
+          fi
+
+          git commit -a -m "chore: Add version ${{ steps.get-release-version.outputs.VERSION }} to Cloud Foundry"
+          echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+      - name: Push changes
+        uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
+        if: ${{ steps.create-commit.outputs.commit != '' }}
         with:
-          commit_message: "chore: Add version ${{ steps.get-release-version.outputs.VERSION }} to Cloud Foundry"
-          repo: ${{ github.repository }}
           branch: cloudfoundry
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          command: push
+          commits: "${{ steps.create-commit.outputs.commit }}"
diff --git a/.github/workflows/update-docker-build-image.yaml b/.github/workflows/update-docker-build-image.yaml
@@ -15,7 +15,7 @@ jobs:
   update-docker-build-image:
     runs-on: ubuntu-latest
     permissions:
-      contents: write # Required to create and push branch
+      contents: read
       id-token: write # Required for OIDC token federation
     steps:
       - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
@@ -26,17 +26,9 @@ jobs:
 
       - name: Checkout the repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: Download ghcommit CLI
-        run: |
-          curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L
-          chmod +x /usr/local/bin/ghcommit
       - name: Pick a branch name
         id: define-branch
         run: echo "branch=ci/update-docker-build-image-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
-      - name: Create branch
-        run: |
-          git checkout -b ${{ steps.define-branch.outputs.branch }}
-          git push -u origin ${{ steps.define-branch.outputs.branch }} --force
       - name: Define the Docker build image tage to use
         id: define-tag
         run: |
@@ -59,11 +51,30 @@ jobs:
       - name: Update the Docker build image in GitLab CI config
         run: |
           sed -i '' -E 's|(BUILDER_IMAGE_VERSION_PREFIX:)[^#]*([#].*)|\1 "${{ steps.define-tag.outputs.tag }}-" \2|' .gitlab-ci.yml
-      - name: Commit and push changes
-        env:
-          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
+      - name: Commit changes
+        id: create-commit
         run: |
-          ghcommit --repository ${{ github.repository }} --branch ${{ steps.define-branch.outputs.branch }} --add .gitlab-ci.yml --message "feat(ci): Update Docker build image"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          if [[ -z "$(git status -s)" ]]; then
+            echo "No changes to commit, exiting."
+            exit 0;
+          fi
+
+          git commit --message "feat(ci): Update Docker build image" .gitlab-ci.yml
+          echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+      - name: Push changes
+        uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
+        if: ${{ steps.create-commit.outputs.commit != '' }}
+        with:
+          token: "${{ steps.octo-sts.outputs.token }}"
+          branch: "${{ steps.define-branch.outputs.branch }}"
+          # for scheduled runs, sha is the tip of the default branch
+          # for dispatched runs, sha is the tip of the branch it was dispatched on
+          branch-from: "${{ github.sha }}"
+          command: push
+          commits: "${{ steps.create-commit.outputs.commit }}"
       - name: Create pull request
         env:
           GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
diff --git a/.github/workflows/update-gradle-dependencies.yaml b/.github/workflows/update-gradle-dependencies.yaml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Update Gradle dependencies
     permissions:
-      contents: write # Required to create new branch
+      contents: read
       id-token: write # Required for OIDC token federation
     steps:
       - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
@@ -22,16 +22,8 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
           submodules: "recursive"
-      - name: Download ghcommit CLI
-        run: |
-          curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L
-          chmod +x /usr/local/bin/ghcommit
       - name: Pick a branch name
-        run: echo "BRANCH_NAME=ci/update-gradle-dependencies-$(date +'%Y%m%d')" >> $GITHUB_ENV
-      - name: Create branch
-        run: |
-          git checkout -b $BRANCH_NAME
-          git push -u origin $BRANCH_NAME --force
+        run: echo "branch=ci/update-gradle-dependencies-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
       - name: Update Gradle dependencies
         run: |
           GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx3G -Xms2G'" \
@@ -42,40 +34,58 @@ jobs:
           JAVA_21_HOME=$JAVA_HOME_21_X64 \
           ./gradlew resolveAndLockAll --write-locks --parallel --stacktrace --no-daemon --max-workers=4
       - name: Commit changes
+        id: create-commits
         env:
-          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
+          BRANCH_NAME: ${{ steps.define-branch.outputs.branch }}
         run: |
-          GH_ADD_ARGS=""
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          FILES=""
+          COMMITS=""
           COUNT=0
+          # XXX: Could be replaced by ${{ github.sha }}
           BRANCH_HEAD=$(git rev-parse HEAD)
           for lockfile in $(git status --porcelain=v1 | awk '{ print $NF }'); do
             echo "Found lockfile: $lockfile"
-            GH_ADD_ARGS="$GH_ADD_ARGS --add $lockfile"
+            FILES="$FILES $lockfile"
             COUNT=$((COUNT+1))
             if [ $COUNT -eq 10 ]; then
-              echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with $GH_ADD_ARGS"
-              OUTPUT=$(ghcommit --repository ${{ github.repository }} --branch $BRANCH_NAME --sha $BRANCH_HEAD $GH_ADD_ARGS --message "chore: Update Gradle dependencies" 2>&1)
-              echo $OUTPUT
-              if [[ $OUTPUT != *"Success. New commit"* ]]; then
-                exit 1
-              fi
-              BRANCH_HEAD=${OUTPUT##*/}
-              echo "ghcommit output: $OUTPUT"
-              GH_ADD_ARGS=""
+              echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with files $FILES"
+              git commit --no-verify --message="chore: Update Gradle dependencies" "${FILES}"
+              COMMITS="$COMMITS $(git rev-parse HEAD)"
+              FILES=""
               COUNT=0
             fi
           done
           # Check at uncommited files
           echo "Checking uncommited files"
           git status
-          # Create a PR from the created branch
+
+          # Commit any remaining files
           if [ $COUNT -gt 0 ]; then
-            echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with $GH_ADD_ARGS"
-            ghcommit --repository ${{ github.repository }} --branch $BRANCH_NAME --sha $BRANCH_HEAD $GH_ADD_ARGS --message "chore: Update Gradle dependencies"
+            echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with $FILES"
+            git commit --no-verify --message="chore: Update Gradle dependencies" "${FILES}"
+            COMMITS="$COMMITS $(git rev-parse HEAD)"
           fi
+
+          echo "Commits to push: ${COMMITS}"
+          echo "commits=\"${COMMITS}\"" >> $GITHUB_OUTPUT
+      - name: Push changes
+        uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
+        if: ${{ steps.create-commits.outputs.commits != '' }}
+        with:
+          token: "${{ steps.octo-sts.outputs.token }}"
+          branch: "${{ steps.define-branch.outputs.branch }}"
+          # for scheduled runs, sha is the tip of the default branch
+          # for dispatched runs, sha is the tip of the branch it was dispatched on
+          branch-from: "${{ github.sha }}"
+          command: push
+          commits: "${{ steps.create-commits.outputs.commits }}"
       - name: Create pull request
         env:
           GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
+          BRANCH_NAME: ${{ steps.define-branch.outputs.branch }}
         run: |
           # use echo to set a multiline body for the PR
           echo -e "This PR updates the Gradle dependencies. ⚠️ Don't forget to squash commits before merging. ⚠️\n\n- [ ] Update PR title if a code change is needed to support one of those new dependencies" | \
diff --git a/.github/workflows/update-jmxfetch-submodule.yaml b/.github/workflows/update-jmxfetch-submodule.yaml
@@ -8,32 +8,51 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+        id: octo-sts
+        with:
+          scope: ${{ github.repository }}
+          policy: self.update-jmxfetch-submodule.create-pr
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
-
       - name: Update Submodule
         run: |
           git submodule update --remote -- dd-java-agent/agent-jmxfetch/integrations-core
-      - name: Download ghcommit CLI
-        run: |
-          curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L
-          chmod +x /usr/local/bin/ghcommit
       - name: Pick a branch name
         id: define-branch
         run: echo "branch=ci/update-jmxfetch-submodule-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
-      - name: Create branch
-        run: |
-          git checkout -b ${{ steps.define-branch.outputs.branch }}
-          git push -u origin ${{ steps.define-branch.outputs.branch }} --force
-      - name: Commit and push changes
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+      - name: Commit changes
+        id: create-commit
         run: |
-          ghcommit --repository ${{ github.repository }} --branch ${{ steps.define-branch.outputs.branch }} --add dd-java-agent/agent-jmxfetch/integrations-core --message "Update agent-jmxfetch submodule"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          if [[ -z "$(git status -s)" ]]; then
+            echo "No changes to commit, exiting."
+            exit 0;
+          fi
+
+          git commit -a -m "Update agent-jmxfetch submodule"
+          echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+      - name: Push changes
+        uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
+        if: ${{ steps.create-commit.outputs.commit != '' }}
+        with:
+          token: "${{ steps.octo-sts.outputs.token }}"
+          branch: "${{ steps.define-branch.outputs.branch }}"
+          # for scheduled runs, sha is the tip of the default branch
+          # for dispatched runs, sha is the tip of the branch it was dispatched on
+          branch-from: "${{ github.sha }}"
+          command: push
+          commits: "${{ steps.create-commit.outputs.commit }}"
       - name: Create pull request
+        if: ${{ steps.create-commit.outputs.commit != '' }}
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: "${{ steps.octo-sts.outputs.token }}"
         run: |
           gh pr create --title "Update agent-jmxfetch submodule" \
             --base master \
