Skip to content

Commit c2560c4

Browse files
sarahchen6sarahchen6
authored
Add pin system tests workflow (#10173)
* Add pin system tests workflow * Add testing trigger * Try peter-evans/create-pull-request * Revert "Try peter-evans/create-pull-request" This reverts commit 2a2a8ea. * Hard code release base branch * Create and push branch in one step * Make draft * Missing slash * Change workflow trigger to release branch creation * Refine trust policy
1 parent 1ad22e7 commit c2560c4

File tree

2 files changed

+111
-4
lines changed

2 files changed

+111
-4
lines changed

‎.github/chainguard/self.pin-system-tests.create-pr.sts.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
issuer: https://token.actions.githubusercontent.com
22

3-
subject_pattern: repo:DataDog/dd-trace-java:ref:refs/heads/.+
3+
subject_pattern: repo:DataDog/dd-trace-java:ref:refs/heads/(master|test/v.+)
44

55
claim_pattern:
6-
event_name: (push|workflow_dispatch)
7-
ref: refs/heads/.+
8-
job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/pin-system-tests\.yaml@refs/heads/.+
6+
event_name: (create|workflow_dispatch)
7+
ref: refs/heads/(master|test/v.+)
8+
job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/pin-system-tests\.yaml@refs/heads/(master|test/v.+)
99

1010
permissions:
1111
contents: write

‎.github/workflows/pin-system-tests.yaml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: Pin system tests
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
tag:
7+
description: 'The minor release branch name (e.g. release/v1.54.x)'
8+
required: true
9+
type: string
10+
# run workflow when a release branch is created
11+
create:
12+
13+
jobs:
14+
pin-system-tests:
15+
name: "Pin system tests"
16+
# CHANGE BACK TO release/v*
17+
if: github.event_name != 'create' || startsWith(github.ref, 'refs/heads/test/v')
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: write # may not be needed
21+
id-token: write # Required for OIDC token federation
22+
steps:
23+
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
24+
id: octo-sts
25+
with:
26+
scope: DataDog/dd-trace-java
27+
policy: self.pin-system-tests.create-pr
28+
29+
- name: Checkout the repository
30+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
31+
32+
- name: Define branch name
33+
id: define-branch
34+
run: echo "branch=ci/pin-system-tests-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
35+
36+
- name: Check if branch already exists
37+
id: check-branch
38+
run: |
39+
BRANCH=${{ steps.define-branch.outputs.branch }}
40+
if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
41+
echo "creating_new_branch=false" >> "$GITHUB_OUTPUT"
42+
echo "Branch $BRANCH already exists - please delete it and re-run the workflow."
43+
exit 0
44+
else
45+
echo "creating_new_branch=true" >> "$GITHUB_OUTPUT"
46+
echo "Branch $BRANCH does not exist - creating it now"
47+
fi
48+
49+
- name: Update system-tests references to latest commit SHA on main
50+
run: ./tooling/update_system_test_reference.sh
51+
52+
- name: Check if changes should be committed
53+
id: check-changes
54+
run: |
55+
if [[ -z "$(git status -s)" ]]; then
56+
echo "No changes to commit, exiting."
57+
echo "commit_changes=false" >> "$GITHUB_OUTPUT"
58+
exit 0
59+
else
60+
echo "commit_changes=true" >> "$GITHUB_OUTPUT"
61+
echo "Changes to commit:"
62+
git status -s
63+
fi
64+
65+
- name: Commit changes
66+
if: steps.check-changes.outputs.commit_changes == 'true'
67+
id: create-commit
68+
run: |
69+
git config user.name "github-actions[bot]"
70+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
71+
git commit -m "chore: Pin system-tests for release branch" .github/workflows/run-system-tests.yaml
72+
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
73+
74+
- name: Push changes
75+
uses: DataDog/commit-headless@5a0f3876e0fbdd3a86b3e008acf4ec562db59eee # action/v2.0.1
76+
if: steps.check-changes.outputs.commit_changes == 'true' && steps.check-branch.outputs.creating_new_branch == 'true'
77+
with:
78+
token: "${{ steps.octo-sts.outputs.token }}"
79+
branch: "${{ steps.define-branch.outputs.branch }}"
80+
head-sha: "${{ github.sha }}"
81+
create-branch: true
82+
command: push
83+
commits: "${{ steps.create-commit.outputs.commit }}"
84+
85+
- name: Define base branch
86+
id: define-base-branch
87+
run: |
88+
if [[ -n "${{ github.event.inputs.tag }}" ]]; then
89+
BASE_BRANCH=${{ github.event.inputs.tag }}
90+
else
91+
BASE_BRANCH=${GITHUB_REF#refs/heads/}
92+
fi
93+
echo "base_branch=${BASE_BRANCH}" >> $GITHUB_OUTPUT
94+
95+
- name: Create pull request
96+
if: steps.check-changes.outputs.commit_changes == 'true' && steps.check-branch.outputs.creating_new_branch == 'true'
97+
env:
98+
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
99+
# REMOVE DRAFT
100+
run: |
101+
gh pr create --title "Pin system tests for release branch" \
102+
--base ${{ steps.define-base-branch.outputs.base_branch }} \
103+
--head ${{ steps.define-branch.outputs.branch }} \
104+
--label "tag: dependencies" \
105+
--label "tag: no release notes" \
106+
--body "This PR pins the system-tests reference for the release branch." \
107+
--draft

0 commit comments

Comments
 (0)