Skip to content

Use commit-headless to create signed commits from GHA #9302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 10 commits into
base: master
Choose a base branch
from
Draft

Use commit-headless to create signed commits from GHA #9302

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
b448d6a
ci: use commit-headless to create signed commits from actions
avidal Aug 1, 2025
3215bed
Merge branch 'master' into sarahchen6/update-dd-octo-sts
sarahchen6 Aug 4, 2025
5d8d682
Merge branch 'master' into sarahchen6/update-dd-octo-sts
sarahchen6 Aug 5, 2025
17d121b
Add back create-commit id
sarahchen6 Aug 5, 2025
04ea047
Delete ghcommit download
sarahchen6 Aug 5, 2025
a9a1f75
Change cloudfoundry content permissions to read
sarahchen6 Aug 5, 2025
2a47f6a
Undo - Change cloudfoundry content permissions to read
sarahchen6 Aug 5, 2025
f8587d4
Clean docker build workflow
sarahchen6 Aug 5, 2025
3e3c04f
Clean jmxfetch submodule workflow
sarahchen6 Aug 5, 2025
7744e40
Clean gradle dependencies workflow
sarahchen6 Aug 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 19 additions & 7 deletions .github/workflows/add-release-to-cloudfoundry.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
name: Add release to Cloud Foundry
on:
on:
release:
types:
- released
Expand Down Expand Up @@ -42,11 +42,23 @@ jobs:
- name: Append release to Cloud Foundry repository
run: |
echo "${{ steps.get-release-version.outputs.VERSION }}: ${{ steps.get-release-url.outputs.URL }}" >> index.yml
- name: Commit and push changes
uses: planetscale/ghcommit-action@322be9669498a4be9ce66efc1169f8f43f6bd883 # v0.2.17
- name: Commit changes
id: create-commit
run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

if [[ -z "$(git status -s)" ]]; then
echo "No changes to commit, exiting."
exit 0;
fi

git commit -a -m "chore: Add version ${{ steps.get-release-version.outputs.VERSION }} to Cloud Foundry"
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
- name: Push changes
uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
if: ${{ steps.create-commit.outputs.commit != '' }}
with:
commit_message: "chore: Add version ${{ steps.get-release-version.outputs.VERSION }} to Cloud Foundry"
repo: ${{ github.repository }}
branch: cloudfoundry
env:
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
command: push
commits: "${{ steps.create-commit.outputs.commit }}"
32 changes: 22 additions & 10 deletions .github/workflows/update-docker-build-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:
update-docker-build-image:
runs-on: ubuntu-latest
permissions:
contents: write # Required to create and push branch
contents: read
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❔ question: ‏If contents: write is no more needed, should we remove it to from add-release-to-clouldfoundry?

Copy link
Contributor Author

@sarahchen6 sarahchen6 Aug 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes it seems so! content permissions are specifically for GITHUB_TOKEN (ref), and add-release-to-cloudfoundry doesn't use this token to push anymore.

EDIT: just kidding - Since there is no use of dd-octo-sts, I think the workflow is still using GITHUB_TOKEN and needs the write permissions to push 🤔

id-token: write # Required for OIDC token federation
steps:
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
Expand All @@ -26,17 +26,9 @@ jobs:

- name: Checkout the repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Download ghcommit CLI
run: |
curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L
chmod +x /usr/local/bin/ghcommit
- name: Pick a branch name
id: define-branch
run: echo "branch=ci/update-docker-build-image-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
- name: Create branch
run: |
git checkout -b ${{ steps.define-branch.outputs.branch }}
git push -u origin ${{ steps.define-branch.outputs.branch }} --force
- name: Define the Docker build image tage to use
id: define-tag
run: |
Expand All @@ -63,7 +55,27 @@ jobs:
env:
GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
run: |
ghcommit --repository ${{ github.repository }} --branch ${{ steps.define-branch.outputs.branch }} --add .gitlab-ci.yml --message "feat(ci): Update Docker build image"
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

if [[ -z "$(git status -s)" ]]; then
echo "No changes to commit, exiting."
exit 0;
fi

git commit --message "feat(ci): Update Docker build image" .gitlab-ci.yml
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
- name: Push changes
uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
if: ${{ steps.create-commit.outputs.commit != '' }}
with:
token: "${{ steps.octo-sts.outputs.token }}"
branch: "${{ steps.define-branch.outputs.branch }}"
# for scheduled runs, sha is the tip of the default branch
# for dispatched runs, sha is the tip of the branch it was dispatched on
branch-from: "${{ github.sha }}"
command: push
commits: "${{ steps.create-commit.outputs.commit }}"
- name: Create pull request
env:
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
Expand Down
60 changes: 35 additions & 25 deletions .github/workflows/update-gradle-dependencies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-latest
name: Update Gradle dependencies
permissions:
contents: write # Required to create new branch
contents: read
id-token: write # Required for OIDC token federation
steps:
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
Expand All @@ -22,16 +22,8 @@ jobs:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
with:
submodules: "recursive"
- name: Download ghcommit CLI
run: |
curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L
chmod +x /usr/local/bin/ghcommit
- name: Pick a branch name
run: echo "BRANCH_NAME=ci/update-gradle-dependencies-$(date +'%Y%m%d')" >> $GITHUB_ENV
- name: Create branch
run: |
git checkout -b $BRANCH_NAME
git push -u origin $BRANCH_NAME --force
run: echo "branch=ci/update-gradle-dependencies-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
- name: Update Gradle dependencies
run: |
GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx3G -Xms2G'" \
Expand All @@ -42,40 +34,58 @@ jobs:
JAVA_21_HOME=$JAVA_HOME_21_X64 \
./gradlew resolveAndLockAll --write-locks --parallel --stacktrace --no-daemon --max-workers=4
- name: Commit changes
id: create-commits
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 suggestion: ‏For this part, I would recommend to get rid of the logic that create small commits (ie commit with less than 10 files) and check how the commit-headless push works for big commits.
It would simplify our workflow by only push one big commit.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I adjusted the logic for now after not finding evidence that commits are limited. However, this will need another review / pass through before merging 😅

env:
GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
BRANCH_NAME: ${{ steps.define-branch.outputs.branch }}
run: |
GH_ADD_ARGS=""
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

FILES=""
COMMITS=""
COUNT=0
# XXX: Could be replaced by ${{ github.sha }}
BRANCH_HEAD=$(git rev-parse HEAD)
for lockfile in $(git status --porcelain=v1 | awk '{ print $NF }'); do
echo "Found lockfile: $lockfile"
GH_ADD_ARGS="$GH_ADD_ARGS --add $lockfile"
FILES="$FILES $lockfile"
COUNT=$((COUNT+1))
if [ $COUNT -eq 10 ]; then
echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with $GH_ADD_ARGS"
OUTPUT=$(ghcommit --repository ${{ github.repository }} --branch $BRANCH_NAME --sha $BRANCH_HEAD $GH_ADD_ARGS --message "chore: Update Gradle dependencies" 2>&1)
echo $OUTPUT
if [[ $OUTPUT != *"Success. New commit"* ]]; then
exit 1
fi
BRANCH_HEAD=${OUTPUT##*/}
echo "ghcommit output: $OUTPUT"
GH_ADD_ARGS=""
echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with files $FILES"
git commit --no-verify --message="chore: Update Gradle dependencies" "${FILES}"
COMMITS="$COMMITS $(git rev-parse HEAD)"
FILES=""
COUNT=0
fi
done
# Check at uncommited files
echo "Checking uncommited files"
git status
# Create a PR from the created branch

# Commit any remaining files
if [ $COUNT -gt 0 ]; then
echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with $GH_ADD_ARGS"
ghcommit --repository ${{ github.repository }} --branch $BRANCH_NAME --sha $BRANCH_HEAD $GH_ADD_ARGS --message "chore: Update Gradle dependencies"
echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with $FILES"
git commit --no-verify --message="chore: Update Gradle dependencies" "${FILES}"
COMMITS="$COMMITS $(git rev-parse HEAD)"
fi

echo "Commits to push: ${COMMITS}"
echo "commits=\"${COMMITS}\"" >> $GITHUB_OUTPUT
- name: Push changes
uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
if: ${{ steps.create-commits.outputs.commits != '' }}
with:
token: "${{ steps.octo-sts.outputs.token }}"
branch: "${{ steps.define-branch.outputs.branch }}"
# for scheduled runs, sha is the tip of the default branch
# for dispatched runs, sha is the tip of the branch it was dispatched on
branch-from: "${{ github.sha }}"
command: push
commits: "${{ steps.create-commits.outputs.commits }}"
- name: Create pull request
env:
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
BRANCH_NAME: ${{ steps.define-branch.outputs.branch }}
run: |
# use echo to set a multiline body for the PR
echo -e "This PR updates the Gradle dependencies. ⚠️ Don't forget to squash commits before merging. ⚠️\n\n- [ ] Update PR title if a code change is needed to support one of those new dependencies" | \
Expand Down
47 changes: 33 additions & 14 deletions .github/workflows/update-jmxfetch-submodule.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,32 +8,51 @@ on:
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
id: octo-sts
with:
scope: ${{ github.repository }}
policy: self.update-jmxfetch-submodule.create-pr
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2

- name: Update Submodule
run: |
git submodule update --remote -- dd-java-agent/agent-jmxfetch/integrations-core
- name: Download ghcommit CLI
run: |
curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L
chmod +x /usr/local/bin/ghcommit
- name: Pick a branch name
id: define-branch
run: echo "branch=ci/update-jmxfetch-submodule-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
- name: Create branch
run: |
git checkout -b ${{ steps.define-branch.outputs.branch }}
git push -u origin ${{ steps.define-branch.outputs.branch }} --force
- name: Commit and push changes
env:
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
- name: Commit changes
id: create-commit
run: |
ghcommit --repository ${{ github.repository }} --branch ${{ steps.define-branch.outputs.branch }} --add dd-java-agent/agent-jmxfetch/integrations-core --message "Update agent-jmxfetch submodule"
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

if [[ -z "$(git status -s)" ]]; then
echo "No changes to commit, exiting."
exit 0;
fi

git commit -a -m "Update agent-jmxfetch submodule"
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
- name: Push changes
uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
if: ${{ steps.create-commit.outputs.commit != '' }}
with:
token: "${{ steps.octo-sts.outputs.token }}"
branch: "${{ steps.define-branch.outputs.branch }}"
# for scheduled runs, sha is the tip of the default branch
# for dispatched runs, sha is the tip of the branch it was dispatched on
branch-from: "${{ github.sha }}"
command: push
commits: "${{ steps.create-commit.outputs.commit }}"
- name: Create pull request
if: ${{ steps.create-commit.outputs.commit != '' }}
env:
GH_TOKEN: ${{ github.token }}
GH_TOKEN: "${{ steps.octo-sts.outputs.token }}"
run: |
gh pr create --title "Update agent-jmxfetch submodule" \
--base master \
Expand Down
Loading