Skip to content

Commit 9320c11

Browse files
ashishdhingraGarrettBeattyphilasmar
authored
Sync master from dev (#378)
* update actions to use commit hash (#368) * Update GitHub Actions * Update GitHub Actions * ci: add sync master/dev workflow * Add dependabot configuration (#373) * Add Semgrep security scanning workflow (#376) * Add Semgrep security scanning workflow * Update semgrep-analysis.yml * chore: Pinned to v1.6.0 of aws-github-ops/handle-stale-discussions so that closed GitHub discussions are not auto-reopened. (#377) --------- Co-authored-by: Garrett Beatty <[email protected]> Co-authored-by: Phil Asmar <[email protected]>
1 parent 3ba8f4b commit 9320c11

File tree

8 files changed

+211
-10
lines changed

8 files changed

+211
-10
lines changed

‎.github/dependabot.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Set update schedule for GitHub Actions
2+
3+
version: 2
4+
updates:
5+
6+
- package-ecosystem: "github-actions"
7+
directory: "/"
8+
schedule:
9+
# Check for updates to GitHub Actions every week
10+
interval: "weekly"
11+
labels:
12+
- "Release Not Needed"
13+
target-branch: "dev"

‎.github/workflows/aws-ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,11 @@ jobs:
3636
aws-region: us-west-2
3737
- name: Run Tests on AWS
3838
id: codebuild
39-
uses: aws-actions/aws-codebuild-run-build@v1
39+
uses: aws-actions/aws-codebuild-run-build@4d15a47425739ac2296ba5e7eee3bdd4bfbdd767 #v1.0.18
4040
with:
4141
project-name: ${{ secrets.CI_TESTING_CODE_BUILD_PROJECT_NAME }}
4242
- name: CodeBuild Link
4343
shell: pwsh
4444
run: |
4545
$buildId = "${{ steps.codebuild.outputs.aws-build-id }}"
46-
echo $buildId
46+
echo $buildId

‎.github/workflows/closed-issue-message.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
auto_comment:
77
runs-on: ubuntu-latest
88
steps:
9-
- uses: aws-actions/closed-issue-message@v1
9+
- uses: aws-actions/closed-issue-message@10aaf6366131b673a7c8b7742f8b3849f1d44f18 #v2
1010
with:
1111
# These inputs are both required
1212
repo-token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/create-release-pr.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,31 +25,31 @@ jobs:
2525
steps:
2626
# Assume an AWS Role that provides access to the Access Token
2727
- name: Configure AWS Credentials
28-
uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 #v4
28+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 #v4.1.0
2929
with:
3030
role-to-assume: ${{ secrets.RELEASE_WORKFLOW_ACCESS_TOKEN_ROLE_ARN }}
3131
aws-region: us-west-2
3232
# Retrieve the Access Token from Secrets Manager
3333
- name: Retrieve secret from AWS Secrets Manager
34-
uses: aws-actions/aws-secretsmanager-get-secrets@v2
34+
uses: aws-actions/aws-secretsmanager-get-secrets@fbd65ea98e018858715f591f03b251f02b2316cb #v2.0.8
3535
with:
3636
secret-ids: |
3737
AWS_SECRET, ${{ secrets.RELEASE_WORKFLOW_ACCESS_TOKEN_NAME }}
3838
parse-json-secrets: true
3939
# Checkout a full clone of the repo
4040
- name: Checkout
41-
uses: actions/checkout@v4
41+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
4242
with:
4343
fetch-depth: '0'
4444
token: ${{ env.AWS_SECRET_TOKEN }}
4545
# Install .NET8 which is needed for AutoVer
4646
- name: Setup .NET 8.0
47-
uses: actions/setup-dotnet@v4
47+
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 #v4.3.1
4848
with:
4949
dotnet-version: 8.0.x
5050
# Install AutoVer to automate versioning and changelog creation
5151
- name: Install AutoVer
52-
run: dotnet tool install --global AutoVer --version 0.0.24
52+
run: dotnet tool install --global AutoVer --version 0.0.25
5353
# Set up a git user to be able to run git commands later on
5454
- name: Setup Git User
5555
run: |

‎.github/workflows/handle-stale-discussions.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,6 @@ jobs:
1313
discussions: write
1414
steps:
1515
- name: Stale discussions action
16-
uses: aws-github-ops/handle-stale-discussions@v1
16+
uses: aws-github-ops/handle-stale-discussions@c0beee451a5d33d9c8f048a6d4e7c856b5422544 #v1.6.0
1717
env:
1818
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

‎.github/workflows/semgrep-analysis.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Semgrep
2+
3+
on:
4+
# Scan changed files in PRs, block on new issues only (existing issues ignored)
5+
pull_request:
6+
7+
push:
8+
branches: ["dev", "master"]
9+
10+
schedule:
11+
- cron: '23 20 * * 1'
12+
13+
# Manually trigger the workflow
14+
workflow_dispatch:
15+
16+
jobs:
17+
semgrep:
18+
name: Scan
19+
permissions:
20+
security-events: write
21+
runs-on: ubuntu-latest
22+
container:
23+
image: returntocorp/semgrep
24+
# Skip any PR created by dependabot to avoid permission issues
25+
if: (github.actor != 'dependabot[bot]')
26+
steps:
27+
# Fetch project source
28+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
29+
30+
- run: semgrep ci --sarif > semgrep.sarif
31+
env:
32+
SEMGREP_RULES: >- # more at semgrep.dev/explore
33+
p/security-audit
34+
p/secrets
35+
p/owasp-top-ten
36+
37+
- name: Upload SARIF file for GitHub Advanced Security Dashboard
38+
uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 #v3.28.16
39+
with:
40+
sarif_file: semgrep.sarif
41+
if: always()

‎.github/workflows/stale_issues.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
runs-on: ubuntu-latest
1111
name: Stale issue job
1212
steps:
13-
- uses: aws-actions/stale-issue-cleanup@v6
13+
- uses: aws-actions/stale-issue-cleanup@5650b49bcd757a078f6ca06c373d7807b773f9bc #v7.1.0
1414
with:
1515
# Setting messages to an empty string will cause the automation to skip
1616
# that category

‎.github/workflows/sync-master-dev.yml‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
# This GitHub Workflow is designed to run automatically after the Release PR, which was created by the `Create Release PR` workflow, is closed.
2+
# This workflow has 2 jobs. One will run if the `Release PR` is successfully merged, indicating that a release should go out.
3+
# The other will run if the `Release PR` was closed and a release is not intended to go out.
4+
name: Sync 'dev' and 'master'
5+
6+
# The workflow will automatically be triggered when any PR is closed.
7+
on:
8+
pull_request:
9+
types: [closed]
10+
11+
permissions:
12+
contents: write
13+
id-token: write
14+
15+
jobs:
16+
# This job will check if the PR was successfully merged, it's source branch is `releases/next-release` and target branch is `dev`.
17+
# This indicates that the merged PR was the `Release PR`.
18+
# This job will synchronize `dev` and `master`, create a GitHub Release and delete the `releases/next-release` branch.
19+
sync-dev-and-master:
20+
name: Sync dev and master
21+
if: |
22+
github.event.pull_request.merged == true &&
23+
github.event.pull_request.head.ref == 'releases/next-release' &&
24+
github.event.pull_request.base.ref == 'dev'
25+
runs-on: ubuntu-latest
26+
steps:
27+
# Assume an AWS Role that provides access to the Access Token
28+
- name: Configure AWS Credentials
29+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 #v4.1.0
30+
with:
31+
role-to-assume: ${{ secrets.RELEASE_WORKFLOW_ACCESS_TOKEN_ROLE_ARN }}
32+
aws-region: us-west-2
33+
# Retrieve the Access Token from Secrets Manager
34+
- name: Retrieve secret from AWS Secrets Manager
35+
uses: aws-actions/aws-secretsmanager-get-secrets@fbd65ea98e018858715f591f03b251f02b2316cb #v2.0.8
36+
with:
37+
secret-ids: |
38+
AWS_SECRET, ${{ secrets.RELEASE_WORKFLOW_ACCESS_TOKEN_NAME }}
39+
parse-json-secrets: true
40+
# Checkout a full clone of the repo
41+
- name: Checkout code
42+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
43+
with:
44+
ref: dev
45+
fetch-depth: 0
46+
token: ${{ env.AWS_SECRET_TOKEN }}
47+
# Install .NET9 which is needed for AutoVer
48+
- name: Setup .NET 9.0
49+
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 #v4.3.1
50+
with:
51+
dotnet-version: 9.0.x
52+
# Install AutoVer which is needed to retrieve information about the current release.
53+
- name: Install AutoVer
54+
run: dotnet tool install --global AutoVer --version 0.0.25
55+
# Set up a git user to be able to run git commands later on
56+
- name: Setup Git User
57+
run: |
58+
git config --global user.email "[email protected]"
59+
git config --global user.name "aws-sdk-dotnet-automation"
60+
# Retrieve the release name which is needed for the GitHub Release
61+
- name: Read Release Name
62+
id: read-release-name
63+
run: |
64+
version=$(autover changelog --release-name)
65+
echo "VERSION=$version" >> $GITHUB_OUTPUT
66+
# Retrieve the tag name which is needed for the GitHub Release
67+
- name: Read Tag Name
68+
id: read-tag-name
69+
run: |
70+
tag=$(autover changelog --tag-name)
71+
echo "TAG=$tag" >> $GITHUB_OUTPUT
72+
# Retrieve the changelog which is needed for the GitHub Release
73+
- name: Read Changelog
74+
id: read-changelog
75+
run: |
76+
changelog=$(autover changelog --output-to-console)
77+
echo "CHANGELOG<<EOF"$'\n'"$changelog"$'\n'EOF >> "$GITHUB_OUTPUT"
78+
# Merge dev into master in order to synchronize the 2 branches
79+
- name: Merge dev to master
80+
run: |
81+
git fetch origin
82+
git checkout master
83+
git merge dev
84+
git push origin master
85+
# Create the GitHub Release
86+
- name: Create GitHub Release
87+
env:
88+
GITHUB_TOKEN: ${{ env.AWS_SECRET_TOKEN }}
89+
run: |
90+
gh release create "${{ steps.read-tag-name.outputs.TAG }}" --title "${{ steps.read-release-name.outputs.VERSION }}" --notes "${{ steps.read-changelog.outputs.CHANGELOG }}"
91+
# Delete the `releases/next-release` branch
92+
- name: Clean up
93+
run: |
94+
git fetch origin
95+
if git ls-remote --exit-code --heads origin releases/next-release > /dev/null; then
96+
echo "Branch 'releases/next-release' exists on origin. Deleting..."
97+
git push origin --delete releases/next-release
98+
else
99+
echo "Branch 'releases/next-release' does not exist on origin, skipping deletion."
100+
fi
101+
# This job will check if the PR was closed, it's source branch is `releases/next-release` and target branch is `dev`.
102+
# This indicates that the closed PR was the `Release PR`.
103+
# This job will delete the tag created by AutoVer and the release branch.
104+
clean-up-closed-release:
105+
name: Clean up closed release
106+
if: |
107+
github.event.pull_request.merged == false &&
108+
github.event.pull_request.head.ref == 'releases/next-release' &&
109+
github.event.pull_request.base.ref == 'dev'
110+
runs-on: ubuntu-latest
111+
steps:
112+
# Checkout a full clone of the repo
113+
- name: Checkout code
114+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
115+
with:
116+
ref: releases/next-release
117+
fetch-depth: 0
118+
# Install .NET9 which is needed for AutoVer
119+
- name: Setup .NET 9.0
120+
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 #v4.3.1
121+
with:
122+
dotnet-version: 9.0.x
123+
# Install AutoVer which is needed to retrieve information about the current release.
124+
- name: Install AutoVer
125+
run: dotnet tool install --global AutoVer --version 0.0.25
126+
# Set up a git user to be able to run git commands later on
127+
- name: Setup Git User
128+
run: |
129+
git config --global user.email "[email protected]"
130+
git config --global user.name "aws-sdk-dotnet-automation"
131+
# Retrieve the tag name to be deleted
132+
- name: Read Tag Name
133+
id: read-tag-name
134+
run: |
135+
tag=$(autover changelog --tag-name)
136+
echo "TAG=$tag" >> $GITHUB_OUTPUT
137+
# Delete the tag created by AutoVer and the release branch
138+
- name: Clean up
139+
run: |
140+
git fetch origin
141+
git push --delete origin ${{ steps.read-tag-name.outputs.TAG }}
142+
if git ls-remote --exit-code --heads origin releases/next-release > /dev/null; then
143+
echo "Branch 'releases/next-release' exists on origin. Deleting..."
144+
git push origin --delete releases/next-release
145+
else
146+
echo "Branch 'releases/next-release' does not exist on origin, skipping deletion."
147+
fi

0 commit comments

Comments
 (0)