Skip to content

Commit 94d5ec2

Browse files
nirinchevnirinchev
authored
chore(ci): use github app instead of bot user (#492)
* chore(ci): use github app instead of bot user * Cleanup
1 parent d9db8b5 commit 94d5ec2

File tree

5 files changed

+119
-140
lines changed

5 files changed

+119
-140
lines changed

‎.github/workflows/bump-packages.yaml

Lines changed: 12 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -10,25 +10,27 @@ jobs:
1010
name: Bump packages
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v3
13+
- uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
14+
id: app-token
15+
with:
16+
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
17+
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
18+
19+
- uses: actions/checkout@v4
1420
with:
1521
# don't checkout a detatched HEAD
1622
ref: ${{ github.head_ref }}
23+
token: ${{ steps.app-token.outputs.token }}
1724

1825
# this is important so git log can pick up on
1926
# the whole history to generate the list of AUTHORS
20-
fetch-depth: '0'
21-
22-
- name: Setup git
23-
run: |
24-
git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
25-
git config --local user.name "github-actions[bot]"
27+
fetch-depth: "0"
2628

2729
- name: Setup Node.js
28-
uses: actions/setup-node@v3
30+
uses: actions/setup-node@v4
2931
with:
3032
node-version: 20.x
31-
cache: 'npm'
33+
cache: "npm"
3234

3335
- name: Install npm
3436
run: npm install -g npm@8
@@ -46,21 +48,4 @@ jobs:
4648
npm run bump-packages
4749
git add .
4850
git commit --no-allow-empty -m "chore(ci): bump packages" || true
49-
50-
- name: Create Pull Request
51-
id: cpr
52-
uses: peter-evans/create-pull-request@v6
53-
with:
54-
commit-message: 'chore(ci): bump packages'
55-
branch: ci/bump-packages
56-
title: 'chore(ci): bump packages'
57-
body: |
58-
- Bump package versions
59-
60-
- name: Merge PR
61-
if: ${{steps.cpr.outputs.pull-request-operation == 'created'}}
62-
env:
63-
PULL_REQUEST_NUMBER: ${{steps.cpr.outputs.pull-request-number}}
64-
GITHUB_TOKEN: ${{secrets.PAT}}
65-
run: |
66-
gh pr merge $PULL_REQUEST_NUMBER --squash --delete-branch
51+
git push

‎.github/workflows/check-test.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,25 +46,25 @@ jobs:
4646

4747
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
4848
- name: Checkout
49-
uses: actions/checkout@v2
49+
uses: actions/checkout@v4
5050
with:
5151
fetch-depth: 0
5252

5353
- name: Setup Node.js
54-
uses: actions/setup-node@v3
54+
uses: actions/setup-node@v4
5555
with:
5656
node-version: 20.x
57-
cache: 'npm'
57+
cache: "npm"
5858

5959
- name: Install npm
6060
run: npm install -g npm@8
6161

6262
- name: Use [email protected]
6363
# Default Python (3.12) doesn't have support for distutils
6464
# https://github.com/nodejs/node-gyp/issues/2869
65-
uses: actions/setup-python@v4
65+
uses: actions/setup-python@v5
6666
with:
67-
python-version: '3.11'
67+
python-version: "3.11"
6868

6969
- name: Install Dependencies
7070
run: |

‎.github/workflows/codeql.yml

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ name: "CodeQL"
1313

1414
on:
1515
push:
16-
branches: [ "main" ]
16+
branches: ["main"]
1717
pull_request:
1818
# The branches below must be a subset of the branches above
19-
branches: [ "main" ]
19+
branches: ["main"]
2020
schedule:
21-
- cron: '30 14 * * 4'
21+
- cron: "30 14 * * 4"
2222

2323
jobs:
2424
analyze:
@@ -33,53 +33,53 @@ jobs:
3333
strategy:
3434
fail-fast: false
3535
matrix:
36-
language: [ 'javascript-typescript' ]
36+
language: ["javascript-typescript"]
3737
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
3838
# Use only 'java' to analyze code written in Java, Kotlin or both
3939
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
4040
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
4141

4242
steps:
43-
- name: Checkout repository
44-
uses: actions/checkout@v3
43+
- name: Checkout repository
44+
uses: actions/checkout@v4
4545

46-
# Initializes the CodeQL tools for scanning.
47-
- name: Initialize CodeQL
48-
uses: github/codeql-action/init@v2
49-
with:
50-
languages: ${{ matrix.language }}
51-
# If you wish to specify custom queries, you can do so here or in a config file.
52-
# By default, queries listed here will override any specified in a config file.
53-
# Prefix the list here with "+" to use these queries and those in the config file.
46+
# Initializes the CodeQL tools for scanning.
47+
- name: Initialize CodeQL
48+
uses: github/codeql-action/init@v2
49+
with:
50+
languages: ${{ matrix.language }}
51+
# If you wish to specify custom queries, you can do so here or in a config file.
52+
# By default, queries listed here will override any specified in a config file.
53+
# Prefix the list here with "+" to use these queries and those in the config file.
5454

55-
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
56-
# queries: security-extended,security-and-quality
57-
config: |
58-
paths-ignore:
59-
- '**/*.test.js'
60-
- '**/*.spec.js'
61-
- '**/*.test.ts'
62-
- '**/*.spec.ts'
63-
- '**/*.test.tsx'
64-
- '**/*.spec.tsx'
65-
- 'scripts/**'
55+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
56+
# queries: security-extended,security-and-quality
57+
config: |
58+
paths-ignore:
59+
- '**/*.test.js'
60+
- '**/*.spec.js'
61+
- '**/*.test.ts'
62+
- '**/*.spec.ts'
63+
- '**/*.test.tsx'
64+
- '**/*.spec.tsx'
65+
- 'scripts/**'
6666
67-
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
68-
# If this step fails, then you should remove it and run the build manually (see below)
69-
- name: Autobuild
70-
uses: github/codeql-action/autobuild@v2
67+
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
68+
# If this step fails, then you should remove it and run the build manually (see below)
69+
- name: Autobuild
70+
uses: github/codeql-action/autobuild@v2
7171

72-
# ℹ️ Command-line programs to run using the OS shell.
73-
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
72+
# ℹ️ Command-line programs to run using the OS shell.
73+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
7474

75-
# If the Autobuild fails above, remove it and uncomment the following three lines.
76-
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
75+
# If the Autobuild fails above, remove it and uncomment the following three lines.
76+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
7777

78-
# - run: |
79-
# echo "Run, Build Application using script"
80-
# ./location_of_script_within_repo/buildscript.sh
78+
# - run: |
79+
# echo "Run, Build Application using script"
80+
# ./location_of_script_within_repo/buildscript.sh
8181

82-
- name: Perform CodeQL Analysis
83-
uses: github/codeql-action/analyze@v2
84-
with:
85-
category: "/language:${{matrix.language}}"
82+
- name: Perform CodeQL Analysis
83+
uses: github/codeql-action/analyze@v2
84+
with:
85+
category: "/language:${{matrix.language}}"

‎.github/workflows/publish-packages.yaml

Lines changed: 43 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -18,45 +18,46 @@ jobs:
1818
runs-on: ubuntu-latest
1919

2020
steps:
21-
- uses: actions/checkout@v3
22-
with:
23-
# don't checkout a detatched HEAD
24-
ref: ${{ github.head_ref }}
25-
26-
# this is important so git log has the whole history
27-
fetch-depth: '0'
28-
29-
- name: Setup git
30-
run: |
31-
git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
32-
git config --local user.name "github-actions[bot]"
33-
34-
- name: Setup Node.js
35-
uses: actions/setup-node@v3
36-
with:
37-
node-version: 20.x
38-
cache: 'npm'
39-
40-
- name: Install npm
41-
run: npm install -g npm@8
42-
43-
- name: Install Dependencies
44-
run: |
45-
npm run bootstrap-ci
46-
shell: bash
47-
48-
- name: "Publish what is not already in NPM"
49-
env:
50-
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
51-
run: |
52-
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
53-
git update-index --assume-unchanged .npmrc
54-
npm run publish-packages
55-
56-
- name: "Publish tags"
57-
run: |
58-
npx lerna list -a --json | \
59-
jq -r '.[] | .name + "@" + .version' | \
60-
xargs -i sh -c "git tag -a {} -m {} || true"
61-
git push --follow-tags
62-
21+
- uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
22+
id: app-token
23+
with:
24+
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
25+
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
26+
27+
- uses: actions/checkout@v4
28+
with:
29+
# don't checkout a detatched HEAD
30+
ref: ${{ github.head_ref }}
31+
token: ${{ steps.app-token.outputs.token }}
32+
33+
# this is important so git log has the whole history
34+
fetch-depth: "0"
35+
36+
- name: Setup Node.js
37+
uses: actions/setup-node@v4
38+
with:
39+
node-version: 20.x
40+
cache: "npm"
41+
42+
- name: Install npm
43+
run: npm install -g npm@8
44+
45+
- name: Install Dependencies
46+
run: |
47+
npm run bootstrap-ci
48+
shell: bash
49+
50+
- name: "Publish what is not already in NPM"
51+
env:
52+
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
53+
run: |
54+
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
55+
git update-index --assume-unchanged .npmrc
56+
npm run publish-packages
57+
58+
- name: "Publish tags"
59+
run: |
60+
npx lerna list -a --json | \
61+
jq -r '.[] | .name + "@" + .version' | \
62+
xargs -i sh -c "git tag -a {} -m {} || true"
63+
git push --follow-tags

‎.github/workflows/update-cidrs.yaml

Lines changed: 19 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -11,42 +11,35 @@ jobs:
1111
name: Update automatically generated files
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: actions/checkout@v3
15-
- uses: actions/setup-node@v3
14+
- uses: actions/create-github-app-token@v1
15+
id: app-token
1616
with:
17-
node-version: ^18.x
18-
cache: 'npm'
17+
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
18+
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}
1919

20-
- name: Install npm@8
21-
run: |
22-
npm install -g npm@8
20+
- uses: actions/checkout@v4
21+
with:
22+
# don't checkout a detatched HEAD
23+
ref: ${{ github.head_ref }}
24+
token: ${{ steps.app-token.outputs.token }}
25+
26+
- uses: actions/setup-node@v4
27+
with:
28+
node-version: ^20.x
29+
cache: "npm"
2330

2431
- name: Install Dependencies
2532
run: |
2633
npm -v
27-
npm i
34+
npm ci
2835
# make sure precommit.js is compiled
2936
npm run bootstrap-ci -- --scope @mongodb-js/monorepo-tools --stream --include-dependencies
3037
3138
- name: Update cidrs.json
3239
run: npm run -w packages/mongodb-cloud-info update-cidrs
3340

34-
- name: Create Pull Request
35-
id: cpr
36-
uses: peter-evans/create-pull-request@v6
37-
with:
38-
commit-message: Update report
39-
branch: ci/update-cidrs
40-
title: 'chore: update cidrs.json'
41-
add-paths: |
42-
resources/cidrs.json
43-
body: |
44-
- Update `cidrs.json`
45-
46-
- name: Merge PR
47-
env:
48-
PULL_REQUEST_NUMBER: ${{steps.cpr.outputs.pull-request-number}}
49-
# NOTE: we don't use a PAT so to not trigger further automation
50-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
41+
- name: Commit and push
5142
run: |
52-
gh pr merge $PULL_REQUEST_NUMBER --squash --delete-branch
43+
git add resources/cidrs.json
44+
git commit --no-allow-empty -m "chore: update cidrs.json [skip ci]" || true
45+
git push

0 commit comments

Comments
 (0)