GitHub action sync (#592)

sync'ing with latest in https://github.com/trask/repository-practices

Author: trask

.github/scripts/draft-change-log-entries.sh

@@ -24,15 +24,18 @@ else
 fi
 
 declare -A component_names=()
-component_names["aws-resources/"]="AWS Resources"
-component_names["aws-xray/"]="AWS X-Ray SDK Support"
-component_names["aws-xray-propagator/"]="AWS X-Ray Propagator"
+component_names["aws-resources/"]="AWS resources"
+component_names["aws-xray/"]="AWS X-Ray SDK support"
+component_names["aws-xray-propagator/"]="AWS X-Ray propagator"
 component_names["consistent-sampling/"]="Consistent sampling"
+component_names["jfr-events/"]="JFR events"
 component_names["jfr-streaming/"]="JFR streaming"
 component_names["jmx-metrics/"]="JMX metrics"
 component_names["maven-extension/"]="Maven extension"
 component_names["micrometer-meter-provider/"]="Micrometer MeterProvider"
+component_names["noop-api/"]="No-op API"
 component_names["runtime-attach/"]="Runtime attach"
+component_names["resource-providers/"]="Resource providers"
 component_names["samplers/"]="Samplers"
 component_names["static-instrumenter/"]="Static instrumenter"
 
@@ -41,10 +44,17 @@ echo
 
 for component in */ ; do
   component_name=${component_names[$component]:=$component}
-  echo "### $component_name"
-  echo
-  git log --reverse --pretty=format:"- %s" $range $component \
-    | sed -r 's,\(#([0-9]+)\),\n  ([#\1](https://github.com/open-telemetry/opentelemetry-java-contrib/pull/\1)),'
-  echo
-  echo
+  commits=$(git log --reverse \
+          --perl-regexp \
+          --author='^(?!dependabot\[bot\] )' \
+          --pretty=format:"- %s" \
+          "$range" \
+          "$component")
+  if [[ "$commits" != "" ]]; then
+    echo "### $component_name"
+    echo
+    echo "$commits" \
+      | sed -E 's,\(#([0-9]+)\)$,\n  ([#\1](https://github.com/open-telemetry/opentelemetry-java-contrib/pull/\1)),'
+    echo
+  fi
 done

.github/scripts/merge-change-log-after-release.sh

@@ -0,0 +1,44 @@
+#!/bin/bash -e
+
+# this script merges release notes for $VERSION into CHANGELOG.md
+# the release date for $VERSION should be available in $RELEASE_DATE
+# and the release notes for $VERSION should be available in /tmp/changelog-section.md
+
+if [[ $VERSION =~ ^[0-9]+\.[0-9]+\.0 ]]; then
+  # this was not a patch release, so the version exists already in the CHANGELOG.md
+
+  # update the release date
+  sed -Ei "s/## Version $VERSION .*/## Version $VERSION ($RELEASE_DATE)/" CHANGELOG.md
+
+  # the entries are copied over from the release branch to support workflows
+  # where change log entries may be updated after preparing the release branch
+
+  {
+    # copy the portion above the release, up to and including the heading
+    sed -n "0,/^## Version $VERSION /p" CHANGELOG.md
+    # copy the release notes for $VERSION
+    cat /tmp/changelog-section.md
+    # copy the portion below the release
+    sed -n "0,/^## Version $VERSION /d;0,/^## Version /{/^## Version/!d};p" CHANGELOG.md
+  } > /tmp/CHANGELOG.md
+
+  # update the real CHANGELOG.md
+  cp /tmp/CHANGELOG.md CHANGELOG.md
+
+else
+  # this was a patch release, so the version does not exist already in the CHANGELOG.md
+
+  {
+    # copy the portion above the top-most release, not including the heading
+    sed -n "0,/^## Version /{ /^## Version /!p }" CHANGELOG.md
+    # add the heading
+    echo "## Version $VERSION ($RELEASE_DATE)"
+    # copy the release notes for $VERSION
+    cat /tmp/changelog-section.md
+    # copy the portion starting from the top-most release
+    sed -n "/^## Version /,\$p" CHANGELOG.md
+  } > /tmp/CHANGELOG.md
+
+  # update the real CHANGELOG.md
+  cp /tmp/CHANGELOG.md CHANGELOG.md
+fi

.github/workflows/backport.yml

@@ -28,16 +28,16 @@ jobs:
         env:
           NUMBER: ${{ github.event.inputs.number }}
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GH_TOKEN: ${{ secrets.BOT_TOKEN }}
         run: |
           commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
           title=$(gh pr view $NUMBER --json title --jq .title)
 
           branch="opentelemetrybot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
 
+          git checkout -b $branch
           git cherry-pick $commit
-          git push origin HEAD:$branch
+          git push --set-upstream origin $branch
           gh pr create --title "[$GITHUB_REF_NAME] $title" \
                        --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
-                       --head $branch \
                        --base $GITHUB_REF_NAME

.github/workflows/build.yml

@@ -62,13 +62,12 @@ jobs:
           path: jmx-metrics/build/reports/tests/integrationTest
 
   markdown-link-check:
-    # release branches are excluded to avoid unnecessary maintenance if external links break
-    if: ${{ !startsWith(github.ref_name, 'release/') }}
+    # release branches are excluded to avoid unnecessary maintenance
+    if: "!startsWith(github.ref_name, 'release/')"
     uses: ./.github/workflows/reusable-markdown-link-check.yml
 
   misspell-check:
-    # release branches are excluded to avoid unnecessary maintenance if new misspellings are added
-    # to the misspell dictionary
+    # release branches are excluded to avoid unnecessary maintenance
     if: ${{ !startsWith(github.ref_name, 'release/') }}
     uses: ./.github/workflows/reusable-misspell-check.yml
 
@@ -111,15 +110,13 @@ jobs:
           GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
 
   required-status-check:
+    # markdown-link-check is not required so pull requests are not blocked if external links break
+    # misspell-check is not required so pull requests are not blocked if new misspellings are added
     needs:
-      # markdown-link-check is not required so that pull requests will not be blocked if external
-      # links break
-      # similarly misspell-check is not required so that pull requests will not be blocked if new
-      # misspellings are added to the misspell dictionary
       - build
       - integration-test
-    runs-on: ubuntu-latest
     if: always()
+    runs-on: ubuntu-latest
     steps:
       - if: |
           needs.build.result != 'success' ||

.github/workflows/codeql-daily.yml

@@ -2,6 +2,7 @@ name: CodeQL (daily)
 
 on:
   schedule:
+    # Daily at 01:30 (UTC)
     - cron: '30 1 * * *'
   workflow_dispatch:
 
@@ -33,6 +34,7 @@ jobs:
 
   open-issue-on-failure:
     # open an issue on failure because it can be easy to miss CI failure notifications
-    needs: analyze
-    if: failure()
+    needs:
+      - analyze
+    if: failure() && github.run_attempt == 1
     uses: ./.github/workflows/reusable-open-issue-on-failure.yml

.github/workflows/prepare-patch-release.yml

@@ -45,14 +45,14 @@ jobs:
       - name: Create pull request
         env:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GH_TOKEN: ${{ secrets.BOT_TOKEN }}
         run: |
           message="Prepare release $VERSION"
           branch="opentelemetrybot/prepare-release-${VERSION}"
 
+          git checkout -b $branch
           git commit -a -m "$message"
-          git push origin HEAD:$branch
+          git push --set-upstream origin $branch
           gh pr create --title "[$GITHUB_REF_NAME] $message" \
                        --body "$message." \
-                       --head $branch \
                        --base $GITHUB_REF_NAME

.github/workflows/prepare-release-branch.yml

@@ -8,7 +8,8 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - run: |
+      - name: Verify prerequisites
+        run: |
           if [[ $GITHUB_REF_NAME != main ]]; then
             echo this workflow should only be run against main
             exit 1
@@ -21,7 +22,8 @@ jobs:
 
   create-pull-request-against-release-branch:
     runs-on: ubuntu-latest
-    needs: prereqs
+    needs:
+      - prereqs
     steps:
       - uses: actions/checkout@v3
 
@@ -55,21 +57,22 @@ jobs:
       - name: Create pull request against the release branch
         env:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GH_TOKEN: ${{ secrets.BOT_TOKEN }}
         run: |
           message="Prepare release $VERSION"
           branch="opentelemetrybot/prepare-release-${VERSION}"
 
+          git checkout -b $branch
           git commit -a -m "$message"
-          git push origin HEAD:$branch
+          git push --set-upstream origin $branch
           gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
                        --body "$message." \
-                       --head $branch \
                        --base $RELEASE_BRANCH_NAME
 
   create-pull-request-against-main:
     runs-on: ubuntu-latest
-    needs: prereqs
+    needs:
+      - prereqs
     steps:
       - uses: actions/checkout@v3
 
@@ -103,15 +106,15 @@ jobs:
       - name: Create pull request against main
         env:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GH_TOKEN: ${{ secrets.BOT_TOKEN }}
         run: |
           message="Update version to $NEXT_VERSION"
           body="Update version to \`$NEXT_VERSION\`."
           branch="opentelemetrybot/update-version-to-${NEXT_VERSION}"
 
+          git checkout -b $branch
           git commit -a -m "$message"
-          git push origin HEAD:$branch
+          git push --set-upstream origin $branch
           gh pr create --title "$message" \
                        --body "$body" \
-                       --head $branch \
                        --base main