Skip to content

Commit 8939a5c

Browse files
Raj-StepSecurityRaj-StepSecurity
committed
cherry-picked manually
1 parent 304e384 commit 8939a5c

File tree

16 files changed

+348
-61
lines changed

16 files changed

+348
-61
lines changed

‎.editorconfig‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
indent_style = space
6+
indent_size = 4
7+
insert_final_newline = true
8+
trim_trailing_whitespace = true
9+
end_of_line = lf
10+
max_line_length = 160
11+
12+
[*.{yaml,yml,json}]
13+
indent_size = 2

‎.env‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,5 +58,5 @@ RUNNER_ARCH="X"
5858
# RUNNER_NAME=""
5959
INPUT_VERSION="latest"
6060
RUNNER_OS="macOS"
61-
RUNNER_TEMP=".local/tmp"
62-
RUNNER_TOOL_CACHE=".local/cache"
61+
RUNNER_TEMP=.local/tmp
62+
RUNNER_TOOL_CACHE=.local/cache

‎.github/labeler.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: 1
2+
appendOnly: true
3+
labels:
4+
- label: 'chore'
5+
type: 'pull_request'
6+
title: '^chore:.*'
7+
- label: '🐞 bug'
8+
type: 'pull_request'
9+
title: '^fix:.*'
10+
- label: '✨ enhancement'
11+
type: 'pull_request'
12+
title: '^feat:.*'
13+
- label: '📖 docs'
14+
type: 'pull_request'
15+
title: '^docs:.*'

‎.github/release.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
changelog:
2+
exclude:
3+
labels:
4+
- chore
5+
categories:
6+
- title: 💥 Breaking Changes
7+
labels:
8+
- 💥 breaking-change
9+
- title: ✨ Exciting New Features
10+
labels:
11+
- ✨ enhancement
12+
- title: 🐞 Bug Fixes
13+
labels:
14+
- 🐞 bug
15+
- title: 🛠️ Dependencies
16+
labels:
17+
- 🛠️ dependencies
18+
- title: 📖 Documentation
19+
labels:
20+
- 📖 docs
21+
- title: Other Changes
22+
labels:
23+
- '*'

‎.github/workflows/auto_cherry_pick.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ on:
44
workflow_dispatch:
55
inputs:
66
base_branch:
7-
description: "Base branch to create the PR against"
7+
description: 'Base branch to create the PR against'
88
required: true
9-
default: "main"
9+
default: 'main'
1010
script:
1111
description: 'Script to run after audit fix'
1212
required: false
@@ -22,7 +22,7 @@ jobs:
2222
cherry-pick:
2323
uses: step-security/reusable-workflows/.github/workflows/auto_cherry_pick.yaml@v1
2424
with:
25-
original-owner: "jkroepke"
26-
repo-name: "setup-vals"
25+
original-owner: 'jkroepke'
26+
repo-name: 'setup-vals'
2727
base_branch: ${{ inputs.base_branch }}
2828
script: ${{ inputs.script || 'npm run all' }}

‎.github/workflows/ci.yml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
env:
2+
RUNNER_DEBUG: 1
3+
4+
name: 'CI'
5+
on: # rebuild any PRs and main branch changes
6+
pull_request:
7+
push:
8+
branches:
9+
- main
10+
11+
permissions: {}
12+
13+
jobs:
14+
build: # make sure build/ci work properly
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
steps:
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
20+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
21+
with:
22+
node-version: '22'
23+
- run: |
24+
npm install
25+
npm run all
26+
- run: |
27+
git diff --exit-code ':!dist/index.js.map' ':!badges/coverage.svg'
28+
test: # make sure the action works on a clean machine without building
29+
runs-on: ${{ matrix.os }}
30+
permissions:
31+
contents: read
32+
strategy:
33+
matrix:
34+
os: [ubuntu-latest, macos-latest, windows-latest]
35+
steps:
36+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
37+
- uses: ./
38+
- name: Get the version
39+
run: vals version
40+
- uses: ./
41+
with:
42+
version: v0.40.0
43+
- name: Get the version
44+
run: vals version | grep 0.40.0
45+
- uses: ./
46+
with:
47+
version: 0.28.0
48+
- name: Get the version
49+
run: vals version | grep 0.28.0
50+
51+
super-lint:
52+
name: super-lint
53+
runs-on: ubuntu-24.04
54+
permissions:
55+
contents: read
56+
steps:
57+
- name: Checkout Code
58+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
59+
with:
60+
fetch-depth: 0
61+
62+
- name: Lint Code Base
63+
uses: super-linter/super-linter/slim@4e8a7c2bf106c4c766c816b35ec612638dc9b6b2 # v7.3.0
64+
env:
65+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
66+
MULTI_STATUS: false
67+
LINTER_RULES_PATH: .
68+
VALIDATE_ALL_CODEBASE: true
69+
VALIDATE_BASH: true
70+
VALIDATE_BASH_EXEC: true
71+
VALIDATE_ENV: true
72+
VALIDATE_GITHUB_ACTIONS: true
73+
VALIDATE_HTML: true
74+
VALIDATE_NATURAL_LANGUAGE: true
75+
VALIDATE_SHELL_SHFMT: true
76+
VALIDATE_XML: true
77+
VALIDATE_YAML: true
78+
79+
release:
80+
if: github.repository_owner == 'jkroepke' && github.ref_name == 'main'
81+
name: Release
82+
runs-on: ubuntu-latest
83+
needs:
84+
- build
85+
- test
86+
- super-lint
87+
permissions:
88+
contents: write
89+
steps:
90+
- uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
91+
id: app-token
92+
with:
93+
app-id: 1248576
94+
private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
95+
- name: Checkout
96+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
97+
with:
98+
fetch-depth: 0
99+
- name: Setup Node.js
100+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
101+
with:
102+
node-version: '22'
103+
- name: Install dependencies
104+
run: npm clean-install
105+
- name: Release
106+
env:
107+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
108+
run: npx semantic-release

‎.github/workflows/pr.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Pull Request
2+
on:
3+
pull_request:
4+
types:
5+
- opened
6+
- reopened
7+
- synchronize
8+
- labeled
9+
- unlabeled
10+
11+
permissions: {}
12+
13+
jobs:
14+
add-labels:
15+
runs-on: ubuntu-latest
16+
if: >-
17+
!contains(github.event.pull_request.labels.*.name, '💥 breaking-change') &&
18+
!contains(github.event.pull_request.labels.*.name, '✨ enhancement') &&
19+
!contains(github.event.pull_request.labels.*.name, '🐞 bug') &&
20+
!contains(github.event.pull_request.labels.*.name, '📖 docs') &&
21+
!contains(github.event.pull_request.labels.*.name, 'chore') &&
22+
!contains(github.event.pull_request.labels.*.name, '🛠️ dependencies')
23+
steps:
24+
- uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
25+
id: app-token
26+
with:
27+
app-id: 1248576
28+
private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
29+
- uses: srvaroa/labeler@0a20eccb8c94a1ee0bed5f16859aece1c45c3e55 # v1.13.0
30+
env:
31+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
32+
validate-labels:
33+
name: check labels missing
34+
runs-on: ubuntu-latest
35+
steps:
36+
- name: check
37+
if: >-
38+
!contains(github.event.pull_request.labels.*.name, '💥 breaking-change') &&
39+
!contains(github.event.pull_request.labels.*.name, '✨ enhancement') &&
40+
!contains(github.event.pull_request.labels.*.name, '🐞 bug') &&
41+
!contains(github.event.pull_request.labels.*.name, '📖 docs') &&
42+
!contains(github.event.pull_request.labels.*.name, 'chore') &&
43+
!contains(github.event.pull_request.labels.*.name, '🛠️ dependencies')
44+
run: >-
45+
echo One of the following labels is missing on this PR:
46+
breaking-change enhancement bug docs chore && exit 1
47+
validate-title:
48+
name: check title prefix
49+
runs-on: ubuntu-latest
50+
steps:
51+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
52+
- name: check
53+
run: |
54+
PR_TITLE_PREFIX=$(echo "$PR_TITLE" | cut -d':' -f1)
55+
if [[ "$PR_TITLE_PREFIX" == "fix"* ]] || [[ "$PR_TITLE_PREFIX" == "feat"* ]] || [[ "$PR_TITLE_PREFIX" == "chore"* ]]; then
56+
exit 0
57+
fi
58+
echo "PR title must start with feat, fix or chore"
59+
exit 1
60+
env:
61+
PR_TITLE: ${{ github.event.pull_request.title }}

‎.github/workflows/renovate-custom-hooks.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: renovate hooks
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'package.json'
9+
- 'package-lock.json'
10+
11+
jobs:
12+
renovate-post-run:
13+
name: Renovate Post Upgrade Hook
14+
runs-on: ubuntu-latest
15+
if: github.repository_owner == 'jkroepke' && github.actor == 'renovate[bot]'
16+
steps:
17+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
18+
with:
19+
fetch-depth: 0
20+
21+
# Using a GitHub App token, because GitHub Actions doesn't run on commits from github-actions bot
22+
# Used App:
23+
# https://github.com/organizations/prometheus-community/settings/apps/helm-charts-renovate-helper.
24+
# Ref: https://github.com/prometheus-community/helm-charts/issues/5213.
25+
- uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
26+
id: app-token
27+
with:
28+
app-id: 1248576
29+
private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
30+
31+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
32+
with:
33+
node-version: '22'
34+
35+
- run: |
36+
npm install
37+
npm run all
38+
- name: Commit changes
39+
env:
40+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
41+
GITHUB_HEAD_REF: ${{ github.head_ref }}
42+
#language=bash
43+
run: |
44+
# Define the target directory
45+
TARGET_DIR="."
46+
# Fetch deleted files in the target directory
47+
DELETED_FILES=$(git diff --diff-filter=D --name-only HEAD -- "$TARGET_DIR")
48+
# Fetch added/modified files in the target directory
49+
MODIFIED_FILES=$(git diff --diff-filter=ACM --name-only HEAD -- "$TARGET_DIR")
50+
# Create a temporary file for JSON output
51+
FILE_CHANGES_JSON_FILE=$(mktemp)
52+
# Initialize JSON structure
53+
echo '{ "deletions": [], "additions": [] }' > "$FILE_CHANGES_JSON_FILE"
54+
# Add deletions
55+
for file in $DELETED_FILES; do
56+
jq --arg path "$file" '.deletions += [{"path": $path}]' "$FILE_CHANGES_JSON_FILE" > "$FILE_CHANGES_JSON_FILE.tmp"
57+
mv "$FILE_CHANGES_JSON_FILE.tmp" "$FILE_CHANGES_JSON_FILE"
58+
done
59+
# Prepare additions (new or modified files)
60+
for file in $MODIFIED_FILES; do
61+
jq --rawfile content "$file" --arg path "$file" \
62+
'.additions += [{"path": $path, "contents": ($content | @base64)}]' \
63+
"$FILE_CHANGES_JSON_FILE" > "$FILE_CHANGES_JSON_FILE.tmp"
64+
mv "$FILE_CHANGES_JSON_FILE.tmp" "$FILE_CHANGES_JSON_FILE"
65+
done
66+
# Create a temporary file for the final JSON payload
67+
JSON_PAYLOAD_FILE=$(mktemp)
68+
# Construct the final JSON using jq and store it in a file
69+
jq -n --arg repo "$GITHUB_REPOSITORY" \
70+
--arg branch "$GITHUB_HEAD_REF" \
71+
--arg message "post upgrade changes from renovate" \
72+
--arg expectedOid "$GITHUB_SHA" \
73+
--slurpfile fileChanges "$FILE_CHANGES_JSON_FILE" \
74+
'{
75+
query: "mutation ($input: CreateCommitOnBranchInput!) {
76+
createCommitOnBranch(input: $input) {
77+
commit {
78+
url
79+
}
80+
}
81+
}",
82+
variables: {
83+
input: {
84+
branch: {
85+
repositoryNameWithOwner: $repo,
86+
branchName: $branch
87+
},
88+
message: { headline: $message },
89+
fileChanges: $fileChanges[0],
90+
expectedHeadOid: $expectedOid
91+
}
92+
}
93+
}' > "$JSON_PAYLOAD_FILE"
94+
# Call GitHub API
95+
curl https://api.github.com/graphql -f \
96+
-sSf -H "Authorization: Bearer $GITHUB_TOKEN" \
97+
--data "@$JSON_PAYLOAD_FILE"
98+
# Clean up temporary files
99+
rm "$FILE_CHANGES_JSON_FILE" "$JSON_PAYLOAD_FILE"

0 commit comments

Comments
 (0)