Skip to content

chore(deps): pin actions/attest-build-provenance action to 520d128 #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

chore(deps): pin actions/attest-build-provenance action to 520d128 #33

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a7377dd
TESTING
trask Feb 10, 2025
d6f4869
chore(deps): pin actions/attest-build-provenance action to 520d128
renovate[bot] Feb 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
141 changes: 2 additions & 139 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,19 +102,7 @@ jobs:
SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
run: ./gradlew assemble spdxSbom publishToSonatype closeAndReleaseSonatypeStagingRepository

- name: Build and publish gradle plugins
env:
SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
# Don't use publishToSonatype since we don't want to publish the marker artifact
run: ./gradlew build publishPlugins publishPluginMavenPublicationToSonatypeRepository closeAndReleaseSonatypeStagingRepository
working-directory: gradle-plugins
run: ./gradlew assemble spdxSbom

- name: Collect SBOMs
run: |
Expand Down Expand Up @@ -176,7 +164,7 @@ jobs:
cp javaagent/build/libs/opentelemetry-javaagent-${VERSION}.jar opentelemetry-javaagent.jar

- id: attest
uses: actions/attest-build-provenance@v2
uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2
with:
subject-path: |
opentelemetry-javaagent.jar
Expand All @@ -198,128 +186,3 @@ jobs:
opentelemetry-javaagent.jar \
opentelemetry-java-instrumentation-SBOM.zip \
attestations.intoto.jsonl

echo "version=$VERSION" >> $GITHUB_OUTPUT
echo "prior-version=$PRIOR_VERSION" >> $GITHUB_OUTPUT

merge-change-log-to-main:
permissions:
contents: write # for git push to PR branch
runs-on: ubuntu-latest
needs:
- release
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Copy change log section from release branch
env:
VERSION: ${{ needs.release.outputs.version }}
run: |
sed -n "0,/^## Version $VERSION /d;/^## Version /q;p" CHANGELOG.md \
> /tmp/changelog-section.md

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: main

- name: Merge change log to main
env:
VERSION: ${{ needs.release.outputs.version }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
release_date=$(gh release view v$VERSION --json publishedAt --jq .publishedAt | sed 's/T.*//')
RELEASE_DATE=$release_date .github/scripts/merge-change-log-after-release.sh

- name: Use CLA approved bot
run: .github/scripts/use-cla-approved-bot.sh

- uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
id: otelbot-token
with:
app-id: ${{ vars.OTELBOT_APP_ID }}
private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}

- name: Create pull request against main
env:
VERSION: ${{ needs.release.outputs.version }}
# not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
run: |
if git diff --quiet; then
if [[ $VERSION == *.0 ]]; then
echo there are no updates to merge, not creating pull request
exit 0 # success
else
echo patch release notes did not get applied for some reason
exit 1 # failure
fi
fi

message="Merge change log updates from $GITHUB_REF_NAME"
body="Merge change log updates from \`$GITHUB_REF_NAME\`."
branch="otelbot/merge-change-log-updates-from-${GITHUB_REF_NAME//\//-}"

git checkout -b $branch
git commit -a -m "$message"
git push --set-upstream origin $branch
gh pr create --title "$message" \
--body "$body" \
--base main

update-apidiff-baseline-to-released-version:
runs-on: ubuntu-latest
needs:
- release
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: main

- name: Wait for release to be available in maven central
env:
VERSION: ${{ needs.release.outputs.version }}
run: |
until curl --silent \
--show-error \
--output /dev/null \
--head \
--fail \
https://repo1.maven.org/maven2/io/opentelemetry/javaagent/opentelemetry-javaagent/$VERSION/opentelemetry-javaagent-$VERSION.jar
do
sleep 60
done

- name: Update apidiff baseline
env:
VERSION: ${{ needs.release.outputs.version }}
PRIOR_VERSION: ${{ needs.release.outputs.prior-version }}
run: |
./gradlew japicmp -PapiBaseVersion=$PRIOR_VERSION -PapiNewVersion=$VERSION
./gradlew --refresh-dependencies japicmp

- name: Use CLA approved bot
run: .github/scripts/use-cla-approved-bot.sh

- uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
id: otelbot-token
with:
app-id: ${{ vars.OTELBOT_APP_ID }}
private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}

- name: Create pull request against main
env:
VERSION: ${{ needs.release.outputs.version }}
# not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
run: |
message="Update apidiff baseline to released version $VERSION"
body="Update apidiff baseline to released version \`$version\`."
branch="otelbot/update-apidiff-baseline-to-released-version-${VERSION}"

git checkout -b $branch
git add docs/apidiffs
git commit -m "$message"
git push --set-upstream origin $branch
gh pr create --title "$message" \
--body "$body" \
--base main
Loading