From f91c6fd38648042510e280de7498e28ddc98e398 Mon Sep 17 00:00:00 2001 From: Ferenc Csaky Date: Wed, 22 Apr 2026 17:53:43 +0200 Subject: [PATCH 1/3] chore: Ship runner uber JAR in Flink `lib/` --- flink-sql-runner/src/main/docker/Dockerfile | 6 ++---- .../java/com/datasqrl/flinkrunner/AbstractITSupport.java | 4 +++- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/flink-sql-runner/src/main/docker/Dockerfile b/flink-sql-runner/src/main/docker/Dockerfile index fc2eb530..9a5a9bb7 100644 --- a/flink-sql-runner/src/main/docker/Dockerfile +++ b/flink-sql-runner/src/main/docker/Dockerfile @@ -16,8 +16,6 @@ FROM apache/flink:${flink-base-image} -RUN mkdir -p /opt/flink/plugins/flink-sql-runner - COPY flink-table-planner_2.12-*.jar /opt/flink/lib COPY flink-s3-fs-hadoop-*.jar /opt/flink/lib COPY hadoop-common-*.jar /opt/flink/lib @@ -26,11 +24,11 @@ COPY hadoop-mapreduce-client-core-*.jar /opt/flink/lib COPY iceberg-flink-runtime-*.jar /opt/flink/lib COPY iceberg-aws-bundle-*.jar /opt/flink/lib COPY stdlib-utils-*.jar /opt/flink/lib -COPY flink-sql-runner.uber.jar /opt/flink/plugins/flink-sql-runner +COPY flink-sql-runner.uber.jar /opt/flink/lib/sql-runner.uber.jar COPY --chmod=755 entrypoint.sh /entrypoint.sh RUN rm -rf /opt/flink/lib/flink-table-planner-loader-*.jar \ - && ln -s /opt/flink/plugins/flink-sql-runner/flink-sql-runner.uber.jar /opt/flink/flink-sql-runner.jar \ + && echo 'UEsDBBQACAgIAG2UllwAAAAAAAAAAAAAAAAUAAQATUVUQS1JTkYvTUFOSUZFU1QuTUb+ygAA803My0xLLS7RDUstKs7Mz7NSMNQz4HIuSk0sSU3Rdaq0UkjLyczL1i0uzNEtKs3LSy3i4gIAUEsHCL/cUjU2AAAANAAAAFBLAQIUABQACAgIAG2Ully/3FI1NgAAADQAAAAUAAQAAAAAAAAAAAAAAAAAAABNRVRBLUlORi9NQU5JRkVTVC5NRv7KAABQSwUGAAAAAAEAAQBGAAAAfAAAAAAA' | base64 -d > /opt/flink/noop.jar \ && mkdir -p /opt/flink/hadoop-conf \ && echo 'fs.s3a.aws.credentials.providercom.amazonaws.auth.DefaultAWSCredentialsProviderChain' > /opt/flink/hadoop-conf/core-site.xml diff --git a/flink-sql-runner/src/test/java/com/datasqrl/flinkrunner/AbstractITSupport.java b/flink-sql-runner/src/test/java/com/datasqrl/flinkrunner/AbstractITSupport.java index 094402e9..87e942be 100644 --- a/flink-sql-runner/src/test/java/com/datasqrl/flinkrunner/AbstractITSupport.java +++ b/flink-sql-runner/src/test/java/com/datasqrl/flinkrunner/AbstractITSupport.java @@ -165,7 +165,9 @@ protected String flinkRun(List sqlRunnerArgs, @Nullable String savepoint execCmd.add(savepointPath); } - execCmd.add("./plugins/flink-sql-runner/flink-sql-runner.uber.jar"); + execCmd.add("-c"); + execCmd.add("com.datasqrl.flinkrunner.CliRunner"); + execCmd.add("noop.jar"); execCmd.addAll(sqlRunnerArgs); var execRes = flinkContainer.execInContainer(execCmd.toArray(new String[0])); From 60b462117cf67a2e0d0fdb9d896db6359c5063f5 Mon Sep 17 00:00:00 2001 From: Marvin Froeder Date: Mon, 27 Apr 2026 12:11:27 -0300 Subject: [PATCH 2/3] Add /test-cloud-compilation comment-triggered cloud-compilation sync workflow Signed-off-by: Marvin Froeder --- .github/workflows/test-cloud-compilation.yml | 479 +++++++++++++++++++ adr/test-cloud-compilation-workflow.md | 16 + 2 files changed, 495 insertions(+) create mode 100644 .github/workflows/test-cloud-compilation.yml create mode 100644 adr/test-cloud-compilation-workflow.md diff --git a/.github/workflows/test-cloud-compilation.yml b/.github/workflows/test-cloud-compilation.yml new file mode 100644 index 00000000..44b379e1 --- /dev/null +++ b/.github/workflows/test-cloud-compilation.yml @@ -0,0 +1,479 @@ +name: Test Cloud Compilation + +on: + issue_comment: + types: [created] + pull_request: + types: [synchronize, reopened, closed] + +jobs: + decide: + if: | + ( + github.event_name == 'issue_comment' && + github.event.issue.pull_request != null && + contains(github.event.comment.body, '/test-cloud-compilation') + ) || ( + github.event_name == 'pull_request' && + (github.event.action == 'synchronize' || github.event.action == 'reopened') && + !github.event.pull_request.draft + ) + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + outputs: + should_sync: ${{ steps.gate.outputs.should_sync }} + pr_number: ${{ steps.gate.outputs.pr_number }} + pr_head_ref: ${{ steps.gate.outputs.head_ref }} + pr_head_sha: ${{ steps.gate.outputs.head_sha }} + pr_base_ref: ${{ steps.gate.outputs.base_ref }} + pr_url: ${{ steps.gate.outputs.url }} + pr_title: ${{ steps.gate.outputs.title }} + steps: + - name: Authorize commenter + if: github.event_name == 'issue_comment' + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + run: | + PERM=$(gh api \ + "/repos/${{ github.repository }}/collaborators/${{ github.event.comment.user.login }}/permission" \ + --jq .permission) + echo "User permission: $PERM" + case "$PERM" in + admin|write|maintain) echo "Authorized" ;; + *) echo "User does not have write access — refusing"; exit 1 ;; + esac + + - name: Add eyes reaction + if: github.event_name == 'issue_comment' + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + run: | + gh api -X POST \ + -H "Accept: application/vnd.github+json" \ + "/repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions" \ + -f content=eyes || true + + - name: Resolve PR metadata and gate + id: gate + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + run: | + if [[ "${{ github.event_name }}" == "issue_comment" ]]; then + PR_NUMBER=${{ github.event.issue.number }} + else + PR_NUMBER=${{ github.event.pull_request.number }} + fi + + PR_DATA=$(gh api "/repos/${{ github.repository }}/pulls/${PR_NUMBER}") + HEAD_REF=$(echo "$PR_DATA" | jq -r .head.ref) + HEAD_SHA=$(echo "$PR_DATA" | jq -r .head.sha) + BASE_REF=$(echo "$PR_DATA" | jq -r .base.ref) + URL=$(echo "$PR_DATA" | jq -r .html_url) + TITLE=$(echo "$PR_DATA" | jq -r .title) + + # For pull_request triggers, only proceed if a cloud-compilation branch + # already exists for this PR (i.e. /test-cloud-compilation was invoked + # at least once). For issue_comment, always proceed. + if [[ "${{ github.event_name }}" == "pull_request" ]]; then + if ! gh api "/repos/DataSQRL/cloud-compilation/branches/${HEAD_REF}" >/dev/null 2>&1; then + echo "No cloud-compilation branch exists for this PR yet — skipping auto-sync" + echo "should_sync=false" >> "$GITHUB_OUTPUT" + exit 0 + fi + fi + + echo "should_sync=true" >> "$GITHUB_OUTPUT" + { + echo "pr_number=${PR_NUMBER}" + echo "head_ref=${HEAD_REF}" + echo "head_sha=${HEAD_SHA}" + echo "base_ref=${BASE_REF}" + echo "url=${URL}" + } >> "$GITHUB_OUTPUT" + { + echo "title<<__PR_TITLE_EOF__" + echo "${TITLE}" + echo "__PR_TITLE_EOF__" + } >> "$GITHUB_OUTPUT" + + sync: + needs: decide + if: needs.decide.outputs.should_sync == 'true' + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + steps: + - name: Checkout flink-sql-runner repo + uses: actions/checkout@v4 + with: + ref: ${{ needs.decide.outputs.pr_head_sha }} + path: flink-sql-runner + + - name: Checkout cloud-compilation repo + uses: actions/checkout@v4 + with: + repository: DataSQRL/cloud-compilation + token: ${{ secrets.BOT_PAT }} + ref: ${{ needs.decide.outputs.pr_base_ref }} + path: compilation + + - name: Import GPG key + run: | + printf '%s\n' "${{ secrets.GPG_PRIVATE_KEY }}" > /tmp/gpg_key.asc + gpg --batch --import /tmp/gpg_key.asc + rm /tmp/gpg_key.asc + gpg --list-secret-keys --keyid-format=long + + - name: Configure git + run: | + cd compilation + git config user.name "Datasqrl - Automation Bot" + git config user.email "bot@datasqrl.com" + git config user.signingkey "${{ secrets.GPG_KEY_ID }}" + git config commit.gpgsign true + + - name: Create or update branch + id: branch + env: + BRANCH_NAME: ${{ needs.decide.outputs.pr_head_ref }} + BASE_REF: ${{ needs.decide.outputs.pr_base_ref }} + run: | + cd compilation + echo "branch_name=${BRANCH_NAME}" >> "$GITHUB_OUTPUT" + + git fetch origin + if git rev-parse --verify "origin/${BRANCH_NAME}" >/dev/null 2>&1; then + echo "Branch exists, checking out..." + git checkout "${BRANCH_NAME}" + git pull origin "${BRANCH_NAME}" + else + echo "Creating new branch from ${BASE_REF}..." + git checkout -b "${BRANCH_NAME}" + fi + + - name: Update flink-sql-runner version + env: + PR_NUMBER: ${{ needs.decide.outputs.pr_number }} + run: | + cd compilation + PR_TAG="pr-${PR_NUMBER}" + + python3 - "$PR_TAG" <<'PY' + import re, sys + pr_tag = sys.argv[1] + + app_yaml = "cloud-compilation/src/main/resources/application.yaml" + with open(app_yaml) as f: + text = f.read() + new_text, n = re.subn( + r'( flink-sql-runner:\n version: )\S+', + lambda m: m.group(1) + pr_tag, + text, + count=1, + ) + if n != 1: + raise SystemExit(f"Failed to locate flink-sql-runner.version in {app_yaml}") + with open(app_yaml, "w") as f: + f.write(new_text) + + override_yaml = "integration-tests/config/application-override.yaml" + with open(override_yaml) as f: + text = f.read() + new_text, n = re.subn( + r'flinkSqlRunner: "[^"]*"', + 'flinkSqlRunner: "ghcr.io/datasqrl/flink-sql-runner"', + text, + count=1, + ) + if n != 1: + raise SystemExit(f"Failed to locate flinkSqlRunner image in {override_yaml}") + with open(override_yaml, "w") as f: + f.write(new_text) + PY + + git add cloud-compilation/src/main/resources/application.yaml + git add integration-tests/config/application-override.yaml + + - name: Update flink-sql-runner commit tracking + env: + PR_NUMBER: ${{ needs.decide.outputs.pr_number }} + PR_SHA: ${{ needs.decide.outputs.pr_head_sha }} + run: | + cd compilation + mkdir -p .github + { + echo "flink-sql-runner PR #${PR_NUMBER}" + echo "Commit: ${PR_SHA}" + echo "Updated: $(date -u +"%Y-%m-%d %H:%M:%S UTC")" + } > .github/flink-sql-runner-pr-info.txt + git add .github/flink-sql-runner-pr-info.txt + + - name: Commit and push changes + env: + PR_NUMBER: ${{ needs.decide.outputs.pr_number }} + PR_SHA: ${{ needs.decide.outputs.pr_head_sha }} + run: | + cd compilation + echo "Git status before commit:" + git status + + if git diff --staged --quiet; then + echo "No changes to commit" + else + git commit -s -S \ + -m "Test flink-sql-runner PR #${PR_NUMBER}: Sync with commit ${PR_SHA}" + git push origin "${{ steps.branch.outputs.branch_name }}" + fi + + - name: Create or update PR + id: cc-pr + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + PR_NUMBER: ${{ needs.decide.outputs.pr_number }} + PR_TITLE: ${{ needs.decide.outputs.pr_title }} + PR_URL: ${{ needs.decide.outputs.pr_url }} + BASE_REF: ${{ needs.decide.outputs.pr_base_ref }} + run: | + cd compilation + + FULL_TITLE="Test flink-sql-runner PR #${PR_NUMBER}: ${PR_TITLE}" + BODY=$(cat <> "$GITHUB_OUTPUT" + echo "created=${CREATED}" >> "$GITHUB_OUTPUT" + + - name: Comment on flink-sql-runner PR + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + PR_NUMBER: ${{ needs.decide.outputs.pr_number }} + CC_PR_URL: ${{ steps.cc-pr.outputs.url }} + run: | + COMMENT_BODY="🔄 Cloud-compilation PR has been created/updated: ${CC_PR_URL} + + This PR will test the flink-sql-runner changes against cloud-compilation integration tests." + + EXISTING_COMMENT=$(gh pr view "${PR_NUMBER}" \ + --repo "${{ github.repository }}" \ + --json comments \ + --jq '.comments[] | select(.body | contains("Cloud-compilation PR has been created/updated")) | .id' \ + | head -1 || echo "") + + if [ -z "$EXISTING_COMMENT" ]; then + gh pr comment "${PR_NUMBER}" \ + --repo "${{ github.repository }}" \ + --body "${COMMENT_BODY}" + else + echo "Comment already exists, skipping..." + fi + + - name: Add rocket reaction + if: success() && github.event_name == 'issue_comment' + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + run: | + gh api -X POST \ + -H "Accept: application/vnd.github+json" \ + "/repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions" \ + -f content=rocket || true + + - name: Add failure reaction + if: failure() && github.event_name == 'issue_comment' + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + run: | + gh api -X POST \ + -H "Accept: application/vnd.github+json" \ + "/repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions" \ + -f content=confused || true + + revert-on-merge: + if: | + github.event_name == 'pull_request' && + github.event.action == 'closed' && + github.event.pull_request.merged == true + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + steps: + - name: Check whether cloud-compilation branch exists + id: branch_exists + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + BRANCH_NAME: ${{ github.event.pull_request.head.ref }} + run: | + if gh api "/repos/DataSQRL/cloud-compilation/branches/${BRANCH_NAME}" >/dev/null 2>&1; then + echo "exists=true" >> "$GITHUB_OUTPUT" + else + echo "No cloud-compilation branch — nothing to revert" + echo "exists=false" >> "$GITHUB_OUTPUT" + fi + + - name: Checkout cloud-compilation repo + if: steps.branch_exists.outputs.exists == 'true' + uses: actions/checkout@v4 + with: + repository: DataSQRL/cloud-compilation + token: ${{ secrets.BOT_PAT }} + ref: ${{ github.event.pull_request.base.ref }} + fetch-depth: 0 + + - name: Import GPG key + if: steps.branch_exists.outputs.exists == 'true' + run: | + printf '%s\n' "${{ secrets.GPG_PRIVATE_KEY }}" > /tmp/gpg_key.asc + gpg --batch --import /tmp/gpg_key.asc + rm /tmp/gpg_key.asc + + - name: Configure git + if: steps.branch_exists.outputs.exists == 'true' + run: | + git config user.name "Datasqrl - Automation Bot" + git config user.email "bot@datasqrl.com" + git config user.signingkey "${{ secrets.GPG_KEY_ID }}" + git config commit.gpgsign true + + - name: Revert PR-test changes + if: steps.branch_exists.outputs.exists == 'true' + id: revert + env: + BRANCH_NAME: ${{ github.event.pull_request.head.ref }} + BASE_REF: ${{ github.event.pull_request.base.ref }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + git checkout "${BRANCH_NAME}" + + # Restore the files we touched back to the base branch state. + git checkout "origin/${BASE_REF}" -- \ + cloud-compilation/src/main/resources/application.yaml \ + integration-tests/config/application-override.yaml || true + + # Drop the PR tracking file if it exists. + if [ -f .github/flink-sql-runner-pr-info.txt ]; then + git rm .github/flink-sql-runner-pr-info.txt + fi + + if git diff --staged --quiet; then + echo "No revert changes to commit" + echo "committed=false" >> "$GITHUB_OUTPUT" + else + git commit -s -S \ + -m "Revert flink-sql-runner PR #${PR_NUMBER} test overrides after merge" + git push origin "${BRANCH_NAME}" + echo "committed=true" >> "$GITHUB_OUTPUT" + fi + + - name: Close or comment on cloud-compilation PR + if: steps.branch_exists.outputs.exists == 'true' + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + BRANCH_NAME: ${{ github.event.pull_request.head.ref }} + BASE_REF: ${{ github.event.pull_request.base.ref }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + CC_PR=$(gh pr list \ + --repo DataSQRL/cloud-compilation \ + --head "${BRANCH_NAME}" \ + --json number --jq '.[0].number' || echo "") + + if [ -z "$CC_PR" ]; then + echo "No cloud-compilation PR open for this branch." + exit 0 + fi + + git fetch origin "${BRANCH_NAME}" "${BASE_REF}" + if git diff --quiet "origin/${BASE_REF}" "origin/${BRANCH_NAME}"; then + gh pr close "${CC_PR}" \ + --repo DataSQRL/cloud-compilation \ + --delete-branch \ + --comment "Automatically closed: all test overrides have been reverted after flink-sql-runner PR #${PR_NUMBER} was merged." + else + gh pr comment "${CC_PR}" \ + --repo DataSQRL/cloud-compilation \ + --body "✅ flink-sql-runner PR #${PR_NUMBER} merged. Test overrides reverted, but branch still has changes vs ${BASE_REF} — manual review needed." + fi + + - name: Comment on flink-sql-runner PR + if: steps.branch_exists.outputs.exists == 'true' + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + BRANCH_NAME: ${{ github.event.pull_request.head.ref }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + CC_PR_URL=$(gh pr list \ + --repo DataSQRL/cloud-compilation \ + --head "${BRANCH_NAME}" \ + --state all \ + --json url --jq '.[0].url' || echo "") + + if [ -n "$CC_PR_URL" ]; then + gh pr comment "${PR_NUMBER}" \ + --repo "${{ github.repository }}" \ + --body "✅ Cloud-compilation PR has been cleaned up: ${CC_PR_URL}" + fi + + comment-on-close-without-merge: + if: | + github.event_name == 'pull_request' && + github.event.action == 'closed' && + github.event.pull_request.merged == false + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + steps: + - name: Comment on cloud-compilation PR (if exists) + env: + GH_TOKEN: ${{ secrets.BOT_PAT }} + BRANCH_NAME: ${{ github.event.pull_request.head.ref }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + CC_PR=$(gh pr list \ + --repo DataSQRL/cloud-compilation \ + --head "${BRANCH_NAME}" \ + --json number --jq '.[0].number' || echo "") + + if [ -n "$CC_PR" ]; then + gh pr comment "${CC_PR}" \ + --repo DataSQRL/cloud-compilation \ + --body "⚠️ flink-sql-runner PR #${PR_NUMBER} was closed without merging. This PR can be closed." + fi diff --git a/adr/test-cloud-compilation-workflow.md b/adr/test-cloud-compilation-workflow.md new file mode 100644 index 00000000..6079d5d0 --- /dev/null +++ b/adr/test-cloud-compilation-workflow.md @@ -0,0 +1,16 @@ +# Comment-triggered cloud-compilation sync workflow + +## Summary +Adds a GitHub Actions workflow that lets contributors test a flink-sql-runner PR end-to-end against cloud-compilation by commenting `/test-cloud-compilation`. Once a PR has been kicked off, subsequent pushes to the same PR auto-resync, and PR close cleans up the cloud-compilation side. + +## Key Decisions +- Manual kickoff via PR comment (not automatic on PR open) — most flink-sql-runner PRs do not need cloud-compilation integration runs, so opt-in keeps noise and CI cost down. Mirrors the spirit of cloud-backend's `sync-compilation-pr` flow but inverts the default. +- Auto-sync after first kickoff (on `pull_request: synchronize`/`reopened`) — gated on the cloud-compilation branch already existing, so it only ever fires for PRs the user previously opted in. +- Override `images.flinkSqlRunner` in `integration-tests/config/application-override.yaml` to `ghcr.io/datasqrl/flink-sql-runner` because PR images are published to GHCR, while the default override points to a Docker Hub ECR pull-through cache that won't have `pr-N` tags. +- Auto-cleanup on PR close — revert the `application.yaml` and `application-override.yaml` files to base, drop the tracking file, close the cloud-compilation PR if the branch matches base, otherwise leave a comment for manual review. Closed-without-merge just leaves a comment. +- Commenter authorization is enforced via the GitHub permissions API (admin/write/maintain only) so external comments cannot trigger paid CI. + +## Notes +- Requires repo/org secrets `BOT_PAT`, `GPG_PRIVATE_KEY`, `GPG_KEY_ID` (already used by the cloud-backend equivalent). +- The `flink-sql-runner` label is applied to the cloud-compilation PR; create it in cloud-compilation if it doesn't already exist. +- Mirrors patterns from `DataSQRL/cloud-backend/.github/workflows/build-and-test.yml` (`sync-compilation-pr`, `sync-compilation-revert`, `sync-compilation-comment-closed`). From f6dc741685e6871e8541767f94e1a631c5cf38b2 Mon Sep 17 00:00:00 2001 From: Marvin Froeder Date: Tue, 28 Apr 2026 16:31:29 -0300 Subject: [PATCH 3/3] Use BOT_GPG_PRIVATE_KEY and hardcoded bot identity for cloud-compilation sync commits Signed-off-by: Marvin Froeder --- .github/workflows/test-cloud-compilation.yml | 44 ++++++-------------- 1 file changed, 12 insertions(+), 32 deletions(-) diff --git a/.github/workflows/test-cloud-compilation.yml b/.github/workflows/test-cloud-compilation.yml index 8fce3a2d..40d37f8a 100644 --- a/.github/workflows/test-cloud-compilation.yml +++ b/.github/workflows/test-cloud-compilation.yml @@ -182,37 +182,27 @@ jobs: - name: Import GPG key id: gpg env: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} + GPG_PRIVATE_KEY: ${{ secrets.BOT_GPG_PRIVATE_KEY }} run: | echo "$GPG_PRIVATE_KEY" | gpg --batch --import KEY_ID=$(gpg --list-secret-keys --keyid-format=long --with-colons \ | awk -F: '/^sec/ {print $5; exit}') - UID_LINE=$(gpg --list-secret-keys --with-colons \ - | awk -F: '/^uid/ {print $10; exit}') - USER_NAME=$(echo "$UID_LINE" | sed -E 's/ *<[^>]+>$//') - USER_EMAIL=$(echo "$UID_LINE" | sed -E 's/.*<([^>]+)>.*/\1/') - if [ -z "$KEY_ID" ] || [ -z "$USER_EMAIL" ]; then - echo "Failed to determine GPG key id / uid (key_id=${KEY_ID}, uid=${UID_LINE})" + if [ -z "$KEY_ID" ]; then + echo "Failed to determine GPG key id" exit 1 fi mkdir -p ~/.gnupg echo "default-key ${KEY_ID}" >> ~/.gnupg/gpg.conf echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf - { - echo "key_id=${KEY_ID}" - echo "user_name=${USER_NAME}" - echo "user_email=${USER_EMAIL}" - } >> "$GITHUB_OUTPUT" + echo "key_id=${KEY_ID}" >> "$GITHUB_OUTPUT" - name: Configure git env: KEY_ID: ${{ steps.gpg.outputs.key_id }} - USER_NAME: ${{ steps.gpg.outputs.user_name }} - USER_EMAIL: ${{ steps.gpg.outputs.user_email }} run: | cd compilation - git config user.name "${USER_NAME}" - git config user.email "${USER_EMAIL}" + git config user.name "Datasqrl - Automation Bot" + git config user.email "bot@datasqrl.com" git config user.signingkey "${KEY_ID}" git config commit.gpgsign true @@ -449,37 +439,27 @@ jobs: id: gpg if: steps.branch_exists.outputs.exists == 'true' env: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} + GPG_PRIVATE_KEY: ${{ secrets.BOT_GPG_PRIVATE_KEY }} run: | echo "$GPG_PRIVATE_KEY" | gpg --batch --import KEY_ID=$(gpg --list-secret-keys --keyid-format=long --with-colons \ | awk -F: '/^sec/ {print $5; exit}') - UID_LINE=$(gpg --list-secret-keys --with-colons \ - | awk -F: '/^uid/ {print $10; exit}') - USER_NAME=$(echo "$UID_LINE" | sed -E 's/ *<[^>]+>$//') - USER_EMAIL=$(echo "$UID_LINE" | sed -E 's/.*<([^>]+)>.*/\1/') - if [ -z "$KEY_ID" ] || [ -z "$USER_EMAIL" ]; then - echo "Failed to determine GPG key id / uid (key_id=${KEY_ID}, uid=${UID_LINE})" + if [ -z "$KEY_ID" ]; then + echo "Failed to determine GPG key id" exit 1 fi mkdir -p ~/.gnupg echo "default-key ${KEY_ID}" >> ~/.gnupg/gpg.conf echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf - { - echo "key_id=${KEY_ID}" - echo "user_name=${USER_NAME}" - echo "user_email=${USER_EMAIL}" - } >> "$GITHUB_OUTPUT" + echo "key_id=${KEY_ID}" >> "$GITHUB_OUTPUT" - name: Configure git if: steps.branch_exists.outputs.exists == 'true' env: KEY_ID: ${{ steps.gpg.outputs.key_id }} - USER_NAME: ${{ steps.gpg.outputs.user_name }} - USER_EMAIL: ${{ steps.gpg.outputs.user_email }} run: | - git config user.name "${USER_NAME}" - git config user.email "${USER_EMAIL}" + git config user.name "Datasqrl - Automation Bot" + git config user.email "bot@datasqrl.com" git config user.signingkey "${KEY_ID}" git config commit.gpgsign true