Skip to content

Commit 91b9111

Browse files
AndaristAndarist
authored
Protect publishes with env gate (#610)
* Protect publishes with env gate * tweak CODEOWNERS and release-pr * remove redundant permission * fix syntax * Use app with protection bypass for publishing * handle forks better * remove redundant permission
1 parent d4c53c2 commit 91b9111

4 files changed

Lines changed: 153 additions & 33 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,5 @@
1-
* @Andarist @emmatown
1+
/.github/workflows/** @Andarist @emmatown
2+
/action.yml @Andarist @emmatown
3+
/scripts/bump.ts @Andarist @emmatown
4+
/scripts/release.ts @Andarist @emmatown
5+
/scripts/release-pr.ts @Andarist @emmatown

‎.github/workflows/publish.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Publish
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
concurrency: ${{ github.workflow }}-${{ github.ref }}
9+
10+
permissions: {} # each job should define its own permission explicitly
11+
12+
jobs:
13+
version:
14+
name: Version
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 20
17+
outputs:
18+
hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
19+
permissions:
20+
contents: write # to create release (changesets/action)
21+
issues: write # to post issue comments (changesets/action)
22+
pull-requests: write # to create pull request (changesets/action)
23+
steps:
24+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
- uses: ./.github/actions/ci-setup
26+
27+
- name: Build
28+
run: yarn build
29+
30+
- name: Create or update release pull request
31+
id: changesets
32+
uses: ./
33+
with:
34+
version: yarn bump
35+
36+
publish:
37+
name: Publish
38+
if: needs.version.outputs.hasChangesets == 'false'
39+
needs: version
40+
runs-on: ubuntu-latest
41+
environment: marketplace
42+
timeout-minutes: 20
43+
steps:
44+
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
45+
id: app-token
46+
with:
47+
client-id: ${{ vars.APP_CLIENT_ID }}
48+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
49+
50+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
51+
with:
52+
token: ${{ steps.app-token.outputs.token }}
53+
54+
- uses: ./.github/actions/ci-setup
55+
56+
- name: Build
57+
run: yarn build
58+
59+
- name: Publish to marketplace
60+
uses: ./
61+
with:
62+
publish: yarn release

‎.github/workflows/release-pr.yml‎

Lines changed: 86 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,35 @@ on:
44
issue_comment:
55
types: [created]
66

7+
permissions: {}
8+
79
jobs:
810
release_check:
911
if: github.repository == 'changesets/action' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/release-pr')
1012
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
issues: write
16+
pull-requests: read
1117
steps:
1218
- id: report_in_progress
1319
run: |
1420
echo "in_progress_reaction_id=$(gh api /repos/${{github.repository}}/issues/comments/${{github.event.comment.id}}/reactions -f content='eyes' --jq '.id')" >> "$GITHUB_OUTPUT"
1521
env:
1622
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1723

24+
- id: parse_command
25+
run: |
26+
if [[ "$COMMENT_BODY" =~ ^/release-pr[[:space:]]+([0-9a-fA-F]{7,40})[[:space:]]*$ ]]
27+
then
28+
echo "requested_sha=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
29+
else
30+
echo "Expected '/release-pr <sha>' where <sha> is a 7-40 character commit SHA."
31+
exit 1
32+
fi
33+
env:
34+
COMMENT_BODY: ${{ github.event.comment.body }}
35+
1836
- id: check_authorization
1937
run: |
2038
if [[ $AUTHOR_ASSOCIATION == 'MEMBER' || $AUTHOR_ASSOCIATION == 'OWNER' || $AUTHOR_ASSOCIATION == 'COLLABORATOR' ]]
@@ -27,22 +45,80 @@ jobs:
2745
env:
2846
AUTHOR_ASSOCIATION: ${{ github.event.comment.author_association }}
2947

48+
- id: resolve_requested_sha
49+
run: |
50+
requested_sha=$(echo "$REQUESTED_SHA" | tr '[:upper:]' '[:lower:]')
51+
52+
mapfile -t matches < <(
53+
gh api /repos/${{ github.repository }}/pulls/${{ github.event.issue.number }}/commits --paginate --jq '.[].sha' |
54+
awk -v sha="$requested_sha" 'index(tolower($0), sha) == 1 { print $0 }'
55+
)
56+
57+
if [[ ${#matches[@]} -eq 0 ]]
58+
then
59+
echo "Requested SHA $REQUESTED_SHA is not part of this pull request."
60+
exit 1
61+
fi
62+
63+
if [[ ${#matches[@]} -gt 1 ]]
64+
then
65+
echo "Requested SHA $REQUESTED_SHA is ambiguous for this pull request."
66+
exit 1
67+
fi
68+
69+
resolved_sha="${matches[0]}"
70+
pr_head_sha=$(gh pr view ${{ github.event.issue.number }} --json headRefOid --jq '.headRefOid')
71+
72+
if [[ "$resolved_sha" != "$pr_head_sha" ]]
73+
then
74+
echo "Requested SHA $resolved_sha is not the current PR head $pr_head_sha."
75+
exit 1
76+
fi
77+
78+
echo "resolved_sha=$resolved_sha" >> "$GITHUB_OUTPUT"
79+
echo "pr_head_sha=$pr_head_sha" >> "$GITHUB_OUTPUT"
80+
env:
81+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
82+
REQUESTED_SHA: ${{ steps.parse_command.outputs.requested_sha }}
83+
84+
- id: get_pr_head_repository
85+
run: |
86+
echo "head_repository=$(gh pr view ${{ github.event.issue.number }} --json headRepositoryOwner,headRepository --jq '.headRepositoryOwner.login + "/" + .headRepository.name')" >> "$GITHUB_OUTPUT"
87+
env:
88+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
89+
3090
outputs:
3191
in_progress_reaction_id: ${{ steps.report_in_progress.outputs.in_progress_reaction_id }}
92+
requested_sha: ${{ steps.parse_command.outputs.requested_sha }}
93+
resolved_sha: ${{ steps.resolve_requested_sha.outputs.resolved_sha }}
94+
pr_head_sha: ${{ steps.resolve_requested_sha.outputs.pr_head_sha }}
95+
head_repository: ${{ steps.get_pr_head_repository.outputs.head_repository }}
3296

3397
release:
3498
if: github.repository == 'changesets/action'
3599
timeout-minutes: 20
36100
runs-on: ubuntu-latest
37101
needs: release_check
102+
permissions:
103+
contents: write
104+
issues: write
105+
pull-requests: write
38106
steps:
39107
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
40108
- uses: ./.github/actions/ci-setup
41109

42-
- name: Checkout pull request
43-
run: gh pr checkout ${{ github.event.issue.number }}
110+
- name: Fetch validated commit from pull request head repository
111+
run: |
112+
git remote add pr-head https://github.com/$HEAD_REPOSITORY.git
113+
git fetch --no-tags pr-head $RESOLVED_SHA
44114
env:
45-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
115+
HEAD_REPOSITORY: ${{ needs.release_check.outputs.head_repository }}
116+
RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}
117+
118+
- name: Checkout validated commit
119+
run: git checkout --detach $RESOLVED_SHA
120+
env:
121+
RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}
46122

47123
- name: Check if Version Packages PR
48124
id: check_version_packages
@@ -78,7 +154,8 @@ jobs:
78154
env:
79155
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
80156

81-
- run: gh pr comment ${{ github.event.issue.number }} --body "The [${{ github.repository }}@$(git rev-parse HEAD)](https://github.com/${{ github.repository }}/commit/$(git rev-parse HEAD)) release triggered by [this comment](${{ github.event.comment.url }}) has [succeeded](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})."
157+
- run: |
158+
gh pr comment ${{ github.event.issue.number }} --body "The release for \`${{ needs.release_check.outputs.resolved_sha }}\` triggered by [this comment](${{ github.event.comment.url }}) has [succeeded](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}). Published commit: [${{ github.repository }}@$(git rev-parse HEAD)](https://github.com/${{ github.repository }}/commit/$(git rev-parse HEAD))."
82159
env:
83160
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
84161
@@ -87,6 +164,9 @@ jobs:
87164
timeout-minutes: 2
88165
runs-on: ubuntu-latest
89166
if: failure() && github.repository == 'changesets/action' && (needs.release_check.result == 'failure' || needs.release.result == 'failure')
167+
permissions:
168+
issues: write
169+
pull-requests: write
90170
steps:
91171
- run: gh api /repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions -f content='-1'
92172
env:
@@ -96,7 +176,8 @@ jobs:
96176
env:
97177
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
98178

99-
- run: gh pr comment ${{ github.event.issue.number }} --body "The release triggered by [this comment](${{ github.event.comment.url }}) has [failed](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})."
179+
- run: |
180+
gh pr comment ${{ github.event.issue.number }} --body "The release for \`${{ needs.release_check.outputs.requested_sha }}\` triggered by [this comment](${{ github.event.comment.url }}) has [failed](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})."
100181
env:
101182
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
102183
GH_REPO: ${{ github.repository }}

‎.github/workflows/version-or-publish.yml‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

0 commit comments

Comments
 (0)