Changelog v1.75.0

.github/actions/milestone-changelog/action.yml

@@ -4,9 +4,12 @@ inputs:
   milestone:
     description: Milestone object containing number and title
     required: true
-  token:
+  changelog-access-token:
     description: Github token
     required: true
+  ssdlc-tools-pull-token:
+    description: Changelog generator pull token
+    required: true
 runs:
   using: "composite"
   steps:
@@ -17,45 +20,35 @@ runs:
         echo "milestone_title=${{ fromJSON(inputs.milestone).title }}" >> $GITHUB_OUTPUT
         echo "milestone_number=${{ fromJSON(inputs.milestone).number }}" >> $GITHUB_OUTPUT
 
-    - name: Find possible sections in project structure
-      id: sections
-      uses: actions/github-script@v6.4.1
+    - name: Set up Python
+      uses: actions/setup-python@v5
       with:
-        result-encoding: string
-        script: |
-          const { find } = require('./.github/scripts/js/changelog-find-sections.js')
-          const rootDirs = [
-            ".",
-            "modules",
-            "ee/modules",
-            "ee/be/modules",
-            "ee/se/modules",
-            "ee/fe/modules",
-            "ee/se-plus/modules"
-          ]
-          const excludePatterns = [
-            "^\\.",
-            "CHANGELOG",
-            "^ee$",
-            "^modules$"
-          ]
-          const sections = find(rootDirs, excludePatterns)
-          return sections.join("\n")
+        python-version: "3.12"
+
+    - name: Install changelog generator
+      shell: bash
+      env:
+        CHANGELOG_GENERATOR_VERSION: "0.0.0+a0347187"
+      run: |
+        pip install --upgrade pip
+        pip install "deckhouse-changelog-generator==${CHANGELOG_GENERATOR_VERSION}" \
+          --index-url "https://token:${SSDLC_TOOLS_PULL_TOKEN}@fox.flant.com/api/v4/projects/5387/packages/pypi/simple"
 
     - name: Collect Changelog
       id: changelog
-      uses: deckhouse/changelog-action@v3.1.0
-      with:
-        token: ${{ inputs.token }}
-        repo: ${{ github.repository }}
-        milestone: ${{ steps.args.outputs.milestone_title }}
-        # section:forced_impact_level
-        allowed_sections: |
-          ${{ steps.sections.outputs.result }}
-          ci:low
-          dependabot:low
-          testing:low
-          tools:low
+      shell: bash
+      run: |
+        SECTIONS_FILE="${RUNNER_TEMP}/allowed-sections.txt"
+        deckhouse-write-changelog-sections \
+          --repo-root "${GITHUB_WORKSPACE}" \
+          --output "${SECTIONS_FILE}"
+
+        deckhouse-collect-changelog \
+          --repo-path "${GITHUB_WORKSPACE}" \
+          --milestone "${{ steps.args.outputs.milestone_title }}" \
+          --github-repo "${{ github.repository }}" \
+          --github-token "${{ inputs.changelog-access-token }}" \
+          --allowed-sections-file "${SECTIONS_FILE}"
 
     # Patch-version YAML changelog
     - name: Write Changelog YAML
@@ -114,5 +107,5 @@ runs:
 
           For more information, see the [changelog](https://github.com/deckhouse/deckhouse/blob/main/CHANGELOG/CHANGELOG-${{ steps.changelog.outputs.minor_version }}.md) and minor version [release changes](https://github.com/deckhouse/deckhouse/releases/tag/${{ steps.changelog.outputs.minor_version }}.0).
         labels: changelog, auto, status/backport
-        token: ${{ inputs.token }}
+        token: ${{ inputs.changelog-access-token }}
         delete-branch: true

.github/workflows/changelog-by-milestone.yml

@@ -112,16 +112,46 @@ jobs:
     name: Changelog ${{ matrix.milestone.title }}
     runs-on: ubuntu-latest
     needs: milestones
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       max-parallel: 1
       matrix:
         milestone: ${{ fromJSON( needs.milestones.outputs.list ) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v3.5.2
+        with:
+          fetch-depth: 0
+
+      - name: Split repository name
+        id: split
+        env:
+          REPO: ${{ github.repository }}
+        run: |
+          if [ $REPO == "deckhouse/deckhouse" ]; then
+            echo "name=deckhouse" >> $GITHUB_OUTPUT
+          else
+            echo "name=deckhouse-test" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Import secrets
+        id: secrets
+        uses: hashicorp/vault-action@v2
+        with:
+          url: https://seguro.flant.com
+          path: github
+          role: "${{ steps.split.outputs.name }}"
+          method: jwt
+          jwtGithubAudience: github-access-aud
+          secrets: |
+            projects/data/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/github/boatswain/CHANGELOG_ACCESS_TOKEN CHANGELOG_ACCESS_TOKEN | CHANGELOG_ACCESS_TOKEN ;
+            projects/data/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/github/fox_pull_secret SSDLC_TOOLS_PULL_TOKEN | SSDLC_TOOLS_PULL_TOKEN ;
 
       - name: Create changelog
         uses: ./.github/actions/milestone-changelog
         with:
           milestone: ${{ toJSON( matrix.milestone ) }}
-          token: ${{ secrets.CHANGELOG_ACCESS_TOKEN }}
+          changelog-access-token: ${{ steps.secrets.outputs.CHANGELOG_ACCESS_TOKEN }}
+          ssdlc-tools-pull-token: ${{ steps.secrets.outputs.SSDLC_TOOLS_PULL_TOKEN }}

.github/workflows/changelog-by-pull.yml

@@ -37,12 +37,42 @@ jobs:
       )
     name: Changelog ${{ github.event.pull_request.milestone.title }}
     runs-on: "regular"
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3.5.2
+        with:
+          fetch-depth: 0
+
+      - name: Split repository name
+        id: split
+        env:
+          REPO: ${{ github.repository }}
+        run: |
+          if [ $REPO == "deckhouse/deckhouse" ]; then
+            echo "name=deckhouse" >> $GITHUB_OUTPUT
+          else
+            echo "name=deckhouse-test" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Import secrets
+        id: secrets
+        uses: hashicorp/vault-action@v2
+        with:
+          url: https://seguro.flant.com
+          path: github
+          role: "${{ steps.split.outputs.name }}"
+          method: jwt
+          jwtGithubAudience: github-access-aud
+          secrets: |
+            projects/data/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/github/boatswain/CHANGELOG_ACCESS_TOKEN CHANGELOG_ACCESS_TOKEN | CHANGELOG_ACCESS_TOKEN ;
+            projects/data/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/github/fox_pull_secret SSDLC_TOOLS_PULL_TOKEN | SSDLC_TOOLS_PULL_TOKEN ;
 
       - name: Create changelog
         uses: ./.github/actions/milestone-changelog
         with:
           milestone: ${{ toJSON( github.event.pull_request.milestone ) }}
-          token: ${{ secrets.CHANGELOG_ACCESS_TOKEN }}
+          changelog-access-token: ${{ steps.secrets.outputs.CHANGELOG_ACCESS_TOKEN }}
+          ssdlc-tools-pull-token: ${{ steps.secrets.outputs.SSDLC_TOOLS_PULL_TOKEN }}

.github/workflows/changelog-command.yml

@@ -20,15 +20,45 @@ jobs:
   changelog:
     name: Milestone Changelog
     runs-on: "regular"
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3.5.2
+        with:
+          fetch-depth: 0
+
+      - name: Split repository name
+        id: split
+        env:
+          REPO: ${{ github.repository }}
+        run: |
+          if [ $REPO == "deckhouse/deckhouse" ]; then
+            echo "name=deckhouse" >> $GITHUB_OUTPUT
+          else
+            echo "name=deckhouse-test" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Import secrets
+        id: secrets
+        uses: hashicorp/vault-action@v2
+        with:
+          url: https://seguro.flant.com
+          path: github
+          role: "${{ steps.split.outputs.name }}"
+          method: jwt
+          jwtGithubAudience: github-access-aud
+          secrets: |
+            projects/data/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/github/boatswain/CHANGELOG_ACCESS_TOKEN CHANGELOG_ACCESS_TOKEN | CHANGELOG_ACCESS_TOKEN ;
+            projects/data/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/github/fox_pull_secret SSDLC_TOOLS_PULL_TOKEN | SSDLC_TOOLS_PULL_TOKEN ;
 
       - name: Upgrade changelog
         uses: ./.github/actions/milestone-changelog
         with:
           milestone: ${{ toJSON( github.event.client_payload.pull_request.milestone ) }}
-          token: ${{ secrets.CHANGELOG_ACCESS_TOKEN }}
+          changelog-access-token: ${{ steps.secrets.outputs.CHANGELOG_ACCESS_TOKEN }}
+          ssdlc-tools-pull-token: ${{ steps.secrets.outputs.SSDLC_TOOLS_PULL_TOKEN }}
 
       - name: Add reaction for success
         uses: peter-evans/create-or-update-comment@v1