Skip to content

Commit 5b05f79

Browse files
llucaxllucax
committed
Apply migration for repo-config v0.17.0
======================================================================== Updating generated CI workflows... Updated .github/workflows/ci-pr.yaml: updated CI pull-request workflow Updated .github/workflows/ci.yaml: updated main CI workflow ======================================================================== Fixing missed CI platform matrix migrations... Skipped .github/workflows/ci.yaml: platform matrix migration already fixed ======================================================================== Updating generated Dependabot workflows... Updated .github/workflows/auto-dependabot.yaml: updated Dependabot auto-merge workflow Updated .github/workflows/repo-config-migration.yaml: updated repo-config migration workflow ======================================================================== Creating black migration workflow... Created .github/workflows/black-migration.yaml: black formatting migration workflow ======================================================================== Updating auxiliary GitHub workflows... Updated .github/workflows/dco-merge-queue.yml: updated DCO merge queue workflow Updated .github/workflows/labeler.yml: updated labeler workflow Updated .github/workflows/release-notes-check.yml: updated release notes check workflow ======================================================================== ✅ Migration script finished successfully ✅ Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
1 parent 327894e commit 5b05f79

8 files changed

Lines changed: 185 additions & 44 deletions

File tree

‎.github/workflows/auto-dependabot.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,18 @@ on:
1212
pull_request_target:
1313

1414
permissions:
15+
# Read repository contents and Dependabot metadata used by the nested action.
1516
contents: read
17+
# The nested action also uses `github.token` internally for PR operations.
1618
pull-requests: write
1719

1820
jobs:
1921
auto-merge:
2022
name: Auto-merge Dependabot PR
2123
if: >
2224
github.actor == 'dependabot[bot]' &&
23-
!contains(github.event.pull_request.title, 'the repo-config group')
25+
!contains(github.event.pull_request.title, 'the repo-config group') &&
26+
!contains(github.event.pull_request.title, 'Bump black from ')
2427
runs-on: ubuntu-slim
2528
steps:
2629
- name: Generate GitHub App token
@@ -29,6 +32,12 @@ jobs:
2932
with:
3033
app-id: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_ID }}
3134
private-key: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_PRIVATE_KEY }}
35+
# Merge Dependabot PRs.
36+
permission-contents: write
37+
# Create the auto-merged label if it does not exist.
38+
permission-issues: write
39+
# Approve PRs, add labels, and enable auto-merge.
40+
permission-pull-requests: write
3241

3342
- name: Auto-merge Dependabot PR
3443
uses: frequenz-floss/dependabot-auto-approve@e943399cc9d76fbb6d7faae446cd57301d110165 # v1.5.0

‎.github/workflows/black-migration.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Automatic black formatting migration for Dependabot PRs
2+
#
3+
# When Dependabot upgrades black, this workflow installs the new version
4+
# and runs `black .` so the PR already contains any formatting changes
5+
# introduced by the upgrade, while leaving the PR open for review.
6+
#
7+
# Black uses calendar versioning. Only the first release of a new calendar
8+
# year may introduce formatting changes (major bump in Dependabot's terms).
9+
# Minor and patch updates within a year keep formatting stable, so they stay
10+
# in the regular Dependabot groups and are auto-merged normally.
11+
#
12+
# The companion auto-dependabot workflow skips major black PRs so they're
13+
# handled exclusively by this migration workflow.
14+
#
15+
# XXX: !!! SECURITY WARNING !!!
16+
# pull_request_target has write access to the repo, and can read secrets.
17+
# This is required because Dependabot PRs are treated as fork PRs: the
18+
# GITHUB_TOKEN is read-only and secrets are unavailable with a plain
19+
# pull_request trigger. The action mitigates the risk by:
20+
# - Never executing code from the PR (the migration script is embedded
21+
# in this workflow file on the base branch, not taken from the PR).
22+
# - Gating migration steps on github.actor == 'dependabot[bot]'.
23+
# - Running checkout with persist-credentials: false and isolating
24+
# push credentials from the migration script environment.
25+
# For more details read:
26+
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
27+
28+
name: Black Migration
29+
30+
on:
31+
merge_group: # To allow using this as a required check for merging
32+
pull_request_target:
33+
types: [opened, synchronize, reopened, labeled, unlabeled]
34+
35+
permissions:
36+
# Commit reformatted files back to the PR branch.
37+
contents: write
38+
# Create and normalize migration state labels.
39+
issues: write
40+
# Read/update pull request metadata and comments.
41+
pull-requests: write
42+
43+
jobs:
44+
black-migration:
45+
name: Migrate Black
46+
# Skip if it was triggered by the merge queue. We only need the workflow to
47+
# be executed to meet the "Required check" condition for merging, but we
48+
# don't need to actually run the job, having the job present as Skipped is
49+
# enough.
50+
if: |
51+
github.event_name == 'pull_request_target' &&
52+
github.actor == 'dependabot[bot]' &&
53+
contains(github.event.pull_request.title, 'Bump black from ')
54+
runs-on: ubuntu-24.04
55+
steps:
56+
- name: Generate token
57+
id: create-app-token
58+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
59+
with:
60+
app-id: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_ID }}
61+
private-key: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_PRIVATE_KEY }}
62+
# Push reformatted files to the PR branch.
63+
permission-contents: write
64+
# Create and normalize migration state labels.
65+
permission-issues: write
66+
# Read/update pull request metadata and labels.
67+
permission-pull-requests: write
68+
- name: Migrate
69+
uses: frequenz-floss/gh-action-dependabot-migrate@b389f72f9282346920150a67495efbae450ac07b # v1.1.0
70+
with:
71+
migration-script: |
72+
import os
73+
import subprocess
74+
import sys
75+
76+
version = os.environ["MIGRATION_VERSION"].lstrip("v")
77+
subprocess.run(
78+
[sys.executable, "-Im", "pip", "install", f"black=={version}"],
79+
check=True,
80+
)
81+
subprocess.run([sys.executable, "-Im", "black", "."], check=True)
82+
token: ${{ steps.create-app-token.outputs.token }}
83+
auto-merge-on-changes: "false"
84+
sign-commits: "true"
85+
auto-merged-label: "tool:auto-merged"
86+
migrated-label: "tool:black:migration:executed"
87+
intervention-pending-label: "tool:black:migration:intervention-pending"
88+
intervention-done-label: "tool:black:migration:intervention-done"

‎.github/workflows/ci-pr.yaml‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ name: Test PR
33
on:
44
pull_request:
55

6+
permissions:
7+
# Read repository contents for checkout and dependency resolution only.
8+
contents: read
9+
610
env:
711
# Please make sure this version is included in the `matrix`, as the
812
# `matrix` section can't use `env`, so it must be entered manually
@@ -17,10 +21,10 @@ jobs:
1721

1822
steps:
1923
- name: Setup Git
20-
uses: frequenz-floss/gh-action-setup-git@v1.0.0
24+
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
2125

2226
- name: Fetch sources
23-
uses: actions/checkout@v6
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2428
with:
2529
submodules: true
2630

@@ -43,7 +47,7 @@ jobs:
4347

4448
steps:
4549
- name: Run nox
46-
uses: frequenz-floss/gh-action-nox@v1.1.1
50+
uses: frequenz-floss/gh-action-nox@e1351cf45e05e85afc1c79ab883e06322892d34c # v1.1.0
4751
with:
4852
python-version: "3.11"
4953
nox-session: ci_checks_max
@@ -53,15 +57,15 @@ jobs:
5357
runs-on: ubuntu-24.04
5458
steps:
5559
- name: Setup Git
56-
uses: frequenz-floss/gh-action-setup-git@v1.0.0
60+
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
5761

5862
- name: Fetch sources
59-
uses: actions/checkout@v6
63+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6064
with:
6165
submodules: true
6266

6367
- name: Setup Python
64-
uses: frequenz-floss/gh-action-setup-python-with-deps@v1.0.4
68+
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
6569
with:
6670
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
6771
dependencies: .[dev-mkdocs]
@@ -70,11 +74,14 @@ jobs:
7074
env:
7175
MIKE_VERSION: gh-${{ github.job }}
7276
run: |
73-
mike deploy $MIKE_VERSION
74-
mike set-default $MIKE_VERSION
77+
# mike is installed as a console script, not a runnable module.
78+
# Run the installed script under isolated mode to avoid importing from
79+
# the workspace when building docs from checked-out code.
80+
python -I "$(command -v mike)" deploy "$MIKE_VERSION"
81+
python -I "$(command -v mike)" set-default "$MIKE_VERSION"
7582
7683
- name: Upload site
77-
uses: actions/upload-artifact@v6
84+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
7885
with:
7986
name: docs-site
8087
path: site/

0 commit comments

Comments
 (0)