Skip to content

Commit da235be

Browse files
llucaxllucax
authored
Apply repo-config migration from 0.16.0 to 0.17.0 (#527)
For some reason the dependabot PR (#507) updated the dependency to v0.17.0 but the PR and commit description said it was updated to v0.16.0, so the migration script ran for v0.15.0 and v0.16.0 but not v0.17.0. We now run the missing migration. Output: ``` Updating generated CI workflows... Updated .github/workflows/ci-pr.yaml: updated CI pull-request workflow Updated .github/workflows/ci.yaml: updated main CI workflow ======================================================================== Fixing missed CI platform matrix migrations... Skipped .github/workflows/ci.yaml: platform matrix migration already fixed ======================================================================== Updating generated Dependabot workflows... Updated .github/workflows/auto-dependabot.yaml: updated Dependabot auto-merge workflow Updated .github/workflows/repo-config-migration.yaml: updated repo-config migration workflow ======================================================================== Creating black migration workflow... Created .github/workflows/black-migration.yaml: black formatting migration workflow ======================================================================== Updating auxiliary GitHub workflows... Updated .github/workflows/dco-merge-queue.yml: updated DCO merge queue workflow Updated .github/workflows/labeler.yml: updated labeler workflow Updated .github/workflows/release-notes-check.yml: updated release notes check workflow ```
2 parents ca94a1e + f2eda99 commit da235be

8 files changed

Lines changed: 183 additions & 40 deletions

File tree

‎.github/workflows/auto-dependabot.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,18 @@ on:
1212
pull_request_target:
1313

1414
permissions:
15+
# Read repository contents and Dependabot metadata used by the nested action.
1516
contents: read
17+
# The nested action also uses `github.token` internally for PR operations.
1618
pull-requests: write
1719

1820
jobs:
1921
auto-merge:
2022
name: Auto-merge Dependabot PR
2123
if: >
2224
github.actor == 'dependabot[bot]' &&
23-
!contains(github.event.pull_request.title, 'the repo-config group')
25+
!contains(github.event.pull_request.title, 'the repo-config group') &&
26+
!contains(github.event.pull_request.title, 'Bump black from ')
2427
runs-on: ubuntu-slim
2528
steps:
2629
- name: Generate GitHub App token
@@ -29,6 +32,12 @@ jobs:
2932
with:
3033
app-id: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_ID }}
3134
private-key: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_PRIVATE_KEY }}
35+
# Merge Dependabot PRs.
36+
permission-contents: write
37+
# Create the auto-merged label if it does not exist.
38+
permission-issues: write
39+
# Approve PRs, add labels, and enable auto-merge.
40+
permission-pull-requests: write
3241

3342
- name: Auto-merge Dependabot PR
3443
uses: frequenz-floss/dependabot-auto-approve@e943399cc9d76fbb6d7faae446cd57301d110165 # v1.5.0

‎.github/workflows/black-migration.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Automatic black formatting migration for Dependabot PRs
2+
#
3+
# When Dependabot upgrades black, this workflow installs the new version
4+
# and runs `black .` so the PR already contains any formatting changes
5+
# introduced by the upgrade, while leaving the PR open for review.
6+
#
7+
# Black uses calendar versioning. Only the first release of a new calendar
8+
# year may introduce formatting changes (major bump in Dependabot's terms).
9+
# Minor and patch updates within a year keep formatting stable, so they stay
10+
# in the regular Dependabot groups and are auto-merged normally.
11+
#
12+
# The companion auto-dependabot workflow skips major black PRs so they're
13+
# handled exclusively by this migration workflow.
14+
#
15+
# XXX: !!! SECURITY WARNING !!!
16+
# pull_request_target has write access to the repo, and can read secrets.
17+
# This is required because Dependabot PRs are treated as fork PRs: the
18+
# GITHUB_TOKEN is read-only and secrets are unavailable with a plain
19+
# pull_request trigger. The action mitigates the risk by:
20+
# - Never executing code from the PR (the migration script is embedded
21+
# in this workflow file on the base branch, not taken from the PR).
22+
# - Gating migration steps on github.actor == 'dependabot[bot]'.
23+
# - Running checkout with persist-credentials: false and isolating
24+
# push credentials from the migration script environment.
25+
# For more details read:
26+
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
27+
28+
name: Black Migration
29+
30+
on:
31+
merge_group: # To allow using this as a required check for merging
32+
pull_request_target:
33+
types: [opened, synchronize, reopened, labeled, unlabeled]
34+
35+
permissions:
36+
# Commit reformatted files back to the PR branch.
37+
contents: write
38+
# Create and normalize migration state labels.
39+
issues: write
40+
# Read/update pull request metadata and comments.
41+
pull-requests: write
42+
43+
jobs:
44+
black-migration:
45+
name: Migrate Black
46+
# Skip if it was triggered by the merge queue. We only need the workflow to
47+
# be executed to meet the "Required check" condition for merging, but we
48+
# don't need to actually run the job, having the job present as Skipped is
49+
# enough.
50+
if: |
51+
github.event_name == 'pull_request_target' &&
52+
github.actor == 'dependabot[bot]' &&
53+
contains(github.event.pull_request.title, 'Bump black from ')
54+
runs-on: ubuntu-24.04
55+
steps:
56+
- name: Generate token
57+
id: create-app-token
58+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
59+
with:
60+
app-id: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_ID }}
61+
private-key: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_PRIVATE_KEY }}
62+
# Push reformatted files to the PR branch.
63+
permission-contents: write
64+
# Create and normalize migration state labels.
65+
permission-issues: write
66+
# Read/update pull request metadata and labels.
67+
permission-pull-requests: write
68+
- name: Migrate
69+
uses: frequenz-floss/gh-action-dependabot-migrate@b389f72f9282346920150a67495efbae450ac07b # v1.1.0
70+
with:
71+
migration-script: |
72+
import os
73+
import subprocess
74+
import sys
75+
76+
version = os.environ["MIGRATION_VERSION"].lstrip("v")
77+
subprocess.run(
78+
[sys.executable, "-Im", "pip", "install", f"black=={version}"],
79+
check=True,
80+
)
81+
subprocess.run([sys.executable, "-Im", "black", "."], check=True)
82+
token: ${{ steps.create-app-token.outputs.token }}
83+
auto-merge-on-changes: "false"
84+
sign-commits: "true"
85+
auto-merged-label: "tool:auto-merged"
86+
migrated-label: "tool:black:migration:executed"
87+
intervention-pending-label: "tool:black:migration:intervention-pending"
88+
intervention-done-label: "tool:black:migration:intervention-done"

‎.github/workflows/ci-pr.yaml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ name: Test PR
33
on:
44
pull_request:
55

6+
permissions:
7+
# Read repository contents for checkout and dependency resolution only.
8+
contents: read
9+
610
env:
711
# Please make sure this version is included in the `matrix`, as the
812
# `matrix` section can't use `env`, so it must be entered manually
@@ -17,7 +21,7 @@ jobs:
1721

1822
steps:
1923
- name: Run nox
20-
uses: frequenz-floss/gh-action-nox@v1.1.1
24+
uses: frequenz-floss/gh-action-nox@e1351cf45e05e85afc1c79ab883e06322892d34c # v1.1.0
2125
with:
2226
python-version: "3.11"
2327
nox-session: ci_checks_max
@@ -27,15 +31,15 @@ jobs:
2731
runs-on: ubuntu-24.04
2832
steps:
2933
- name: Setup Git
30-
uses: frequenz-floss/gh-action-setup-git@v1.0.0
34+
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
3135

3236
- name: Fetch sources
33-
uses: actions/checkout@v6
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3438
with:
3539
submodules: true
3640

3741
- name: Setup Python
38-
uses: frequenz-floss/gh-action-setup-python-with-deps@v1.0.4
42+
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
3943
with:
4044
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
4145
dependencies: .[dev-mkdocs]
@@ -44,11 +48,14 @@ jobs:
4448
env:
4549
MIKE_VERSION: gh-${{ github.job }}
4650
run: |
47-
mike deploy $MIKE_VERSION
48-
mike set-default $MIKE_VERSION
51+
# mike is installed as a console script, not a runnable module.
52+
# Run the installed script under isolated mode to avoid importing from
53+
# the workspace when building docs from checked-out code.
54+
python -I "$(command -v mike)" deploy "$MIKE_VERSION"
55+
python -I "$(command -v mike)" set-default "$MIKE_VERSION"
4956
5057
- name: Upload site
51-
uses: actions/upload-artifact@v7
58+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
5259
with:
5360
name: docs-site
5461
path: site/

0 commit comments

Comments
 (0)