Skip to content

Commit 5d8b74f

Browse files
fredbifredbi
committed
feat: allow reuse of workflows by other organizations
Problem statement ================= When using workflows such as: * contributors * bump-release * auto-merge the retrieval of secrets for commit or tag PGP-signature and token switch with a github app is currently specific to go-openapi. Proposed solution ================= The names of the secrets (not the secrets themselves) can be injected via optional input parameters into these shared workflows. Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
1 parent 6afeb7f commit 5d8b74f

File tree

3 files changed

+141
-14
lines changed

3 files changed

+141
-14
lines changed

‎.github/workflows/auto-merge.yml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,24 @@ name: Dependabot auto-merge
22

33
on:
44
workflow_call:
5+
inputs:
6+
enable-organization-bot:
7+
description: |
8+
Enable automatic approval and merge of PRs initiated by a bot.
9+
10+
type: boolean
11+
required: false
12+
default: true
13+
organization-bot:
14+
description: |
15+
The bot name for your organization,
16+
for which you wish to enable auto-merge.
17+
18+
Example: bot-go-openapi[bot]
19+
20+
type: string
21+
required: false
22+
default: 'bot-go-openapi[bot]'
523

624
permissions:
725
contents: read
@@ -50,7 +68,7 @@ jobs:
5068
contents: write
5169
pull-requests: write
5270
runs-on: ubuntu-latest
53-
if: ${{ github.event.pull_request.user.login == 'bot-go-openapi[bot]' }}
71+
if: ${{ inputs.enable-organization-bot == 'true' && github.event.pull_request.user.login == inputs.organization-bot }}
5472
env:
5573
PR_URL: ${{github.event.pull_request.html_url}}
5674
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

‎.github/workflows/bump-release.yml‎

Lines changed: 52 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,45 @@ on:
4242
(use "|" to replace end of line).
4343
required: false
4444
type: string
45+
enable-tag-signing:
46+
description: |
47+
Enable PGP tag-signing by a bot user.
48+
49+
You must specify the GPG related inputs if they differ from the default names for secrets.
50+
required: false
51+
type: boolean
52+
default: true
53+
env-gpg-private-key:
54+
description: |
55+
PGP tag-signing by a bot user.
56+
57+
This is the name of the secret to sign tags.
58+
It contains an armored GPG private key.
59+
60+
This input does not contain the secret, but the name of the secret.
61+
required: false
62+
type: string
63+
default: CI_BOT_GPG_PRIVATE_KEY
64+
env-passphrase:
65+
description: |
66+
PGP tag-signing by a bot user.
67+
68+
This is the name of the secret that contains the passphrase to unlock the GPG key.
69+
70+
This input does not contain the secret, but the name of the secret.
71+
required: false
72+
type: string
73+
default: CI_BOT_GPG_PASSPHRASE
74+
env-fingerprint:
75+
description: |
76+
PGP tag-signing by a bot user.
77+
78+
This is the name of the secret that contains the fingerprint of the GPG key.
79+
80+
This input does not contain the secret, but the name of the secret.
81+
required: false
82+
type: string
83+
default: CI_BOT_SIGNING_KEY
4584

4685
jobs:
4786
tag-release:
@@ -85,6 +124,7 @@ jobs:
85124
echo "::notice title=next-tag:${NEXT_TAG}"
86125
-
87126
name: Import GPG key
127+
if: ${{ inputs.enable-tag-signing == 'true' }}
88128
uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
89129
# This is using the GPG signature of bot-go-openapi.
90130
#
@@ -93,9 +133,9 @@ jobs:
93133
# CI_BOT_SIGNING_KEY: the fingerprint of the subkey used (space removed)
94134
# NOTE(fredbi): extracted w/ gpg -K --homedir gnupg --keyid-format LONG --with-keygrip --fingerprint --with-subkey-fingerprint
95135
with:
96-
gpg_private_key: ${{ secrets.CI_BOT_GPG_PRIVATE_KEY }}
97-
passphrase: ${{ secrets.CI_BOT_GPG_PASSPHRASE }}
98-
fingerprint: ${{ secrets.CI_BOT_SIGNING_KEY }}
136+
gpg_private_key: ${{ secrets[inputs.env-gpg-private-key] }}
137+
passphrase: ${{ secrets[inputs.env-passphrase] }}
138+
fingerprint: ${{ secrets[inputs.env-fingerprint] }}
99139
git_user_signingkey: true
100140
git_commit_gpgsign: true
101141
git_tag_gpgsign: true
@@ -115,8 +155,15 @@ jobs:
115155
fi
116156
echo "::notice title=tag-message:${MESSAGE}"
117157
118-
git tag -s -m "${MESSAGE}" "${NEXT_TAG}"
119-
git tag -v "${NEXT_TAG}"
158+
SIGNED=""
159+
if [[ '${{ inputs.enable-tag-signing }}' == 'true' ]] ; then
160+
SIGNED="-s"
161+
fi
162+
163+
git tag "${SIGNED}" -m "${MESSAGE}" "${NEXT_TAG}"
164+
if [[ -n "${SIGNED}" ]] ; then
165+
git tag -v "${NEXT_TAG}"
166+
fi
120167
git push origin "${NEXT_TAG}"
121168
122169
gh-release:

‎.github/workflows/contributors.yml‎

Lines changed: 70 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,71 @@
11
name: Contributors
22

3+
permissions:
4+
contents: read
5+
36
on:
47
workflow_call:
8+
inputs:
9+
env-app-id:
10+
description: |
11+
The name of the secret that contains the app ID of the user that creates the PR.
512
6-
permissions:
7-
contents: read
13+
This workflow exchanges the token to impersonate the app user, so we
14+
don't have issues with the github-actions user approving or merging the PR.
15+
16+
This input does not contain the secret, but the name of the secret.
17+
type: string
18+
required: false
19+
default: CI_BOT_APP_ID
20+
env-app-private-key:
21+
description: |
22+
The name of the secret that contains the app secret key of the user that creates the PR.
23+
24+
This workflow exchanges the token to impersonate the app user, so we
25+
don't have issues with the github-actions user approving or merging the PR.
26+
27+
This input does not contain the secret, but the name of the secret.
28+
type: string
29+
required: false
30+
default: CI_BOT_APP_PRIVATE_KEY
31+
enable-commit-signing:
32+
required: false
33+
type: boolean
34+
default: true
35+
env-gpg-private-key:
36+
description: |
37+
PGP tag-signing by a bot user.
38+
39+
This is the name of the secret to sign tags.
40+
It contains an armored GPG private key.
41+
Tags are not signed if not provided.
42+
43+
This input does not contain the secret, but the name of the secret.
44+
required: false
45+
type: string
46+
default: CI_BOT_GPG_PRIVATE_KEY
47+
env-passphrase:
48+
description: |
49+
PGP tag-signing by a bot user.
50+
51+
This is the name of the secret that contains the passphrase to unlock the GPG key.
52+
Tags are not signed if not provided.
53+
54+
This input does not contain the secret, but the name of the secret.
55+
required: false
56+
type: string
57+
default: CI_BOT_GPG_PASSPHRASE
58+
env-fingerprint:
59+
description: |
60+
PGP tag-signing by a bot user.
61+
62+
This is the name of the secret that contains the fingerprint of the GPG key.
63+
Tags are not signed if not provided.
64+
65+
This input does not contain the secret, but the name of the secret.
66+
required: false
67+
type: string
68+
default: CI_BOT_SIGNING_KEY
869

970
jobs:
1071
update-contributors:
@@ -36,15 +97,16 @@ jobs:
3697
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
3798
id: app-token
3899
with:
39-
app-id: ${{ secrets.CI_BOT_APP_ID }}
40-
private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
100+
app-id: ${{ secrets[inputs.env-app-id] }}
101+
private-key: ${{ secrets[inputs.env-app-private-key] }}
41102
-
42103
name: Import GPG key
43104
uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
105+
if: ${{ inputs.enable-commit-signing == 'true' }}
44106
with:
45-
gpg_private_key: ${{ secrets.CI_BOT_GPG_PRIVATE_KEY }}
46-
passphrase: ${{ secrets.CI_BOT_GPG_PASSPHRASE }}
47-
fingerprint: ${{ secrets.CI_BOT_SIGNING_KEY }}
107+
gpg_private_key: ${{ secrets[inputs.env-gpg-private-key] }}
108+
passphrase: ${{ secrets[inputs.env-passphrase] }}
109+
fingerprint: ${{ secrets[inputs.env-fingerprint] }}
48110
git_user_signingkey: true
49111
git_commit_gpgsign: true
50112
git_tag_gpgsign: true
@@ -62,7 +124,7 @@ jobs:
62124
draft: false
63125
assignees: fredbi
64126
reviewers: fredbi
65-
sign-commits: true
127+
sign-commits: ${{ inputs.enable-commit-signing }}
66128
signoff: true # DCO
67129

68130
auto-merge:

0 commit comments

Comments
 (0)