Skip to content

Commit ebe48da

Browse files
galarghgalargh
authored
Merge pull request #139 from multiformats/master-upgrade
upgrade@25637679823
2 parents 3ad4336 + 8ba4460 commit ebe48da

28 files changed

Lines changed: 385 additions & 347 deletions

‎.github/actions/git-config-user/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ runs:
66
steps:
77
- if: github.event_name == 'workflow_dispatch'
88
run: |
9-
git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com>"
9+
git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com"
1010
git config --global user.name "${GITHUB_ACTOR}"
1111
shell: bash
1212
- if: github.event_name != 'workflow_dispatch'

‎.github/workflows/apply.yml‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ jobs:
1515
pull-requests: read
1616
name: Prepare
1717
runs-on: ubuntu-latest
18+
environment: read
1819
outputs:
1920
workspaces: ${{ steps.workspaces.outputs.this }}
2021
sha: ${{ steps.sha.outputs.result }}
@@ -23,16 +24,16 @@ jobs:
2324
shell: bash
2425
steps:
2526
- name: Checkout
26-
uses: actions/checkout@v5
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2728
- name: Discover workspaces
2829
id: workspaces
2930
run: echo "this=$(ls github | jq --raw-input '[.[0:-4]]' | jq -sc add)" >> $GITHUB_OUTPUT
3031
- name: Install pnpm
31-
uses: pnpm/action-setup@v4
32+
uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
3233
with:
3334
version: 10
3435
- name: Use Node.js lts/*
35-
uses: actions/setup-node@v6
36+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
3637
with:
3738
node-version: lts/*
3839
cache: ''
@@ -41,9 +42,9 @@ jobs:
4142
- name: Find sha for plan
4243
id: sha
4344
env:
44-
GITHUB_APP_ID: ${{ secrets.RW_GITHUB_APP_ID }}
45-
GITHUB_APP_INSTALLATION_ID: ${{ secrets[format('RW_GITHUB_APP_INSTALLATION_ID_{0}', matrix.workspace)] || secrets.RW_GITHUB_APP_INSTALLATION_ID }}
46-
GITHUB_APP_PEM_FILE: ${{ secrets.RW_GITHUB_APP_PEM_FILE }}
45+
GITHUB_APP_ID: ${{ secrets.RO_GITHUB_APP_ID }}
46+
GITHUB_APP_INSTALLATION_ID: ${{ secrets[format('RO_GITHUB_APP_INSTALLATION_ID_{0}', matrix.workspace)] || secrets.RO_GITHUB_APP_INSTALLATION_ID }}
47+
GITHUB_APP_PEM_FILE: ${{ secrets.RO_GITHUB_APP_PEM_FILE }}
4748
run: node lib/actions/find-sha-for-plan.js
4849
working-directory: scripts
4950
apply:
@@ -58,6 +59,7 @@ jobs:
5859
workspace: ${{ fromJson(needs.prepare.outputs.workspaces) }}
5960
name: Apply
6061
runs-on: ubuntu-latest
62+
environment: write
6163
env:
6264
TF_IN_AUTOMATION: 1
6365
TF_INPUT: 0
@@ -74,20 +76,28 @@ jobs:
7476
working-directory: terraform
7577
steps:
7678
- name: Checkout
77-
uses: actions/checkout@v5
79+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7880
- name: Setup terraform
79-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
81+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
8082
with:
8183
terraform_version: 1.12.0
8284
terraform_wrapper: false
8385
- name: Initialize terraform
8486
run: terraform init
85-
- name: Terraform Plan Download
87+
- name: Download reviewed terraform plan
8688
env:
8789
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8890
SHA: ${{ needs.prepare.outputs.sha }}
8991
run: gh run download -n "${TF_WORKSPACE}_${SHA}.tfplan" --repo "${GITHUB_REPOSITORY}"
90-
- name: Terraform Apply
92+
- name: Replan merged commit
9193
run: |
9294
terraform show -json > $TF_WORKSPACE.tfstate.json
93-
terraform apply -lock-timeout=0s -no-color "${TF_WORKSPACE}.tfplan"
95+
terraform plan -refresh=false -lock=false -out="${TF_WORKSPACE}.merged.tfplan" -no-color
96+
- name: Compare reviewed and merged plans
97+
run: |
98+
terraform show -no-color "${TF_WORKSPACE}.tfplan" > "${TF_WORKSPACE}.reviewed.txt"
99+
terraform show -no-color "${TF_WORKSPACE}.merged.tfplan" > "${TF_WORKSPACE}.merged.txt"
100+
diff -u "${TF_WORKSPACE}.reviewed.txt" "${TF_WORKSPACE}.merged.txt"
101+
- name: Terraform Apply
102+
run: |
103+
terraform apply -lock-timeout=0s -no-color "${TF_WORKSPACE}.merged.tfplan"

‎.github/workflows/clean.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
shell: bash
3131
steps:
3232
- name: Checkout
33-
uses: actions/checkout@v5
33+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3434
- name: Discover workspaces
3535
id: workspaces
3636
env:
@@ -53,6 +53,7 @@ jobs:
5353
workspace: ${{ fromJson(needs.prepare.outputs.workspaces) }}
5454
name: Prepare
5555
runs-on: ubuntu-latest
56+
environment: write
5657
env:
5758
TF_IN_AUTOMATION: 1
5859
TF_INPUT: 0
@@ -69,9 +70,9 @@ jobs:
6970
shell: bash
7071
steps:
7172
- name: Checkout
72-
uses: actions/checkout@v5
73+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7374
- name: Setup terraform
74-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
75+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
7576
with:
7677
terraform_version: 1.12.0
7778
terraform_wrapper: false

‎.github/workflows/cleanup.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,20 +30,21 @@ jobs:
3030
contents: write
3131
name: Clean Up
3232
runs-on: ubuntu-latest
33+
environment: push # TODO: split into read part and push part
3334
env:
3435
GITHUB_APP_ID: ${{ secrets.RO_GITHUB_APP_ID }}
3536
GITHUB_APP_INSTALLATION_ID: ${{ secrets[format('RO_GITHUB_APP_INSTALLATION_ID_{0}', github.repository_owner)] || secrets.RO_GITHUB_APP_INSTALLATION_ID }}
3637
GITHUB_APP_PEM_FILE: ${{ secrets.RO_GITHUB_APP_PEM_FILE }}
3738
TF_WORKSPACE: ${{ github.repository_owner }}
3839
steps:
3940
- name: Checkout
40-
uses: actions/checkout@v5
41+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4142
- name: Install pnpm
42-
uses: pnpm/action-setup@v4
43+
uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
4344
with:
4445
version: 10
4546
- name: Use Node.js lts/*
46-
uses: actions/setup-node@v6
47+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
4748
with:
4849
node-version: lts/*
4950
cache: ''

‎.github/workflows/fix.yml‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
skip-fix: ${{ steps.skip-fix.outputs.this }}
3636
steps:
3737
- name: Checkout
38-
uses: actions/checkout@v5
38+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3939
- if: github.event_name == 'pull_request_target'
4040
env:
4141
NUMBER: ${{ github.event.pull_request.number }}
@@ -70,6 +70,7 @@ jobs:
7070
workspace: ${{ fromJson(needs.prepare.outputs.workspaces || '[]') }}
7171
name: Fix
7272
runs-on: ubuntu-latest
73+
environment: read
7374
env:
7475
TF_IN_AUTOMATION: 1
7576
TF_INPUT: 0
@@ -82,7 +83,7 @@ jobs:
8283
TF_VAR_write_delay_ms: 300
8384
steps:
8485
- name: Checkout
85-
uses: actions/checkout@v5
86+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8687
- if: github.event_name == 'pull_request_target'
8788
env:
8889
NUMBER: ${{ github.event.pull_request.number }}
@@ -93,19 +94,19 @@ jobs:
9394
git fetch origin "pull/${NUMBER}/head"
9495
rm -rf github && git checkout "${SHA}" -- github
9596
- name: Setup terraform
96-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
97+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
9798
with:
9899
terraform_version: 1.12.0
99100
terraform_wrapper: false
100101
- name: Initialize terraform
101102
run: terraform init
102103
working-directory: terraform
103104
- name: Install pnpm
104-
uses: pnpm/action-setup@v4
105+
uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
105106
with:
106107
version: 10
107108
- name: Use Node.js lts/*
108-
uses: actions/setup-node@v6
109+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
109110
with:
110111
node-version: lts/*
111112
cache: ''
@@ -117,7 +118,7 @@ jobs:
117118
run: node lib/actions/fix-yaml-config.js
118119
working-directory: scripts
119120
- name: Upload YAML config
120-
uses: actions/upload-artifact@v4
121+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
121122
with:
122123
name: ${{ env.TF_WORKSPACE }}.yml
123124
path: github/${{ env.TF_WORKSPACE }}.yml
@@ -126,7 +127,7 @@ jobs:
126127
# NOTE(galargh, 2024-02-15): This will only work if GitHub as Code is used for a single organization
127128
- name: Comment on pull request
128129
if: github.event_name == 'pull_request_target' && steps.fix.outputs.comment
129-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
130+
uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
130131
with:
131132
header: fix
132133
number: ${{ github.event.pull_request.number }}
@@ -138,9 +139,7 @@ jobs:
138139
contents: read
139140
name: Push
140141
runs-on: ubuntu-latest
141-
env:
142-
AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
143-
AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
142+
environment: push
144143
steps:
145144
- name: Generate app token
146145
id: token
@@ -151,18 +150,18 @@ jobs:
151150
installation_retrieval_payload: ${{ secrets[format('RW_GITHUB_APP_INSTALLATION_ID_{0}', github.repository_owner)] || secrets.RW_GITHUB_APP_INSTALLATION_ID }}
152151
private_key: ${{ secrets.RW_GITHUB_APP_PEM_FILE }}
153152
- name: Checkout
154-
uses: actions/checkout@v5
153+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
155154
with:
156155
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
157156
ref: ${{ github.event.pull_request.head.sha || github.sha }}
158157
token: ${{ steps.token.outputs.token }}
159158
path: head
160159
- name: Checkout
161-
uses: actions/checkout@v5
160+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
162161
with:
163162
path: base
164163
- name: Download YAML configs
165-
uses: actions/download-artifact@v5
164+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
166165
with:
167166
path: artifacts
168167
- name: Copy YAML configs

‎.github/workflows/labels.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,20 +28,21 @@ jobs:
2828
contents: read
2929
name: Sync
3030
runs-on: ubuntu-latest
31+
environment: write
3132
env:
3233
GITHUB_APP_ID: ${{ secrets.RW_GITHUB_APP_ID }}
3334
GITHUB_APP_INSTALLATION_ID: ${{ secrets[format('RW_GITHUB_APP_INSTALLATION_ID_{0}', github.repository_owner)] || secrets.RW_GITHUB_APP_INSTALLATION_ID }}
3435
GITHUB_APP_PEM_FILE: ${{ secrets.RW_GITHUB_APP_PEM_FILE }}
3536
TF_WORKSPACE: ${{ github.repository_owner }}
3637
steps:
3738
- name: Checkout
38-
uses: actions/checkout@v5
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3940
- name: Install pnpm
40-
uses: pnpm/action-setup@v4
41+
uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
4142
with:
4243
version: 10
4344
- name: Use Node.js lts/*
44-
uses: actions/setup-node@v6
45+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
4546
with:
4647
node-version: lts/*
4748
cache: ''

‎.github/workflows/plan.yml‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
workspaces: ${{ steps.workspaces.outputs.this }}
2626
steps:
2727
- name: Checkout
28-
uses: actions/checkout@v5
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929
- if: github.event_name == 'pull_request_target'
3030
env:
3131
NUMBER: ${{ github.event.pull_request.number }}
@@ -58,6 +58,7 @@ jobs:
5858
workspace: ${{ fromJson(needs.prepare.outputs.workspaces || '[]') }}
5959
name: Plan
6060
runs-on: ubuntu-latest
61+
environment: read
6162
env:
6263
TF_IN_AUTOMATION: 1
6364
TF_INPUT: 0
@@ -70,7 +71,7 @@ jobs:
7071
TF_VAR_write_delay_ms: 300
7172
steps:
7273
- name: Checkout
73-
uses: actions/checkout@v5
74+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7475
- if: github.event_name == 'pull_request_target'
7576
env:
7677
NUMBER: ${{ github.event.pull_request.number }}
@@ -80,7 +81,7 @@ jobs:
8081
git fetch origin "pull/${NUMBER}/head"
8182
rm -rf github && git checkout "${SHA}" -- github
8283
- name: Setup terraform
83-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
84+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
8485
with:
8586
terraform_version: 1.12.0
8687
terraform_wrapper: false
@@ -93,7 +94,7 @@ jobs:
9394
terraform plan -refresh=false -lock=false -out="${TF_WORKSPACE}.tfplan" -no-color
9495
working-directory: terraform
9596
- name: Upload terraform plan
96-
uses: actions/upload-artifact@v4
97+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
9798
with:
9899
name: ${{ env.TF_WORKSPACE }}_${{ github.event.pull_request.head.sha || github.sha }}.tfplan
99100
path: terraform/${{ env.TF_WORKSPACE }}.tfplan
@@ -107,12 +108,13 @@ jobs:
107108
pull-requests: write
108109
name: Comment
109110
runs-on: ubuntu-latest
111+
environment: read
110112
env:
111113
AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
112114
AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
113115
steps:
114116
- name: Checkout
115-
uses: actions/checkout@v5
117+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
116118
- if: github.event_name == 'pull_request_target'
117119
env:
118120
NUMBER: ${{ github.event.pull_request.number }}
@@ -122,47 +124,48 @@ jobs:
122124
git fetch origin "pull/${NUMBER}/head"
123125
rm -rf github && git checkout "${SHA}" -- github
124126
- name: Setup terraform
125-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
127+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
126128
with:
127129
terraform_version: 1.12.0
128130
terraform_wrapper: false
129131
- name: Initialize terraform
130132
run: terraform init
131133
working-directory: terraform
132134
- name: Download terraform plans
133-
uses: actions/download-artifact@v5
135+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
134136
with:
135137
path: terraform
136138
- name: Show terraform plans
137139
run: |
138140
for plan in $(find . -type f -name '*.tfplan'); do
139141
echo "<details><summary>$(basename "${plan}" '.tfplan')</summary>" >> TERRAFORM_PLANS.md
140142
echo '' >> TERRAFORM_PLANS.md
141-
echo '```' >> TERRAFORM_PLANS.md
142-
echo "$(terraform show -no-color "${plan}" 2>&1)" >> TERRAFORM_PLANS.md
143-
echo '```' >> TERRAFORM_PLANS.md
143+
echo '~~~~terraform' >> TERRAFORM_PLANS.md
144+
terraform show -no-color "${plan}" 2>&1 | sed 's/^~~~~/~~~~ /' >> TERRAFORM_PLANS.md
145+
echo '~~~~' >> TERRAFORM_PLANS.md
144146
echo '' >> TERRAFORM_PLANS.md
145147
echo '</details>' >> TERRAFORM_PLANS.md
146148
done
147149
cat TERRAFORM_PLANS.md
148150
working-directory: terraform
149151
- name: Prepare comment
150152
run: |
151-
echo 'COMMENT<<EOF' >> $GITHUB_ENV
153+
delimiter="$(uuidgen)"
154+
echo "COMMENT<<${delimiter}" >> $GITHUB_ENV
152155
if [[ $(wc -c TERRAFORM_PLANS.md | cut -d' ' -f1) -ge 65000 ]]; then
153156
echo "Terraform plans are too long to post as a comment. Please inspect [Plan > Comment > Show terraform plans](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) instead." >> $GITHUB_ENV
154157
else
155158
cat TERRAFORM_PLANS.md >> $GITHUB_ENV
156159
fi
157-
echo 'EOF' >> $GITHUB_ENV
160+
echo "${delimiter}" >> $GITHUB_ENV
158161
working-directory: terraform
159162
- name: Comment on pull request
160-
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
163+
uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
161164
with:
162165
header: plan
163166
number: ${{ github.event.pull_request.number }}
164167
message: |
165-
Before merge, verify that all the following plans are correct. They will be applied as-is after the merge.
168+
Before merge, verify that all the following plans are correct. After merge, Apply will regenerate the plans from the merged commit and continue only if they match.
166169
167170
#### Terraform plans
168171
${{ env.COMMENT }}

0 commit comments

Comments
 (0)