ci: fix automated release notes update (#791)

* ci: fix automated release notes update

* ci: replace ':' by '_' in SLSA file for container SHA

* Update .github/workflows/build-push.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Ron <45816308+rjaegers@users.noreply.github.com>

* test: GitHub Pull Request -> GitHub

The GitHub Pull Request extension has been renamed in the UI to just GitHub and shows PR and Issue data

* test: pin manifest to version 16

The latest version 17 manifest has a Clang-19 check, and amp-devcontainer-cpp is not yet on Clang-19

---------

Signed-off-by: Ron <45816308+rjaegers@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: rjaegers

.github/workflows/build-push.yml

@@ -135,7 +135,9 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh attestation verify --repo ${{ github.repository }} oci://${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}@${{ steps.build-and-push.outputs.digest }} --format json --jq '.[] | .attestation.bundle.dsseEnvelope | select(.payloadType == "application/vnd.in-toto+json").payload' | base64 -d | jq . > ${{ github.repository_owner }}-${{ github.event.repository.name }}-${{ matrix.flavor }}_sha256_${{ steps.build-and-push.outputs.digest }}.intoto.jsonl
+          RAW_SHA=${{ steps.build-and-push.outputs.digest }}
+          FORMATTED_SHA=${RAW_SHA//:/_}
+          gh attestation verify --repo ${{ github.repository }} oci://${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}@${{ steps.build-and-push.outputs.digest }} --format json --jq '.[] | .attestation.bundle.dsseEnvelope | select(.payloadType == "application/vnd.in-toto+json").payload' | base64 -d | jq . > "${{ github.repository_owner }}-${{ github.event.repository.name }}-${{ matrix.flavor }}_${FORMATTED_SHA}.intoto.jsonl"
           gh release upload ${{ github.ref_name }} ./*.intoto.jsonl
       - name: Update package details in release
         if: startsWith(github.ref, 'refs/tags/')

.github/workflows/release-please.yml

@@ -16,6 +16,9 @@ jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         id: token
         with:

test/cpp/features/steps/fixtures.ts

@@ -13,7 +13,7 @@ export const test = base.extend<{ codespacePage: CodespacePage }, { authenticati
     codespacePage: async ({ page }, use) => {
         const codespacePage = new CodespacePage(page);
         await codespacePage.goto();
-        await codespacePage.areExtensionsActive(['SonarQube', 'CMake', 'Live Share', 'GitHub Pull Requests']);
+        await codespacePage.areExtensionsActive(['SonarQube', 'CMake', 'Live Share', 'GitHub']);
 
         await use(codespacePage);
 

test/cpp/integration-tests.bats

@@ -6,7 +6,7 @@ setup_file() {
   # Installing the Windows SDK/CRT takes a long time.
   # When still valid, use the installation from cache.
 
-  xwin --accept-license --cache-dir ${BATS_TEST_DIRNAME}/.xwin-hash list
+  xwin --accept-license --manifest-version 16 --cache-dir ${BATS_TEST_DIRNAME}/.xwin-hash list
   HASH_LIST_MANIFEST=$(sha256sum ${BATS_TEST_DIRNAME}/.xwin-hash/dl/manifest*.json | awk '{ print $1 }')
   HASH_CACHED_MANIFEST=
 
@@ -15,7 +15,7 @@ setup_file() {
   fi
 
   if [[ $HASH_LIST_MANIFEST != $HASH_CACHED_MANIFEST ]]; then
-    xwin --accept-license --cache-dir ${BATS_TEST_DIRNAME}/.xwin-cache splat --preserve-ms-arch-notation
+    xwin --accept-license --manifest-version 16 --cache-dir ${BATS_TEST_DIRNAME}/.xwin-cache splat --preserve-ms-arch-notation
   fi
 
   ln -sf ${BATS_TEST_DIRNAME}/.xwin-cache/splat/ /winsdk