Skip to content

Commit 4e989a4

Browse files
simonbeaudoin0935simonbeaudoin0935
authored
Merge pull request #135 from qualcomm-linux/development
Switch from pull_request_target to pull_request trigger
2 parents eeab5f8 + d73f974 commit 4e989a4

10 files changed

Lines changed: 100 additions & 117 deletions

‎.github/actions/push_to_repo/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ runs:
102102
103103
- name: Checkout Staging Repo
104104
if: steps.check-version.outputs.do_upload == 'true'
105-
uses: actions/checkout@v4
105+
uses: actions/checkout@v5
106106
with:
107107
repository: ${{env.REPO_NAME}}
108108
ref: main

‎.github/workflows/qcom-build-pkg-reusable-workflow.yml‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ on:
4646

4747
permissions:
4848
contents: read
49+
packages: read
4950

5051
jobs:
5152
build-debian-package:
@@ -58,31 +59,29 @@ jobs:
5859

5960
container:
6061
# This docker image is built and published by the qualcomm-linux/docker_deb_build repo CI workflow
61-
image: ghcr.io/qualcomm-linux/pkg-builder:arm64-${{inputs.distro-codename}}
62+
image: ghcr.io/qualcomm-linux/pkg-builder:${{inputs.distro-codename}}
6263
options: --privileged
6364
credentials:
64-
username: ${{vars.DEB_PKG_BOT_CI_USERNAME}}
65-
password: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}
65+
username: ${{ github.actor }}
66+
password: ${{ secrets.GITHUB_TOKEN }}
6667

6768
steps:
6869

6970
- name: Checkout qcom-build-utils
70-
uses: actions/checkout@v4
71+
uses: actions/checkout@v5
7172
with:
7273
repository: qualcomm-linux/qcom-build-utils
7374
ref: ${{inputs.qcom-build-utils-ref}}
74-
token: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}
7575
path: ./qcom-build-utils
7676
fetch-depth: 1
7777
sparse-checkout: |
7878
.github
7979
scripts
8080
8181
- name: Checkout Repository
82-
uses: actions/checkout@v4
82+
uses: actions/checkout@v5
8383
with:
8484
ref: ${{inputs.debian-ref}}
85-
token: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}
8685
path: ./package-repo
8786
fetch-depth: 0 # <- Important for the tags fetching to work
8887
fetch-tags: true # <- Important

‎.github/workflows/qcom-promote-prebuilt-reusable-workflow.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ on:
5050

5151
permissions:
5252
contents: write
53+
packages: read
5354
pull-requests: write
5455

5556
jobs:
@@ -63,15 +64,15 @@ jobs:
6364

6465
container:
6566
# This docker image is built and published by the qualcomm-linux/docker_deb_build repo CI workflow
66-
image: ghcr.io/qualcomm-linux/pkg-builder:arm64-noble
67+
image: ghcr.io/qualcomm-linux/pkg-builder:noble
6768
credentials:
68-
username: ${{ vars.DEB_PKG_BOT_CI_USERNAME }}
69-
password: ${{ secrets.DEB_PKG_BOT_CI_TOKEN }}
69+
username: ${{ github.actor }}
70+
password: ${{ secrets.GITHUB_TOKEN }}
7071

7172
steps:
7273

7374
- name: Checkout qcom-build-utils
74-
uses: actions/checkout@v4
75+
uses: actions/checkout@v5
7576
with:
7677
repository: qualcomm-linux/qcom-build-utils
7778
ref: ${{inputs.qcom-build-utils-ref}}
@@ -82,9 +83,8 @@ jobs:
8283
scripts
8384
8485
- name: Checkout Packaging Repo
85-
uses: actions/checkout@v4
86+
uses: actions/checkout@v5
8687
with:
87-
token: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}
8888
path: ./package-repo
8989
fetch-depth: 0
9090
fetch-tags: true
@@ -231,7 +231,7 @@ jobs:
231231
run: |
232232
cd ./package-repo
233233
234-
gh auth login --with-token <<< "${{secrets.DEB_PKG_BOT_CI_TOKEN}}"
234+
gh auth login --with-token <<< "${{secrets.GITHUB_TOKEN}}"
235235
236236
PR_TITLE="Promotion to ${{env.NEW_DEBIAN_VERSION}} (Artifactory tag: ${{inputs.new-tag}})"
237237

‎.github/workflows/qcom-promote-upstream-reusable-workflow.yml‎

Lines changed: 53 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,17 @@ on:
3131
type: string
3232
required: true
3333

34+
secrets:
35+
PAT:
36+
required: false
37+
3438
permissions:
3539
contents: write
40+
packages: read
41+
pull-requests: write
3642

3743
env:
3844
NORMALIZED_VERSION: ""
39-
DISTRIBUTION: noble
40-
4145
UPSTREAM_TAG_ALREADY_EXISTS: false
4246

4347
jobs:
@@ -50,11 +54,11 @@ jobs:
5054
shell: bash
5155

5256
container:
53-
# This docker image is built and published by the qualcomm-linux/docker_deb_build repo CI workflow
54-
image: ghcr.io/qualcomm-linux/pkg-builder:arm64-noble
57+
# This docker image is built and published by the qualcomm-linux/docker-pkg-build repo CI workflow
58+
image: ghcr.io/qualcomm-linux/pkg-builder:noble
5559
credentials:
56-
username: ${{ vars.DEB_PKG_BOT_CI_USERNAME }}
57-
password: ${{ secrets.DEB_PKG_BOT_CI_TOKEN }}
60+
username: ${{ github.actor }}
61+
password: ${{ secrets.GITHUB_TOKEN }}
5862

5963
steps:
6064

@@ -69,11 +73,10 @@ jobs:
6973
echo "ℹ️ Normalized version : $NORMALIZED_VERSION"
7074
7175
- name: Checkout qcom-build-utils
72-
uses: actions/checkout@v4
76+
uses: actions/checkout@v5
7377
with:
7478
repository: qualcomm-linux/qcom-build-utils
7579
ref: ${{inputs.qcom-build-utils-ref}}
76-
#token: Not needed for public repo
7780
path: ./qcom-build-utils
7881
fetch-depth: 1
7982
sparse-checkout: |
@@ -82,16 +85,19 @@ jobs:
8285
8386
# Fetch all history for all tags and branches
8487
- name: Checkout Repository
85-
uses: actions/checkout@v4
88+
uses: actions/checkout@v5
8689
with:
87-
token: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}
90+
token: ${{secrets.PAT}}
8891
path: ./package-repo
8992
fetch-depth: 0
9093

94+
- name: Authenticate with GitHub
95+
run : |
96+
gh auth login --with-token <<< "${{secrets.PAT}}"
97+
9198
- name: Show branches/tags and checkout debian/upstream latest
99+
working-directory: ./package-repo
92100
run: |
93-
cd ./package-repo
94-
95101
git branch
96102
git tag
97103
git checkout ${{inputs.debian-branch}}
@@ -102,20 +108,17 @@ jobs:
102108
git checkout - # Then revert back to the inputs.debian-branch branch as we will need to have it checked out for gbp later
103109
fi
104110
105-
106111
- name: Make sure the upstream tag is not already part of the repo
112+
working-directory: ./package-repo
107113
run: |
108-
cd ./package-repo
109-
110114
if (git tag --list | grep "${{inputs.upstream-tag}}"); then
111115
echo "❌ The supplied upstream tag is wrong as it pertains to this repo already."
112116
exit 1
113117
fi
114118
115119
- name: Validate the upstream tag promotion state
120+
working-directory: ./package-repo
116121
run: |
117-
cd ./package-repo
118-
119122
# Check if the upstream/<normalized_version> tag does not already exists
120123
if ! git tag --list | grep "upstream/${{env.NORMALIZED_VERSION}}"; then
121124
echo "✅ The upstream tag '${{inputs.upstream-tag}}' has not been promoted yet. Continuing."
@@ -138,7 +141,6 @@ jobs:
138141
echo "ℹ️ This is likely a second attempt to promote the same upstream tag, where the first attempt already added the upstream tag in the upstram branch"
139142
140143
# Check if there is a PR open for this already
141-
gh auth login --with-token <<< "${{secrets.DEB_PKG_BOT_CI_TOKEN}}"
142144
PRS=$(gh pr list --head "debian/pr/${{env.NORMALIZED_VERSION}}-1" --state open --json number --jq '.[].number')
143145
if [ -n "$PRS" ]; then
144146
echo "❌ An open PR already exists for this promotion attempt: $PRS"
@@ -163,20 +165,43 @@ jobs:
163165
fi
164166
165167
- name: Add Upstream Link As A Remote And Fetch Tags
168+
working-directory: ./package-repo
166169
run: |
167-
cd ./package-repo
168-
git remote add upstream-source https://x-access-token:${{secrets.DEB_PKG_BOT_CI_TOKEN}}@github.com/${{inputs.upstream-repo}}.git
169-
git fetch upstream-source "+refs/tags/*:refs/tags/*"
170+
if [ -n "${{secrets.PAT}}" ]; then
171+
echo "ℹ️ Adding upstream remote with token authentication. This is because the upstream repository may be private and require authentication to fetch tags."
172+
REPO_URL=https://x-access-token:${{secrets.PAT}}@github.com/${{inputs.upstream-repo}}.git
173+
else
174+
echo "ℹ️ Adding upstream remote without token authentication, repo is assumed to be public"
175+
REPO_URL=https://github.com/${{inputs.upstream-repo}}.git
176+
fi
177+
178+
git remote add upstream-source $REPO_URL
179+
180+
echo "ℹ️ Fetching tags from upstream repository using token authentication."
181+
182+
# Override the global extraheader set by actions/checkout (GITHUB_TOKEN) which would otherwise
183+
# take precedence over the credentials embedded in the URL and prevent access to external repos.
184+
if ! git fetch upstream-source "+refs/tags/*:refs/tags/*"; then
185+
echo "❌ Failed to fetch tags from '${{inputs.upstream-repo}}'."
186+
187+
if [ -n "${{secrets.PAT}}" ]; then
188+
echo "❌ Ensure that the PAT token has the permission on the repository."
189+
echo "❌ For more information about this token, see the README.md in qcom-build-utils repo."
190+
else
191+
echo "❌ Make sure the upstream repository is public or if it is private that the PAT token is set and has the necessary permissions."
192+
fi
193+
194+
exit 1
195+
fi
170196
171197
- name: Ensure the tag exists in the upstream repo
198+
working-directory: ./package-repo
172199
run: |
173-
cd ./package-repo
174-
175200
if ! git rev-parse --verify "refs/tags/${{inputs.upstream-tag}}" >/dev/null 2>&1; then
176201
echo "❌ The specified upstream tag '${{inputs.upstream-tag}}' does not exist in the upstream repository."
177202
exit 1
178203
fi
179-
204+
180205
- name: Pre-populate the upstream/latest branch if first promotion
181206
run: |
182207
cd ./package-repo
@@ -193,9 +218,8 @@ jobs:
193218
fi
194219
195220
- name: Merge upstream tag into packaging branch
221+
working-directory: ./package-repo
196222
run: |
197-
cd ./package-repo
198-
199223
git config user.name "${{vars.DEB_PKG_BOT_CI_NAME}}"
200224
git config user.email "${{vars.DEB_PKG_BOT_CI_EMAIL}}"
201225
@@ -206,9 +230,8 @@ jobs:
206230
../qcom-build-utils/scripts/merge_debian_packaging_upstream ${{inputs.upstream-tag}}
207231
208232
- name: Promote Changelog
233+
working-directory: ./package-repo
209234
run: |
210-
cd ./package-repo
211-
212235
export DEBFULLNAME="${{vars.DEB_PKG_BOT_CI_NAME}}"
213236
export DEBEMAIL="${{vars.DEB_PKG_BOT_CI_EMAIL}}"
214237
@@ -221,9 +244,8 @@ jobs:
221244
git commit -a -s -m "Update changelog version to ${{env.NORMALIZED_VERSION}}-1 and UNRELEASED suite"
222245
223246
- name: Push Upstream/latest and debian PR Branch
247+
working-directory: ./package-repo
224248
run: |
225-
cd ./package-repo
226-
227249
if [ "${{env.UPSTREAM_TAG_ALREADY_EXISTS}}" = "false" ]; then
228250
# This is the happy path where no previous promotion attempt was detected
229251
@@ -239,11 +261,8 @@ jobs:
239261
git push origin debian/pr/${{env.NORMALIZED_VERSION}}-1
240262
241263
- name: Open Promotion PR
264+
working-directory: ./package-repo
242265
run: |
243-
cd ./package-repo
244-
245-
gh auth login --with-token <<< "${{secrets.DEB_PKG_BOT_CI_TOKEN}}"
246-
247266
../qcom-build-utils/scripts/create_promotion_pr.py \
248267
--base-branch "${{inputs.debian-branch}}" \
249268
--upstream-tag "${{inputs.upstream-tag}}" \

‎.github/workflows/qcom-release-reusable-workflow.yml‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,14 @@ on:
3030
type: boolean
3131
default: true
3232

33+
secrets:
34+
PAT:
35+
description: Personal Access Token with repo and package permissions to the packaging repository. This is needed to push the changelog commit and tag to the packaging repository.
36+
required: false
37+
3338
permissions:
3439
contents: read
40+
packages: read
3541

3642
jobs:
3743
pkg-release:
@@ -47,16 +53,16 @@ jobs:
4753

4854
container:
4955
# This docker image is built and published by the qualcomm-linux/docker_deb_build repo CI workflow
50-
image: ghcr.io/qualcomm-linux/pkg-builder:arm64-${{inputs.distro-codename}}
56+
image: ghcr.io/qualcomm-linux/pkg-builder:${{inputs.distro-codename}}
5157
options: --privileged
5258
credentials:
53-
username: ${{vars.DEB_PKG_BOT_CI_USERNAME}}
54-
password: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}
59+
username: ${{ github.actor }}
60+
password: ${{ secrets.GITHUB_TOKEN }}
5561

5662
steps:
5763

5864
- name: Checkout qcom-build-utils
59-
uses: actions/checkout@v4
65+
uses: actions/checkout@v5
6066
with:
6167
repository: qualcomm-linux/qcom-build-utils
6268
ref: ${{inputs.qcom-build-utils-ref}}
@@ -67,9 +73,9 @@ jobs:
6773
scripts
6874
6975
- name: Checkout Packaging Repo
70-
uses: actions/checkout@v4
76+
uses: actions/checkout@v5
7177
with:
72-
token: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}
78+
token: ${{secrets.PAT}}
7379
path: ./package-repo
7480
fetch-depth: 0
7581
fetch-tags: true
@@ -117,7 +123,6 @@ jobs:
117123
118124
git log --graph --oneline -n 10 --color=always
119125
120-
#TODO pkg_repo_branch needs to be dynamic based on the branch used to call the workflow
121126
- name: Create provenance file
122127
run: |
123128
mkdir build
@@ -276,7 +281,7 @@ jobs:
276281
sed -i 's/:/_/g' *.build
277282
278283
- name: Upload build artifacts
279-
uses: actions/upload-artifact@v4
284+
uses: actions/upload-artifact@v6
280285
with:
281286
name: build-artifacts
282287
path: build/
@@ -286,7 +291,7 @@ jobs:
286291
runs-on: 'lecore-prd-u2404-arm64-xlrg-od-ephem'
287292
steps:
288293
- name: Download build artifacts
289-
uses: actions/download-artifact@v4
294+
uses: actions/download-artifact@v8
290295
with:
291296
name: build-artifacts
292297
path: build/
@@ -323,7 +328,7 @@ jobs:
323328
- name: Notify qcom-distro-images of new release via repository dispatch
324329
uses: peter-evans/repository-dispatch@v3
325330
with:
326-
token: ${{secrets.DEB_PKG_BOT_CI_TOKEN}}
331+
token: ${{secrets.PAT}}
327332
repository: qualcomm-linux/qcom-distro-images
328333
event-type: pkg-repo-release
329334
client-payload: >-

0 commit comments

Comments
 (0)