Skip to content

Commit f74d22d

Browse files
olblakolblak
authored
chore: refactor Updatecli gha workflow & fix zizmor config file (#1069)
* fix: zizmor default configuration Signed-off-by: Olivier Vernin <me@olblak.com> * chore: add updatecli labels and refactor updatecli-compose.yaml Signed-off-by: Olivier Vernin <me@olblak.com> * chore: cleanup updatecli gha workflows Signed-off-by: Olivier Vernin <me@olblak.com> * fix: updatecli release event Signed-off-by: Olivier Vernin <me@olblak.com> * fix: updatecli-compose.yaml Signed-off-by: Olivier Vernin <me@olblak.com> * fix: updatecli pipeline name Signed-off-by: Olivier Vernin <me@olblak.com> * chore: add compose file name Signed-off-by: Olivier Vernin <me@olblak.com> --------- Signed-off-by: Olivier Vernin <me@olblak.com>
1 parent 6cf3cdd commit f74d22d

File tree

9 files changed

+64
-37
lines changed

9 files changed

+64
-37
lines changed

‎.github/workflows/updatecli.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
22
name: Updatecli
33
on:
4-
release:
54
workflow_dispatch:
65
schedule:
76
# Run at 12:00 every 14 days

‎.github/workflows/updatecli_release.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
name: Updatecli - Release
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
# Run daily at 03:00
7+
- cron: "0 3 * * *"
8+
repository_dispatch:
9+
types:
10+
- "updatecli-release"
11+
permissions: {}
12+
jobs:
13+
updatecli:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: "Checkout"
17+
uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
18+
with:
19+
persist-credentials: false
20+
- name: "Setup updatecli"
21+
uses: "updatecli/updatecli-action@2cc8e6d8e356d76b0280cdd03766c36596a0614e" # v3.0.0
22+
with:
23+
version: "v0.115.0"
24+
- name: "Run updatecli only on Updatecli release event"
25+
run: updatecli compose apply --clean-git-branches=true --labels="release:updatecli" --experimental
26+
env:
27+
UPDATECLI_GITHUB_APP_CLIENT_ID: ${{ secrets.UPDATECLIBOT_APP_ID }}
28+
UPDATECLI_GITHUB_APP_PRIVATE_KEY: ${{ secrets.UPDATECLIBOT_APP_PRIVKEY }}
29+
UPDATECLI_GITHUB_APP_INSTALLATION_ID: ${{ secrets.UPDATECLIBOT_APP_INSTALLATION_ID }}
30+
UPDATECLI_UDASH_API_URL: ${{ secrets.UPDATECLI_UDASH_API_URL }}
31+
UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UPDATECLI_UDASH_ACCESS_TOKEN }}
32+
UPDATECLI_UDASH_URL: ${{ secrets.UPDATECLI_UDASH_URL }}

‎.github/workflows/updatecli_update.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,15 @@ jobs:
2222
with:
2323
version: "v0.115.0"
2424
- name: "Run updatecli only on monitored pipelines"
25-
run: updatecli compose apply --clean-git-branches=true --labels="monitoring:enabled" --experimental
25+
run: updatecli compose apply --clean-git-branches=true --labels="monitor:active" --experimental
2626
env:
2727
UPDATECLI_GITHUB_APP_CLIENT_ID: ${{ secrets.UPDATECLIBOT_APP_ID }}
2828
UPDATECLI_GITHUB_APP_PRIVATE_KEY: ${{ secrets.UPDATECLIBOT_APP_PRIVKEY }}
2929
UPDATECLI_GITHUB_APP_INSTALLATION_ID: ${{ secrets.UPDATECLIBOT_APP_INSTALLATION_ID }}
3030
UPDATECLI_UDASH_API_URL: ${{ secrets.UPDATECLI_UDASH_API_URL }}
3131
UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UPDATECLI_UDASH_ACCESS_TOKEN }}
3232
UPDATECLI_UDASH_URL: ${{ secrets.UPDATECLI_UDASH_URL }}
33+
3334
- name: "Run updatecli only on existing pipelines"
3435
run: updatecli compose apply --clean-git-branches=true --existing-only=true --experimental
3536
env:

‎.github/zizmor.yaml‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,3 @@
11
rules:
22
secrets-outside-env:
3-
config:
4-
allow:
5-
- UPDATECLIBOT_APP_ID
6-
- UPDATECLIBOT_APP_PRIVKEY
7-
- UPDATECLIBOT_APP_INSTALLATION_ID
8-
- UPDATECLI_UDASH_API_URL
9-
- UPDATECLI_UDASH_ACCESS_TOKEN
10-
- UPDATECLI_UDASH_URL
3+
disable: true

‎updatecli-compose.yaml‎

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,51 @@
1+
name: Default Update Policies
2+
13
policies:
24
- name: Local Updatecli Website Policies
35
config:
46
- updatecli/updatecli.d/
57
values:
68
- updatecli/values.d/scm.yaml
79

8-
- name: Handle Nodejs version in githubaction
9-
policy: ghcr.io/updatecli/policies/nodejs/githubaction:0.11.1@sha256:812c245adc1f20767ca912baf3087022c78e8153a3f27d43729dd8931864f8e3
10+
- name: Update Updatecli policies
11+
policy: ghcr.io/updatecli/policies/updatecli/autodiscovery:0.8.1@sha256:f8edda1a6cbf0d7274e2b847ede29fc4dc70dd5302ccb8575ae21b069cc0d8a0
1012
values:
1113
- updatecli/values.d/scm.yaml
12-
- updatecli/values.d/nodejs.yaml
14+
valuesinline:
15+
pipeline:
16+
labels:
17+
ecosystem: "updatecli"
18+
monitor: active
1319

14-
- name: Update Updatecli policies
15-
policy: ghcr.io/updatecli/policies/updatecli/autodiscovery:0.8.1@sha256:f8edda1a6cbf0d7274e2b847ede29fc4dc70dd5302ccb8575ae21b069cc0d8a0
20+
- name: Handle Updatecli version in GitHub action
21+
policy: ghcr.io/updatecli/policies/updatecli/githubaction:0.8.1@sha256:48872bbf1a09cfff32ff5ffa07086c20b40d6888c19c36048b18f84bbdad37fe
1622
values:
1723
- updatecli/values.d/scm.yaml
24+
valuesinline:
25+
pipeline:
26+
labels:
27+
ecosystem: "updatecli"
28+
monitor: active
1829

1930
- name: NPM autodiscovery
2031
policy: ghcr.io/updatecli/policies/npm/autodiscovery:0.12.1@sha256:ab02848169d584d7510ab974ec4a27309d9737068b1d888df6a8388a3dad26fc
2132
values:
2233
- updatecli/values.d/scm.yaml
23-
- updatecli/values.d/npm.yaml
34+
valuesinline:
35+
automerge: true
36+
groupby: individual
37+
spec:
38+
ignoreversionconstraints: true
2439

25-
- name: Handle Updatecli version in GitHub action
26-
policy: ghcr.io/updatecli/policies/updatecli/githubaction:0.8.1@sha256:48872bbf1a09cfff32ff5ffa07086c20b40d6888c19c36048b18f84bbdad37fe
40+
- name: Handle Nodejs version in githubaction
41+
policy: ghcr.io/updatecli/policies/nodejs/githubaction:0.11.1@sha256:812c245adc1f20767ca912baf3087022c78e8153a3f27d43729dd8931864f8e3
2742
values:
2843
- updatecli/values.d/scm.yaml
44+
valuesinline:
45+
versionpattern: "~24"
46+
automerge: true
2947

3048
- name: Handle GitHub action version update
3149
policy: ghcr.io/updatecli/policies/autodiscovery/githubaction:0.4.1@sha256:869b676074f9fee7edd5d488140a12c3b09a5f8a175f12f26ea85a4f8bd0a9d1
3250
values:
3351
- updatecli/values.d/scm.yaml
34-
- updatecli/values.d/githubaction.yaml
35-
36-
- name: Update Updatecli version in GitHub action
37-
policy: ghcr.io/updatecli/policies/updatecli/githubaction:0.8.1@sha256:48872bbf1a09cfff32ff5ffa07086c20b40d6888c19c36048b18f84bbdad37fe
38-
values:
39-
- updatecli/values.d/scm.yaml
40-
- updatecli/values.d/githubaction.yaml

‎updatecli/updatecli.d/updatecli.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@ name: "deps: bump updatecli version"
22
pipelineid: "updatecli_action_version"
33

44
labels:
5-
event: release
6-
monitoring: enabled
5+
ecosystem: updatecli
6+
monitor: active
7+
release: updatecli
78

89
actions:
910
default:

‎updatecli/values.d/githubaction.yaml‎

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎updatecli/values.d/nodejs.yaml‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎updatecli/values.d/npm.yaml‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

0 commit comments

Comments
 (0)