Paul Rastoin
d5c7b735d2
# Introduction Getting rid of the fine grained PAT used to dispatch to internal repositories. Repo dispatch requires the contents write permissions which is too wide for such use Refactored all senders and target to pass through a workflow dispatch instead Creating a centralize app that forges a token with actions: write only provided permissions to mitigate any token exfiltrations
89 lines
3.2 KiB
YAML
89 lines
3.2 KiB
YAML
name: Post CI Comments
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ['GraphQL and OpenAPI Breaking Changes Detection']
|
|
types: [completed]
|
|
|
|
permissions:
|
|
actions: read
|
|
|
|
jobs:
|
|
dispatch-breaking-changes:
|
|
if: github.event.workflow_run.conclusion == 'success'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Get PR number from workflow run
|
|
id: pr-info
|
|
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
|
|
with:
|
|
script: |
|
|
const runId = context.payload.workflow_run.id;
|
|
const headSha = context.payload.workflow_run.head_sha;
|
|
const headBranch = context.payload.workflow_run.head_branch;
|
|
const headRepo = context.payload.workflow_run.head_repository;
|
|
|
|
// workflow_run.pull_requests is empty for fork PRs,
|
|
// so fall back to searching by head SHA
|
|
let pullRequests = context.payload.workflow_run.pull_requests;
|
|
let prNumber;
|
|
|
|
if (pullRequests && pullRequests.length > 0) {
|
|
prNumber = pullRequests[0].number;
|
|
} else {
|
|
core.info(`pull_requests is empty (likely a fork PR), searching by SHA ${headSha}`);
|
|
const owner = context.repo.owner;
|
|
const repo = context.repo.repo;
|
|
const headLabel = `${headRepo.owner.login}:${headBranch}`;
|
|
|
|
const { data: prs } = await github.rest.pulls.list({
|
|
owner,
|
|
repo,
|
|
state: 'open',
|
|
head: headLabel,
|
|
per_page: 1,
|
|
});
|
|
|
|
if (prs.length > 0) {
|
|
prNumber = prs[0].number;
|
|
}
|
|
}
|
|
|
|
if (!prNumber) {
|
|
core.info('No pull request found for this workflow run');
|
|
core.setOutput('has_pr', 'false');
|
|
return;
|
|
}
|
|
|
|
core.setOutput('pr_number', prNumber);
|
|
core.setOutput('run_id', runId);
|
|
core.setOutput('has_pr', 'true');
|
|
core.info(`PR #${prNumber}, Run ID: ${runId}`);
|
|
|
|
- name: Mint ci-privileged dispatch token
|
|
id: app-token
|
|
if: steps.pr-info.outputs.has_pr == 'true'
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: ci-privileged
|
|
permission-actions: write
|
|
|
|
- name: Dispatch to ci-privileged
|
|
if: steps.pr-info.outputs.has_pr == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }}
|
|
RUN_ID: ${{ steps.pr-info.outputs.run_id }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
BRANCH_STATE: ${{ github.event.workflow_run.head_branch }}
|
|
run: |
|
|
gh workflow run post-breaking-changes-comment.yaml --repo twentyhq/ci-privileged --ref main \
|
|
-f pr_number="$PR_NUMBER" \
|
|
-f run_id="$RUN_ID" \
|
|
-f repo="$REPOSITORY" \
|
|
-f branch_state="$BRANCH_STATE"
|