update version and docs on website after release by creating a PR

instead of doing a direct commit to the main branch

pipelines/main/pipeline.yml

@@ -324,16 +324,6 @@ resources:
       branch: main
       username: ((ci-bot-access-token-with-read-only-public-repos))
 
-  - name: pinniped-write
-    type: git
-    icon: github
-    check_every: 10m
-    source:
-      uri: https://github.com/vmware/pinniped.git
-      branch: main
-      username: ((ci-bot-username))
-      password: ((ci-bot-access-token-with-public-repo-write-permission))
-
   - name: pinniped-ci
     type: git
     icon: github
@@ -2725,9 +2715,17 @@ jobs:
         timeout: 30m
         file: pinniped-ci/pipelines/shared-tasks/update-version-and-cli-docs/task.yml
         input_mapping: { pinniped-in: pinniped }
-      - put: pinniped-write
+      - task: create-or-update-pr
+        image: gh-cli-image
+        file: pinniped-ci/pipelines/shared-tasks/create-or-update-pr/task.yml
         params:
-          repository: pinniped-out
+          GH_TOKEN: ((ci-bot-access-token-with-public-repo-write-permission))
+          BRANCH: "pinny/update-version-and-cli-docs"
+          COMMIT_MESSAGE: "Update version and CLI docs on website"
+          PR_TITLE: "Update version and CLI docs on website"
+          PR_BODY: "Automatically updated latest version number and CLI docs on website as a result of releasing a new version of Pinniped."
+        input_mapping:
+          pinniped: pinniped-out
 
   - name: update-homebrew-formula
     public: true # all logs are publicly visible

pipelines/security-scan/pipeline.yml

@@ -264,6 +264,10 @@ jobs:
         file: pinniped-ci/pipelines/shared-tasks/create-or-update-pr/task.yml
         params:
           GH_TOKEN: ((ci-bot-access-token-with-public-repo-write-permission))
+          BRANCH: "pinny/bump-deps"
+          COMMIT_MESSAGE: "Bump dependencies"
+          PR_TITLE: "Bump dependencies"
+          PR_BODY: "Automatically bumped all go.mod direct dependencies and/or images in dockerfiles."
         input_mapping:
           pinniped: pinniped-out
 

pipelines/shared-tasks/create-or-update-pr/task.sh

@@ -5,7 +5,10 @@
 
 set -euo pipefail
 
-branch="${BRANCH:-"pinny/bump-deps"}"
+if [[ -z "${BRANCH:-}" || -z "${COMMIT_MESSAGE:-}" || -z "${PR_TITLE:-}" || -z "${PR_BODY:-}" ]]; then
+  echo "BRANCH, COMMIT_MESSAGE, PR_TITLE, and PR_BODY env vars are all required"
+  exit 1
+fi
 
 cd pinniped
 
@@ -33,9 +36,9 @@ fi
 
 # Check if the branch already exists on the remote.
 new_branch="no"
-if [[ -z "$(git ls-remote https_origin "$branch")" ]]; then
+if [[ -z "$(git ls-remote https_origin "$BRANCH")" ]]; then
   echo "The branch does not already exist, so create it."
-  git checkout -b "$branch"
+  git checkout -b "$BRANCH"
   git status
   new_branch="yes"
 else
@@ -46,7 +49,7 @@ else
   # Fetch all the remote branches so we can use one of them.
   git fetch https_origin
   # The branch already exists, so reuse it.
-  git checkout "$branch"
+  git checkout "$BRANCH"
   # Pull to sync up commits with the remote branch.
   git pull --rebase --autostash
   # Throw away all previous commits on the branch and set it up to look like main again.
@@ -64,14 +67,14 @@ git --no-pager diff --staged
 echo
 
 # Commit.
-echo "Committing changes to branch $branch. New branch? $new_branch."
-git commit -m "Bump dependencies"
+echo "Committing changes to branch $BRANCH. New branch? $new_branch."
+git commit -m "$COMMIT_MESSAGE"
 
 # Push.
 if [[ "$new_branch" == "yes" ]]; then
   # Push the new branch to the remote.
   echo "Pushing the new branch."
-  git push --set-upstream https_origin "$branch"
+  git push --set-upstream https_origin "$BRANCH"
 else
   # Force push the existing branch to the remote.
   echo "Force pushing the existing branch."
@@ -81,11 +84,10 @@ fi
 # Now check if there is already a PR open for our branch.
 # If there is already an open PR, then we just updated it by force pushing the branch.
 # Note that using the gh CLI without login depends on setting the GH_TOKEN env var.
-open_pr=$(gh pr list --head "$branch" --json title --jq '. | length')
+open_pr=$(gh pr list --head "$BRANCH" --json title --jq '. | length')
 if [[ "$open_pr" == "0" ]]; then
   # There is no currently open PR for this branch, so open a new PR for this branch
   # against main, and set the title and body.
   echo "Creating PR."
-  gh pr create --head "$branch" --base main \
-    --title "Bump dependencies" --body "Automatically bumped all go.mod direct dependencies and/or images in dockerfiles."
+  gh pr create --head "$BRANCH" --base main --title "$PR_TITLE" --body "$PR_BODY"
 fi

pipelines/shared-tasks/create-or-update-pr/task.yml

@@ -1,4 +1,4 @@
-# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 ---
@@ -10,5 +10,8 @@ params:
   DEPLOY_KEY:
   GH_TOKEN:
   BRANCH:
+  COMMIT_MESSAGE:
+  PR_TITLE:
+  PR_BODY:
 run:
   path: pinniped-ci/pipelines/shared-tasks/create-or-update-pr/task.sh