From 3ea7403b6f38ed53af9dc67ce48b7188f306c98b Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Mon, 4 Aug 2025 14:04:12 -0700 Subject: [PATCH] update version and docs on website after release by creating a PR instead of doing a direct commit to the main branch --- pipelines/main/pipeline.yml | 22 +++++++++---------- pipelines/security-scan/pipeline.yml | 4 ++++ .../shared-tasks/create-or-update-pr/task.sh | 22 ++++++++++--------- .../shared-tasks/create-or-update-pr/task.yml | 5 ++++- 4 files changed, 30 insertions(+), 23 deletions(-) diff --git a/pipelines/main/pipeline.yml b/pipelines/main/pipeline.yml index 0c82b91a3..ba522a525 100644 --- a/pipelines/main/pipeline.yml +++ b/pipelines/main/pipeline.yml @@ -324,16 +324,6 @@ resources: branch: main username: ((ci-bot-access-token-with-read-only-public-repos)) - - name: pinniped-write - type: git - icon: github - check_every: 10m - source: - uri: https://github.com/vmware/pinniped.git - branch: main - username: ((ci-bot-username)) - password: ((ci-bot-access-token-with-public-repo-write-permission)) - - name: pinniped-ci type: git icon: github @@ -2725,9 +2715,17 @@ jobs: timeout: 30m file: pinniped-ci/pipelines/shared-tasks/update-version-and-cli-docs/task.yml input_mapping: { pinniped-in: pinniped } - - put: pinniped-write + - task: create-or-update-pr + image: gh-cli-image + file: pinniped-ci/pipelines/shared-tasks/create-or-update-pr/task.yml params: - repository: pinniped-out + GH_TOKEN: ((ci-bot-access-token-with-public-repo-write-permission)) + BRANCH: "pinny/update-version-and-cli-docs" + COMMIT_MESSAGE: "Update version and CLI docs on website" + PR_TITLE: "Update version and CLI docs on website" + PR_BODY: "Automatically updated latest version number and CLI docs on website as a result of releasing a new version of Pinniped." + input_mapping: + pinniped: pinniped-out - name: update-homebrew-formula public: true # all logs are publicly visible diff --git a/pipelines/security-scan/pipeline.yml b/pipelines/security-scan/pipeline.yml index 9eb9b4415..146a157ac 100644 --- a/pipelines/security-scan/pipeline.yml +++ b/pipelines/security-scan/pipeline.yml @@ -264,6 +264,10 @@ jobs: file: pinniped-ci/pipelines/shared-tasks/create-or-update-pr/task.yml params: GH_TOKEN: ((ci-bot-access-token-with-public-repo-write-permission)) + BRANCH: "pinny/bump-deps" + COMMIT_MESSAGE: "Bump dependencies" + PR_TITLE: "Bump dependencies" + PR_BODY: "Automatically bumped all go.mod direct dependencies and/or images in dockerfiles." input_mapping: pinniped: pinniped-out diff --git a/pipelines/shared-tasks/create-or-update-pr/task.sh b/pipelines/shared-tasks/create-or-update-pr/task.sh index c1e4ebf91..4364043c2 100755 --- a/pipelines/shared-tasks/create-or-update-pr/task.sh +++ b/pipelines/shared-tasks/create-or-update-pr/task.sh @@ -5,7 +5,10 @@ set -euo pipefail -branch="${BRANCH:-"pinny/bump-deps"}" +if [[ -z "${BRANCH:-}" || -z "${COMMIT_MESSAGE:-}" || -z "${PR_TITLE:-}" || -z "${PR_BODY:-}" ]]; then + echo "BRANCH, COMMIT_MESSAGE, PR_TITLE, and PR_BODY env vars are all required" + exit 1 +fi cd pinniped @@ -33,9 +36,9 @@ fi # Check if the branch already exists on the remote. new_branch="no" -if [[ -z "$(git ls-remote https_origin "$branch")" ]]; then +if [[ -z "$(git ls-remote https_origin "$BRANCH")" ]]; then echo "The branch does not already exist, so create it." - git checkout -b "$branch" + git checkout -b "$BRANCH" git status new_branch="yes" else @@ -46,7 +49,7 @@ else # Fetch all the remote branches so we can use one of them. git fetch https_origin # The branch already exists, so reuse it. - git checkout "$branch" + git checkout "$BRANCH" # Pull to sync up commits with the remote branch. git pull --rebase --autostash # Throw away all previous commits on the branch and set it up to look like main again. @@ -64,14 +67,14 @@ git --no-pager diff --staged echo # Commit. -echo "Committing changes to branch $branch. New branch? $new_branch." -git commit -m "Bump dependencies" +echo "Committing changes to branch $BRANCH. New branch? $new_branch." +git commit -m "$COMMIT_MESSAGE" # Push. if [[ "$new_branch" == "yes" ]]; then # Push the new branch to the remote. echo "Pushing the new branch." - git push --set-upstream https_origin "$branch" + git push --set-upstream https_origin "$BRANCH" else # Force push the existing branch to the remote. echo "Force pushing the existing branch." @@ -81,11 +84,10 @@ fi # Now check if there is already a PR open for our branch. # If there is already an open PR, then we just updated it by force pushing the branch. # Note that using the gh CLI without login depends on setting the GH_TOKEN env var. -open_pr=$(gh pr list --head "$branch" --json title --jq '. | length') +open_pr=$(gh pr list --head "$BRANCH" --json title --jq '. | length') if [[ "$open_pr" == "0" ]]; then # There is no currently open PR for this branch, so open a new PR for this branch # against main, and set the title and body. echo "Creating PR." - gh pr create --head "$branch" --base main \ - --title "Bump dependencies" --body "Automatically bumped all go.mod direct dependencies and/or images in dockerfiles." + gh pr create --head "$BRANCH" --base main --title "$PR_TITLE" --body "$PR_BODY" fi diff --git a/pipelines/shared-tasks/create-or-update-pr/task.yml b/pipelines/shared-tasks/create-or-update-pr/task.yml index 862616096..7ba95701f 100644 --- a/pipelines/shared-tasks/create-or-update-pr/task.yml +++ b/pipelines/shared-tasks/create-or-update-pr/task.yml @@ -1,4 +1,4 @@ -# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved. +# Copyright 2020-2025 the Pinniped contributors. All Rights Reserved. # SPDX-License-Identifier: Apache-2.0 --- @@ -10,5 +10,8 @@ params: DEPLOY_KEY: GH_TOKEN: BRANCH: + COMMIT_MESSAGE: + PR_TITLE: + PR_BODY: run: path: pinniped-ci/pipelines/shared-tasks/create-or-update-pr/task.sh