Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

github-action: run GitHub tag/release events #236

Merged
merged 3 commits into from
May 2, 2024
Merged

github-action: run GitHub tag/release events #236

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d518161
use PAT to support GitHub events
v1v Apr 30, 2024
0d69d1a
faster
v1v Apr 30, 2024
2fff4ad
use gh release instead
v1v Apr 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 7 additions & 16 deletions .github/workflows/create-tag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,11 @@ on:
push:
branches:
- main
paths:
- package.json

permissions:
contents: write
contents: read
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The GH API to create a release (https://docs.github.com/en/rest/releases/releases?apiVersion=2022-11-28#create-a-release) says it needs:

The token must have at least one of the following permission sets:

contents:write
contents:write and workflows:write

I guess this is bypassing using the GH token for this job and instead is using the CREATE_TAG_TOKEN secret that is manually maintained for this repo?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is using the CREATE_TAG_TOKEN secret that is manually maintained for this repo?

Correct. Unfortunately, we cannot use the ephemeral GH token if GitHub events are required.

In this particular the GitHub event is needed, to be able to run the release.yml workflow.

GitHub does not support GitHub events when the actor is the GitHub bot, a way to prevent recursivity

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow

When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN, with the exception of workflow_dispatch and repository_dispatch, will not create a new workflow run


jobs:
tag:
Expand All @@ -18,18 +20,7 @@ jobs:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # also fetch tags
- uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- name: Install dependencies # This is needed to be able to run the npm list command
run: npm ci
- run: |
ELASTIC_APM_NODE_VERSION=$(npm list --depth 0 --json elastic-apm-node | jq -r '.dependencies."elastic-apm-node".version')
ELASTIC_APM_NODE_VERSION_WITH_PREFIX="v${ELASTIC_APM_NODE_VERSION}"
# if the tag does not exist
if [[ ! $(git tag -l "${ELASTIC_APM_NODE_VERSION_WITH_PREFIX}") ]]; then
git tag ${ELASTIC_APM_NODE_VERSION_WITH_PREFIX}
git push origin "refs/tags/${ELASTIC_APM_NODE_VERSION_WITH_PREFIX}"
fi


- run: make create-release
env:
GH_TOKEN: ${{ secrets.CREATE_TAG_TOKEN }}
9 changes: 9 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ PORT ?= 3000
IMAGE ?= opbeans/opbeans-node
VERSION ?= latest
LTS_ALPINE ?= 20-alpine
AGENT_VERSION=$(shell npm ls --package-lock-only elastic-apm-node --json | jq -r '.dependencies."elastic-apm-node".version')

.DEFAULT_GOAL := help

Expand Down Expand Up @@ -34,3 +35,11 @@ publish: build ## Publish docker image
clean: ## Clean autogenerated files/folders
@rm -rf bats
@rm -rf target

create-release: ## Create github release given the APM Agent version if no tag release
@if [ -z "$(shell git tag -l v$(AGENT_VERSION))" ]; then \
echo "creating tag v$(AGENT_VERSION)"; \
gh release create "v$(AGENT_VERSION)" --title="$(AGENT_VERSION)" --generate-notes; \
else \
echo "git tag $(AGENT_VERSION) already exists"; \
fi