|
1 | | -name: Increment Version on Merge |
2 | | -run-name: "${{ github.event.pull_request.merged && 'Increment version for' || 'Closing' }} PR #${{ github.event.pull_request.number }}" |
3 | | -on: |
4 | | - # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ |
5 | | - # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token |
6 | | - # |
7 | | - # GitHub's standard pull_request workflow trigger prevents write permissions and |
8 | | - # secrets access when the PR is from a public fork. PRs from branches and forks of |
9 | | - # internal/private repos are not limited the same way for the pull_request trigger. |
10 | | - # |
11 | | - # The pull_request_target trigger (which this workflow is using) relaxes some of those |
12 | | - # restrictions and allows PRs from public forks to have write permissions through the |
13 | | - # GH_TOKEN which we need in order to push new tags to the repo through this workflow. |
14 | | - # |
15 | | - # For this workflow, the elevated permissions should not be a problem because: |
16 | | - # • This workflow is only triggered when a PR is closed and the reusable workflow it |
17 | | - # calls only executes if it has been merged to the default branch. This means the PR |
18 | | - # has been reviewed and approved by a CODEOWNER and merged by someone with Write |
19 | | - # access before this workflow with its elevated permissions gets executed. Any code |
20 | | - # that doesn't meet our standards should be caught before it gets to this point. |
21 | | - # • The "Require approval for all outside collaborators" setting is set at the org-level. |
22 | | - # Before a workflow can execute for a PR generated by an outside collaborator, a user |
23 | | - # with Write access must manually approve the request to execute the workflow run. |
24 | | - # Prior to doing so they should have had a chance to review any changes in the PR |
25 | | - pull_request_target: |
26 | | - types: [closed] |
27 | | - # paths: |
28 | | - # Do not include specific paths here. reusable-increment-version-on-merge.yml will decide |
29 | | - # if this action should be incremented and if new tags should be pushed to the repo based |
30 | | - # on the same criteria used in the build-and-review-pr.yml workflow. |
31 | | - |
32 | | - |
33 | | -# ------------------------------------------------------------------------------------ |
34 | | -# NOTE: This repo duplicates the reusable increment workflow in im-open/.github that |
35 | | -# the rest of the actions use. If changes are needed in this workflow they |
36 | | -# should also be made in im-open/.github. This workflow is duplicated because |
37 | | -# it uses the local copy of itself in the workflow which allows us to test the |
38 | | -# increment build with git-version-lite changes before we merge those changes. |
39 | | -# ------------------------------------------------------------------------------------ |
40 | | - |
41 | | -jobs: |
42 | | - increment-version: |
43 | | - runs-on: ubuntu-latest |
44 | | - env: |
45 | | - MERGE_TO_MAIN: 'false' |
46 | | - |
47 | | - steps: |
48 | | - - name: Check if merge to default branch |
49 | | - id: merge |
50 | | - uses: actions/github-script@v6 |
51 | | - with: |
52 | | - script: | |
53 | | - const defaultBranch = 'main'; |
54 | | - const baseRef = '${{ github.event.pull_request.base.ref }}'; |
55 | | - const merged = ${{ github.event.pull_request.merged }}; |
56 | | -
|
57 | | - if (!merged){ |
58 | | - console.log('PR is not merged. Skipping subsequent steps.'); |
59 | | - core.exportVariable('MERGE_TO_MAIN', false); |
60 | | - return; |
61 | | - } |
62 | | - if (baseRef !== defaultBranch){ |
63 | | - console.log(`PR is merged to ${baseRef} and not ${defaultBranch}. Skipping subsequent steps.`); |
64 | | - core.exportVariable('MERGE_TO_MAIN', false); |
65 | | - return; |
66 | | - } |
67 | | - console.log(`PR is merged to ${defaultBranch}. Proceed with subsequent steps.`); |
68 | | - core.exportVariable('MERGE_TO_MAIN', true); |
69 | | -
|
70 | | - - name: Checkout |
71 | | - if: env.MERGE_TO_MAIN == 'true' |
72 | | - uses: actions/checkout@v3 |
73 | | - |
74 | | - - name: If PR is merged to main - Check for code changes to the action source code |
75 | | - if: env.MERGE_TO_MAIN == 'true' |
76 | | - id: source-code |
77 | | - uses: im-open/did-custom-action-code-change@v1 |
78 | | - with: |
79 | | - files-with-code: 'action.yml,package.json,package-lock.json' |
80 | | - folders-with-code: 'src,dist' |
81 | | - token: ${{ secrets.GITHUB_TOKEN }} |
82 | | - |
83 | | - - name: If PR is merged to main - Print whether Action Source Code Changed (open for details) |
84 | | - if: env.MERGE_TO_MAIN == 'true' |
85 | | - run: | |
86 | | - if [ "${{ steps.source-code.outputs.HAS_CHANGES }}" == "true" ]; then |
87 | | - echo "This PR changes the action's source code. Proceed with subsequent steps." |
88 | | - else |
89 | | - echo "This PR does not change the action's source code. Skipping subsequent steps." |
90 | | - fi |
91 | | -
|
92 | | - - name: If PR is merged to main & PR has source code changes - Checkout |
93 | | - if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true' |
94 | | - uses: actions/checkout@v3 |
95 | | - with: |
96 | | - ref: main |
97 | | - fetch-depth: 0 |
98 | | - |
99 | | - - name: If PR is merged to main & PR has source code changes - Get the next version for the repo |
100 | | - if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true' |
101 | | - id: version |
102 | | - uses: ./ |
103 | | - |
104 | | - - name: If PR is merged to main & PR has source code changes - Print action version (${{ steps.version.outputs.NEXT_VERSION || 'N/A'}}) |
105 | | - if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true' |
106 | | - run: echo "The next action version will be - ${{ steps.version.outputs.NEXT_VERSION }}" |
107 | | - |
108 | | - - name: If PR is merged to main & PR has source code changes - Push tags to repo |
109 | | - if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true' |
110 | | - run: | |
111 | | - git config user.name github-actions |
112 | | - git config user.email github-actions@github.com |
113 | | -
|
114 | | - git tag ${{ steps.version.outputs.NEXT_VERSION }} ${{ github.sha }} |
115 | | - git tag -f ${{ steps.version.outputs.NEXT_MAJOR_VERSION }} ${{ github.sha }} |
116 | | - git tag -f ${{ steps.version.outputs.NEXT_MINOR_VERSION }} ${{ github.sha }} |
117 | | -
|
118 | | - git push origin ${{ steps.version.outputs.NEXT_VERSION }} |
119 | | - git push origin ${{ steps.version.outputs.NEXT_MAJOR_VERSION }} -f |
120 | | - git push origin ${{ steps.version.outputs.NEXT_MINOR_VERSION }} -f |
| 1 | +name: Increment Version on Merge |
| 2 | +run-name: "${{ github.event.pull_request.merged && 'Increment version for' || 'Closing' }} PR #${{ github.event.pull_request.number }}" |
| 3 | +on: |
| 4 | + # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ |
| 5 | + # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token |
| 6 | + # |
| 7 | + # GitHub's standard pull_request workflow trigger prevents write permissions and |
| 8 | + # secrets access when the PR is from a public fork. PRs from branches and forks of |
| 9 | + # internal/private repos are not limited the same way for the pull_request trigger. |
| 10 | + # |
| 11 | + # The pull_request_target trigger (which this workflow is using) relaxes some of those |
| 12 | + # restrictions and allows PRs from public forks to have write permissions through the |
| 13 | + # GH_TOKEN which we need in order to push new tags to the repo through this workflow. |
| 14 | + # |
| 15 | + # For this workflow, the elevated permissions should not be a problem because: |
| 16 | + # • This workflow is only triggered when a PR is closed and the reusable workflow it |
| 17 | + # calls only executes if it has been merged to the default branch. This means the PR |
| 18 | + # has been reviewed and approved by a CODEOWNER and merged by someone with Write |
| 19 | + # access before this workflow with its elevated permissions gets executed. Any code |
| 20 | + # that doesn't meet our standards should be caught before it gets to this point. |
| 21 | + # • The "Require approval for all outside collaborators" setting is set at the org-level. |
| 22 | + # Before a workflow can execute for a PR generated by an outside collaborator, a user |
| 23 | + # with Write access must manually approve the request to execute the workflow run. |
| 24 | + # Prior to doing so they should have had a chance to review any changes in the PR |
| 25 | + pull_request_target: |
| 26 | + types: [closed] |
| 27 | + # paths: |
| 28 | + # Do not include specific paths here. reusable-increment-version-on-merge.yml will decide |
| 29 | + # if this action should be incremented and if new tags should be pushed to the repo based |
| 30 | + # on the same criteria used in the build-and-review-pr.yml workflow. |
| 31 | + |
| 32 | + |
| 33 | +# ------------------------------------------------------------------------------------ |
| 34 | +# NOTE: This repo duplicates the reusable increment workflow in im-open/.github that |
| 35 | +# the rest of the actions use. If changes are needed in this workflow they |
| 36 | +# should also be made in im-open/.github. This workflow is duplicated because |
| 37 | +# it uses the local copy of itself in the workflow which allows us to test the |
| 38 | +# increment build with git-version-lite changes before we merge those changes. |
| 39 | +# ------------------------------------------------------------------------------------ |
| 40 | + |
| 41 | +jobs: |
| 42 | + increment-version: |
| 43 | + runs-on: ubuntu-latest |
| 44 | + env: |
| 45 | + MERGE_TO_MAIN: 'false' |
| 46 | + |
| 47 | + steps: |
| 48 | + - name: Check if merge to default branch |
| 49 | + id: merge |
| 50 | + uses: actions/github-script@v7 |
| 51 | + with: |
| 52 | + script: | |
| 53 | + const defaultBranch = 'main'; |
| 54 | + const baseRef = '${{ github.event.pull_request.base.ref }}'; |
| 55 | + const merged = ${{ github.event.pull_request.merged }}; |
| 56 | +
|
| 57 | + if (!merged){ |
| 58 | + console.log('PR is not merged. Skipping subsequent steps.'); |
| 59 | + core.exportVariable('MERGE_TO_MAIN', false); |
| 60 | + return; |
| 61 | + } |
| 62 | + if (baseRef !== defaultBranch){ |
| 63 | + console.log(`PR is merged to ${baseRef} and not ${defaultBranch}. Skipping subsequent steps.`); |
| 64 | + core.exportVariable('MERGE_TO_MAIN', false); |
| 65 | + return; |
| 66 | + } |
| 67 | + console.log(`PR is merged to ${defaultBranch}. Proceed with subsequent steps.`); |
| 68 | + core.exportVariable('MERGE_TO_MAIN', true); |
| 69 | +
|
| 70 | + - name: Checkout |
| 71 | + if: env.MERGE_TO_MAIN == 'true' |
| 72 | + uses: actions/checkout@v4 |
| 73 | + |
| 74 | + - name: If PR is merged to main - Check for code changes to the action source code |
| 75 | + if: env.MERGE_TO_MAIN == 'true' |
| 76 | + id: source-code |
| 77 | + uses: im-open/did-custom-action-code-change@v1 |
| 78 | + with: |
| 79 | + files-with-code: 'action.yml,package.json,package-lock.json' |
| 80 | + folders-with-code: 'src,dist' |
| 81 | + token: ${{ secrets.GITHUB_TOKEN }} |
| 82 | + |
| 83 | + - name: If PR is merged to main - Print whether Action Source Code Changed (open for details) |
| 84 | + if: env.MERGE_TO_MAIN == 'true' |
| 85 | + run: | |
| 86 | + if [ "${{ steps.source-code.outputs.HAS_CHANGES }}" == "true" ]; then |
| 87 | + echo "This PR changes the action's source code. Proceed with subsequent steps." |
| 88 | + else |
| 89 | + echo "This PR does not change the action's source code. Skipping subsequent steps." |
| 90 | + fi |
| 91 | +
|
| 92 | + - name: If PR is merged to main & PR has source code changes - Checkout |
| 93 | + if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true' |
| 94 | + uses: actions/checkout@v4 |
| 95 | + with: |
| 96 | + ref: main |
| 97 | + fetch-depth: 0 |
| 98 | + |
| 99 | + - name: If PR is merged to main & PR has source code changes - Get the next version for the repo |
| 100 | + if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true' |
| 101 | + id: version |
| 102 | + uses: ./ |
| 103 | + |
| 104 | + - name: If PR is merged to main & PR has source code changes - Print action version (${{ steps.version.outputs.NEXT_VERSION || 'N/A'}}) |
| 105 | + if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true' |
| 106 | + run: echo "The next action version will be - ${{ steps.version.outputs.NEXT_VERSION }}" |
| 107 | + |
| 108 | + - name: If PR is merged to main & PR has source code changes - Push tags to repo |
| 109 | + if: env.MERGE_TO_MAIN == 'true' && steps.source-code.outputs.HAS_CHANGES == 'true' |
| 110 | + run: | |
| 111 | + git config user.name github-actions |
| 112 | + git config user.email github-actions@github.com |
| 113 | +
|
| 114 | + git tag ${{ steps.version.outputs.NEXT_VERSION }} ${{ github.sha }} |
| 115 | + git tag -f ${{ steps.version.outputs.NEXT_MAJOR_VERSION }} ${{ github.sha }} |
| 116 | + git tag -f ${{ steps.version.outputs.NEXT_MINOR_VERSION }} ${{ github.sha }} |
| 117 | +
|
| 118 | + git push origin ${{ steps.version.outputs.NEXT_VERSION }} |
| 119 | + git push origin ${{ steps.version.outputs.NEXT_MAJOR_VERSION }} -f |
| 120 | + git push origin ${{ steps.version.outputs.NEXT_MINOR_VERSION }} -f |
0 commit comments