Bump webhook in rancher/rancher #196
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Bump webhook in rancher/rancher | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| rancher_ref: | |
| description: "Submit PR against the following rancher/rancher branch (eg: main)" | |
| required: true | |
| default: "release/v2.13" | |
| prev_webhook: | |
| description: "Previous Webhook version (eg: v0.5.0-rc.13)" | |
| required: true | |
| default: "" | |
| new_webhook: | |
| description: "New Webhook version (eg: v0.5.0-rc.14)" | |
| required: true | |
| default: "" | |
| env: | |
| RANCHER_REF: ${{ github.event.inputs.rancher_ref }} | |
| WEBHOOK_REF: "${{ github.ref_name }}" | |
| PREV_WEBHOOK: ${{ github.event.inputs.prev_webhook }} | |
| NEW_WEBHOOK: ${{ github.event.inputs.new_webhook }} | |
| jobs: | |
| create-rancher-pr: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Required for vault | |
| id-token: write | |
| steps: | |
| - name: Install dependencies | |
| run: sudo snap install yq --channel=v4/stable | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| with: | |
| ref: "${{ env.WEBHOOK_REF }}" | |
| path: webhook | |
| - uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3 | |
| with: | |
| secrets: | | |
| secret/data/github/repo/${{ github.repository }}/github/app-credentials appId | APP_ID ; | |
| secret/data/github/repo/${{ github.repository }}/github/app-credentials privateKey | PRIVATE_KEY | |
| # Fetch github token just for the rancher repository | |
| - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 | |
| id: app-token | |
| with: | |
| app-id: ${{ env.APP_ID }} | |
| private-key: ${{ env.PRIVATE_KEY }} | |
| repositories: | | |
| rancher | |
| - name: Checkout rancher repository | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| with: | |
| repository: ${{ github.repository_owner }}/rancher | |
| ref: "${{ env.RANCHER_REF }}" | |
| token: ${{ steps.app-token.outputs.token }} | |
| path: rancher | |
| # Allow making git push request later on | |
| persist-credentials: true | |
| - name: Find charts branch | |
| id: find_charts_branch | |
| run: | | |
| cd rancher | |
| # Extract dev-v2.9 out of the following line: | |
| # ChartDefaultBranch = NewSetting("chart-default-branch", "dev-v2.9") | |
| charts_branch=$(grep '"chart-default-branch"' pkg/settings/setting.go | cut -d'"' -f4) | |
| echo "charts_branch=$charts_branch" >> $GITHUB_OUTPUT | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| with: | |
| repository: ${{ github.repository_owner }}/charts | |
| ref: "${{ steps.find_charts_branch.outputs.charts_branch }}" | |
| path: charts | |
| # Prevents the Rancher CI to continuously fail while the webhook RC is not | |
| # yet added to charts' index.yaml file due to caching. | |
| - name: Verify RC exists | |
| env: | |
| CHARTS_BRANCH: "${{ steps.find_charts_branch.outputs.charts_branch }}" | |
| run: | | |
| cd charts | |
| new_webhook_short=$(echo "$NEW_WEBHOOK" | sed 's|^v||') # e.g. 0.5.2-rc.3 | |
| # Empty output if the version is not found, otherwise the version will be outputed. | |
| found=$(yq ".entries.rancher-webhook[].version | select(. == \"*$new_webhook_short\")" index.yaml) | |
| if [ -z "$found" ]; then | |
| echo "rancher-webhook RC version $NEW_WEBHOOK not found in charts (branch=$CHARTS_BRANCH). Aborting." | |
| exit 1 | |
| fi | |
| - name: Configure the committer | |
| run: | | |
| cd rancher | |
| user_id=$(gh api "/users/$APP_USER" --jq .id) | |
| git config --global user.name "$APP_USER" | |
| git config --global user.email "${user_id}+${APP_USER}@users.noreply.github.com" | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| APP_USER: "${{ steps.app-token.outputs.app-slug }}[bot]" | |
| - name: Run release script | |
| run: | | |
| cd rancher | |
| BRANCH="bump-webhook-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" | |
| echo "BRANCH=${BRANCH}" >> $GITHUB_ENV | |
| git checkout -b "$BRANCH" "$RANCHER_REF" | |
| ../webhook/.github/workflows/scripts/release-against-rancher.sh . "$NEW_WEBHOOK" | |
| - name: Push and create pull request | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| cd rancher | |
| git push origin $BRANCH | |
| body=$(../webhook/.github/workflows/scripts/release-message.sh "$PREV_WEBHOOK" "$NEW_WEBHOOK") | |
| gh pr create \ | |
| --title "[$RANCHER_REF] Bump rancher-webhook to $NEW_WEBHOOK" \ | |
| --body "$body" \ | |
| --repo ${{ github.repository_owner }}/rancher \ | |
| --head "${{ github.repository_owner }}:$BRANCH" \ | |
| --base "$RANCHER_REF" |