This repository has been archived by the owner on Aug 25, 2024. It is now read-only.
chore(deps): bump github/codeql-action from 3.25.10 to 3.26.5 in /.github/workflows #480
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Pin: Downstream: 2nd party" | |
| # TODO 3rd party will be based off ActivityPub | |
| # - References | |
| # - RFCv5.1: IETF SCITT: Use Case: Attestations of alignment to S2C2F and org Overlays: https://github.com/ietf-scitt/use-cases/blob/a832905e3c428fd54b1c08d4851801383eac91a6/openssf_metrics.md#use-case-attestations-of-alignment-to-s2c2f-and-org-overlays | |
| on: | |
| pull_request_target: | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| branches: | |
| - main | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| manifest: | |
| runs-on: ubuntu-latest | |
| # Disabled currently | |
| if: false | |
| outputs: | |
| length: ${{ steps.create-manifest-instance.outputs.length }} | |
| manifest: ${{ steps.create-manifest-instance.outputs.github_actions_manifest }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 | |
| with: | |
| egress-policy: audit | |
| - name: Set up Python | |
| uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0 | |
| with: | |
| python-version: "3.11" | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Build manifest from plugins.json from pull request | |
| id: create-manifest-instance | |
| env: | |
| PLUGINS_JSON: "dffml/plugins.json" | |
| SCHEMA: "TODO-dffml-2ndparty-pin" | |
| JSON_INDENT: " " | |
| shell: python -u {0} | |
| run: | | |
| import os | |
| import json | |
| import pathlib | |
| plugins = json.loads(pathlib.Path(os.environ["PLUGINS_JSON"]).read_text()) | |
| manifest = plugins["plugins"]["parties"]["2nd"] | |
| # SECURITY Allowlist of 2nd party orgs to pin | |
| for downstream in manifest: | |
| if not downstream["source_url"].startswith("https://github.com/dffml/"): | |
| raise ValueError(f"source_url not in allowed org: {downstream!r}") | |
| github_actions_manifest = { | |
| "include": manifest, | |
| } | |
| json_ld_manifest = { | |
| "@context": { | |
| "@vocab": os.environ["SCHEMA"], | |
| }, | |
| **github_actions_manifest, | |
| } | |
| print(json.dumps(json_ld_manifest, sort_keys=True, indent=os.environ.get("JSON_INDENT", None))) | |
| if "GITHUB_OUTPUT" in os.environ: | |
| with open(os.environ["GITHUB_OUTPUT"], "a") as fileobj: | |
| fileobj.write(f'length={len(manifest)}\n') | |
| fileobj.write(f"manifest={json.dumps(manifest, sort_keys=True)}\n") | |
| fileobj.write(f'github_actions_manifest={json.dumps(github_actions_manifest, sort_keys=True)}\n') | |
| fileobj.write(f'json_ld_manifest={json.dumps(json_ld_manifest, sort_keys=True)}\n') | |
| pin_downstream_pep_440: | |
| permissions: | |
| contents: write # for Git to git push | |
| name: "Pin downstream to latest commit" | |
| runs-on: ubuntu-latest | |
| # Disabled currently | |
| if: false | |
| env: | |
| PIN_PULL_REQUEST_EMAIL: 'alice.omega.alpha@outlook.com' | |
| PIN_PULL_REQUEST_NAME: 'Alice Alchemy' | |
| GH_ACCESS_TOKEN: ${{ secrets.PIN_DOWNSTREAM_2ND_PARTY_GH_ACCESS_TOKEN }} | |
| PIN_TO_COMMIT: ${{ github.event.after || github.event.pull_request.head.sha }} | |
| UPSTREAM_PACKAGE_NAME: 'dffml' | |
| BUMP_DEP: "dffml @ https://github.com/intel/dffml/archive/" | |
| needs: | |
| - manifest | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 100 | |
| matrix: ${{ fromJSON(needs.manifest.outputs.manifest) }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout downstream | |
| env: | |
| # TODO Pull requests on pull requests, probably from renovate/dependabot | |
| # https://github.com/intel/dffml/pull/1061#pullrequestreview-1281885921 | |
| TARGET_REPO_URL: ${{ matrix.source_url }} | |
| TARGET_BRANCH: ${{ matrix.branch }} | |
| TARGET_COMMIT: ${{ matrix.branch }} | |
| run: | | |
| set -x | |
| git init | |
| git remote add origin "${TARGET_REPO_URL}" | |
| git fetch origin "${TARGET_BRANCH}" --depth 1 | |
| git fetch origin "${TARGET_COMMIT}" --depth 1 | |
| git reset --hard "origin/${TARGET_COMMIT}" | |
| - name: Find repo local dependent files | |
| id: repo-local-downstream | |
| run: | | |
| set -x | |
| get_files() { | |
| git grep "${BUMP_DEP}" | sed -e 's/:.*//g' | sort | uniq | |
| } | |
| echo files_length=$(get_files | wc -l) >> $GITHUB_OUTPUT | |
| - name: Update pinning of upstream within downstream | |
| if: ${{ fromJSON(steps.repo-local-downstream.outputs.files_length) > 0 }} | |
| id: create-pull-request | |
| env: | |
| NEW_HASH: ${{ env.PIN_TO_COMMIT }} | |
| COMMIT_MESSAGE: "setup: Pin ${{ env.UPSTREAM_PACKAGE_NAME }} to ${{ env.PIN_TO_COMMIT }}\n${{ github.event.pull_request.html_url }}\n${{ github.server_url }}/${{ github.repository }}/commit/${{ env.PIN_TO_COMMIT }}\n${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| NEW_BRANCH_WITH_PIN: "pin/pep_440/${{ github.repository }}/${{ env.PIN_TO_COMMIT }}" | |
| FILES: ${{ toJSON(steps.repo-local-downstream.outputs.files) }} | |
| BASE: ${{ matrix.branch }} | |
| run: | | |
| set -x | |
| get_files() { | |
| git grep "${BUMP_DEP}" | sed -e 's/:.*//g' | sort | uniq | |
| } | |
| # https://github.com/dffml/dffml-model-transformers/blob/898af4a51d9b5d70d58ce80ba2c508f3afa82400/setup.cfg#L6 | |
| sed -i -r -e "s#${BUMP_DEP}[A-Fa-f0-9]{40}#${BUMP_DEP}${NEW_HASH}#g" $(get_files) | |
| git checkout -b "${NEW_BRANCH_WITH_PIN}" | |
| git config user.email "${PIN_PULL_REQUEST_EMAIL}" | |
| git config user.name "${PIN_PULL_REQUEST_NAME}" | |
| git commit -sam "${COMMIT_MESSAGE}" | |
| git log -n 1 -p | |
| mkdir -p ~/.config/gh/ | |
| echo "github.com:" > ~/.config/gh/hosts.yml | |
| echo " oauth_token: ${GH_ACCESS_TOKEN}" >> ~/.config/gh/hosts.yml | |
| echo " user: token" >> ~/.config/gh/hosts.yml | |
| echo " git_protocol: https" >> ~/.config/gh/hosts.yml | |
| gh auth setup-git | |
| git push -u origin -f "${NEW_BRANCH_WITH_PIN}" | |
| gh pr create --base "${BASE}" --head "${NEW_BRANCH_WITH_PIN}" --title "${COMMIT_MESSAGE}" --body "" | tee pull-request-url | |
| PULL_REQUEST_URL="$(cat pull-request-url)" | |
| if [[ "x${PULL_REQUEST_URL}" == "x" ]]; then | |
| echo "No pull request URL" 1>&2 | |
| exit 1 | |
| fi | |
| echo "url=${PULL_REQUEST_URL}" | tee -a $GITHUB_OUTPUT |