commit-sign.yml

name: commit sign
on:
  workflow_dispatch:
  push:

permissions: read-all

jobs:
  app-sign-commit:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Write GitHub context to log
        env:
          GITHUB_CONTEXT: ${{ toJSON(github) }}
        run: echo "$GITHUB_CONTEXT"

      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      - run: | 
          echo "" >> README.md && echo ${{ github.sha }} >> README.md
          echo "${{ github.sha }}" >> shas.txt

      # # UNSIGNED COMMIT # #
      # - uses: actions/checkout@v4
      #   with:
      #     token: ${{ steps.app-token.outputs.token }}
      #     repository: joshjohanning-org/commit-sign-app-other-repo
      #     path: other-repo
      # - name: push to git repo
      #   env:
      #     GH_TOKEN: ${{ steps.app-token.outputs.token }}
      #   run: |
      #     cd other-repo
      #     git config --global gpg.format ssh
      #     git config --global user.name 'josh-terraform-app[bot]'
      #     # you get this via https://api.github.com/users/josh-terraform-app[bot]
      #     # see more: https://github.com/orgs/community/discussions/24664#discussioncomment-3880274
      #     git config --global user.email '145150012+josh-terraform-app[bot]@users.noreply.github.com'
      #     git add .
      #     git commit -m "updating readme" -S
      #     git push
      #

      # # UNSIGNED COMMIT # #
      - name: push to repo with commit single file (not signed)
        run: | 
          #!/bin/bash
          set -euxo pipefail
          
          # Variables
          repo_user="${{ github.repository_owner }}"
          repo_name="commit-sign-app-other-repo"
          token="${{ steps.app-token.outputs.token }}"

          FILE_PATH="single-file.txt"

          # Step 1: Encode new content in Base64
          NEW_CONTENT="${{ github.sha }}"
          ENCODED_CONTENT=$(echo -n "${NEW_CONTENT}" | base64)
          
          # Step 2: Get the SHA of the existing file
          SHA=$(curl -H "Authorization: token $token" \
               -H "Accept: application/vnd.github.v3+json" \
               "https://api.github.com/repos/$repo_user/$repo_name/contents/${FILE_PATH}" | jq -r '.sha')
          
          # Step 3: Update the file
          curl -X PUT -H "Authorization: token $token" \
               -H "Accept: application/vnd.github.v3+json" \
               -d "{\"message\": \"update single file\", \"committer\": {\"name\": \"josh-terraform-app[bot]\", \"email\": \"145150012+josh-terraform-app[bot]@users.noreply.github.com\"}, \"content\": \"${ENCODED_CONTENT}\", \"sha\": \"${SHA}\"}" \
               "https://api.github.com/repos/$repo_user/$repo_name/contents/${FILE_PATH}"

          
      # # SIGNED COMMIT # #
      - name: push to repo with signed commit multiple files
        run: | 
          #!/bin/bash
          set -euxo pipefail
          
          # Variables
          repo_user="${{ github.repository_owner }}"
          repo_name="commit-sign-app-other-repo"
          token="${{ steps.app-token.outputs.token }}"
          file1_path="README.md"
          file2_path="shas.txt"
          file3_path=".github/dependabot.yml"
          
          # Get the contents of the files; jq -Rs escapes new lines and quotes
          file1_content=$(jq -Rs '.' $file1_path)
          file2_content=$(jq -Rs '.' $file2_path)
          file3_content=$(jq -Rs '.' $file3_path)
          
          # Get the latest commit
          latest_commit=$(curl -s -H "Authorization: token $token" \
            https://api.github.com/repos/$repo_user/$repo_name/git/refs/heads/main \
            | jq -r '.object.sha')
          
          # Get the tree of the latest commit
          base_tree=$(curl -s -H "Authorization: token $token" \
            https://api.github.com/repos/$repo_user/$repo_name/git/commits/$latest_commit \
            | jq -r '.tree.sha')
          
          # Create a new tree with the new files
          tree=$(curl -s -H "Authorization: token $token" -X POST \
            -d '{
              "base_tree": "'"$base_tree"'",
              "tree": [
                {
                  "path": "'"$file1_path"'",
                  "mode": "100644",
                  "type": "blob",
                  "content": '"$file1_content"'
                },
                {
                  "path": "'"$file2_path"'",
                  "mode": "100644",
                  "type": "blob",
                  "content": '"$file2_content"'
                },
                {
                  "path": "'"$file3_path"'",
                  "mode": "100644",
                  "type": "blob",
                  "content": '"$file3_content"'
                }
              ]
            }' https://api.github.com/repos/$repo_user/$repo_name/git/trees)
          
          # Get the SHA of the new tree
          new_tree_sha=$(echo $tree | jq -r '.sha')
          
          # Create a new commit pointing to the new tree
          commit=$(curl -sf -H "Authorization: token $token" -X POST \
            -d '{
              "message": "Add multiple files",
              "tree": "'"$new_tree_sha"'",
              "parents": ["'"$latest_commit"'"]
            }' https://api.github.com/repos/$repo_user/$repo_name/git/commits)
          
          # Get the SHA of the new commit
          new_commit_sha=$(echo $commit | jq -r '.sha')
          
          # Update the reference of the branch to point to the new commit
          curl -s -H "Authorization: token $token" -X PATCH \
            -d '{
              "sha": "'"$new_commit_sha"'"
            }' https://api.github.com/repos/$repo_user/$repo_name/git/refs/heads/main