Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add workflow to synchronize go mod changes with submodules #314

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add workflow to synchronize go mod changes with submodules #314

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7c77635
Add workflow to synchronize go mod changes with submodules
codysoyland Oct 14, 2024
067557f
Use octo-sts instead of PAT
codysoyland Oct 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/chainguard/sync.sts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
issuer: https://token.actions.githubusercontent.com
subject: repo:sigstore/sigstore-go:pull_request
claim_pattern:
actor: "dependabot\[bot\]"

permissions:
contents: write
52 changes: 52 additions & 0 deletions .github/workflows/synchronize-go-mod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
name: Synchronize go.mod in submodules

on:
pull_request:
branches:
- main
types:
- opened
- synchronize

permissions:
contents: write

jobs:
synchronize-go-mod:
if: github.actor == 'dependabot[bot]'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be an ID? If someone names their account this string, this would run. Not really a big deal though

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the documented way. The actor name is a user name of the entity that triggered the workflow.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with Hayden's question here - having this pinned to an immutable ID feels marginally safer.

runs-on: ubuntu-latest

steps:
- uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
id: octo-sts
with:
scope: sigstore/sigstore-go
identity: sync

- name: Checkout repository
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
with:
ref: ${{ github.event.pull_request.head.ref }}
token: ${{ steps.octo-sts.outputs.token }}

- name: Install Go
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version-file: go.mod
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if the modules don’t use the same version of go? Should we search for all go.mod files, then install go and run go mod tidy for each?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I hadn't considered that, but I think we'd hit an error in that case, and we'd need to manually sync up the go versions.

Copy link
Member

@kommendorkapten kommendorkapten Oct 16, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we create a go.work and workspace, we can define the go version at the top level and use go-version-file: go.work, then rely on go work sync to propagate the version to the sub modules. That could probably be part of this workflow too.


- name: Synchronize go.mod in submodule
run: |
cd examples/oci-image-verification; go mod tidy
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
cd examples/oci-image-verification; go mod tidy
cd examples/oci-image-verification && go mod tidy


- name: Commit and push changes
run: |
if [ -n "$(git status --porcelain)" ]; then
echo "Changes detected:"
git diff
git config --global user.name "github-actions[bot]"
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git commit -a -s -m "Synchronize go.mod in submodules"
git push origin HEAD:${{ github.event.pull_request.head.ref }}
else
echo "No changes to commit"
fi