Create Cert Store Update Pull Request #167
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Create Cert Store Update Pull Request | |
| on: | |
| schedule: | |
| - cron: '0 0 * * *' | |
| repository_dispatch: | |
| types: targetRepo-event | |
| workflow_dispatch: | |
| inputs: | |
| targetRepo: | |
| description: 'Target repository for workflow_dispatch' | |
| default: 'all' | |
| targetRef: | |
| description: 'Target ref for workflow_dispatch' | |
| default: 'latest' | |
| jobs: | |
| create_pull_request: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Set TARGET_REPO_BRANCH from schedule | |
| if: github.event_name == 'schedule' | |
| run: | | |
| echo "TARGET_REPO_BRANCH=latest" | tee -a $GITHUB_ENV | |
| echo "KFUTIL_ARG=all" | tee -a $GITHUB_ENV | |
| - name: Set TARGET_REPO_BRANCH from workflow_dispatch input | |
| if: github.event_name == 'workflow_dispatch' | |
| id: set-local-env-vars | |
| run: | | |
| echo "TARGET_REPO_BRANCH=${{ inputs.targetRef }}" | tee -a $GITHUB_ENV | |
| echo "KFUTIL_ARG=${{ inputs.targetRepo }}" | tee -a $GITHUB_ENV | |
| - name: Set TARGET_REPO_BRANCH from repository_dispatch input | |
| if: github.event_name == 'repository_dispatch' | |
| id: set-env-vars-from-payload | |
| run: | | |
| echo "TARGET_REPO_BRANCH=${{ github.event.client_payload.targetRef }}" | tee -a $GITHUB_ENV | |
| echo "KFUTIL_ARG=${{ github.event.client_payload.targetRepo }}" | tee -a $GITHUB_ENV | |
| - name: Set Branch Name based on targetRef | |
| id: set-branch-name | |
| run: | | |
| if [ "${{ env.TARGET_REPO_BRANCH }}" == "main" ]; then | |
| echo "BRANCH_NAME=${{ env.KFUTIL_ARG }}_${{ env.TARGET_REPO_BRANCH }}" | tee -a $GITHUB_ENV | |
| else | |
| echo "BRANCH_NAME=${{ env.KFUTIL_ARG }}" | tee -a $GITHUB_ENV | |
| fi | |
| - name: Check Open PRs for Existing Branch | |
| id: check-branch | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| const owner = context.repo.owner; | |
| const repo = context.repo.repo; | |
| const branchName = '${{ env.BRANCH_NAME }}'; | |
| // Check if the branch itself exists | |
| let branchExists = false; | |
| try { | |
| await github.rest.git.getRef({ owner, repo, ref: `heads/${branchName}` }); | |
| branchExists = true; | |
| } catch (e) { | |
| branchExists = false; | |
| } | |
| // Check for an open PR targeting this branch | |
| const pulls = await github.rest.pulls.list({ owner, repo, state: "open" }); | |
| const hasOpenPR = pulls.data.some(item => item.head.ref === branchName); | |
| console.log(`Branch exists: ${branchExists}, Open PR: ${hasOpenPR}, Branch name: ${branchName}`); | |
| core.setOutput('PR_BRANCH', branchExists ? 'commit' : 'create'); | |
| core.setOutput('HAS_OPEN_PR', String(hasOpenPR)); | |
| - name: set env.PR_BRANCH value for jobs | |
| run: | | |
| echo "PR_BRANCH=${{steps.check-branch.outputs.PR_BRANCH}}" | tee -a $GITHUB_ENV | |
| echo "HAS_OPEN_PR=${{steps.check-branch.outputs.HAS_OPEN_PR}}" | tee -a $GITHUB_ENV | |
| # If the branch with an open PR already exists, first check out that branch from kfutil | |
| - name: Check out existing repo merge branch | |
| if: env.PR_BRANCH == 'commit' | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: 'keyfactor/kfutil' | |
| sparse-checkout: | | |
| .github | |
| cmd | |
| path: './merge-folder/' | |
| token: ${{ secrets.V2BUILDTOKEN }} | |
| ref: '${{env.BRANCH_NAME}}' | |
| # If the branch does not exist, first check out the main branch from kfutil. | |
| - name: Check out main | |
| if: env.PR_BRANCH == 'create' | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: 'keyfactor/kfutil' | |
| sparse-checkout: | | |
| .github | |
| cmd | |
| path: './merge-folder/' | |
| token: ${{ secrets.V2BUILDTOKEN }} | |
| # Save a copy of the original json | |
| - name: Save original store_types.json | |
| run: | | |
| echo "Saving original store_types.json as store_types.sav.json" | |
| cp ./merge-folder/store_types.json ./merge-folder/store_types.sav.json | |
| # Checkout and run the python tool | |
| - name: Check out python merge tool repo | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: 'keyfactor/integration-tools' | |
| path: './tools/' | |
| token: ${{ secrets.V2BUILDTOKEN }} | |
| - name: Run Python Script | |
| working-directory: ./tools/store-type-merge | |
| run: | | |
| python main.py --repo-name ${{ env.KFUTIL_ARG }} --ref ${{ env.TARGET_REPO_BRANCH }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.V2BUILDTOKEN }} | |
| - name: Save Store Types JSON Artifact | |
| if: success() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: store-types | |
| path: | | |
| ./tools/store-type-merge/store_types.json | |
| ./merge-folder/store_types.sav.json | |
| - name: Save Invalid Store Types JSON Artifact | |
| if: success() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: invalid-repos | |
| path: ./tools/store-type-merge/invalid_repos.json | |
| - name: Save logs directory | |
| if: success() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: logs | |
| path: ./tools/store-type-merge/log | |
| # Copy the result to the pr commit folder | |
| - name: Copy store-type-merge results | |
| run: | | |
| echo "Saving original store_types.json as store_types.sav.json" | |
| cp -f ./tools/store-type-merge/store_types.json ./merge-folder/store_types.json | |
| mkdir -p ./merge-folder/cmd || true | |
| cp -f ./tools/store-type-merge/store_types.json ./merge-folder/cmd/store_types.json # this necessary? | |
| ls -la ./merge-folder/ | |
| ls -la ./merge-folder/cmd/ | |
| # Diff the new json against the saved copy and set an UPDATE_FILE variable | |
| - name: Diff the results | |
| run: | | |
| echo "Diff the results" | |
| echo "Set UPDATE_FILE=1 if differences" | |
| if cmp -s ./merge-folder/store_types.json ./merge-folder/store_types.sav.json ; | |
| then echo "UPDATE_FILE=F" | tee -a $GITHUB_ENV; | |
| else echo "UPDATE_FILE=T" | tee -a $GITHUB_ENV; | |
| fi | |
| diff ./merge-folder/store_types.json ./merge-folder/store_types.sav.json || true | |
| # There are two different steps with a condition to check the PR_BRANCH env var | |
| # Both steps will contain a check for the UPDATE_FILE variable before running | |
| - name: Add and Commit to newly created branch | |
| if: ${{ env.UPDATE_FILE == 'T' && env.PR_BRANCH == 'create' }} | |
| uses: Keyfactor/add-and-commit@v9.1.4 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.SDK_SYNC_PAT }} | |
| with: | |
| add: | | |
| store_types.json | |
| ./cmd/store_types.json --force | |
| message: Update store_types.json for ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}} | |
| author_name: Keyfactor | |
| author_email: keyfactor@keyfactor.github.io | |
| cwd: './merge-folder/' | |
| new_branch: ${{env.BRANCH_NAME}} | |
| - name: Add and Commit to existing branch | |
| if: ${{ env.UPDATE_FILE == 'T' && env.PR_BRANCH == 'commit' }} | |
| uses: Keyfactor/add-and-commit@v9.1.4 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.SDK_SYNC_PAT }} | |
| with: | |
| add: | | |
| store_types.json | |
| ./cmd/store_types.json --force | |
| message: Update store_types.json for ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}} | |
| author_name: Keyfactor | |
| author_email: keyfactor@keyfactor.github.io | |
| cwd: './merge-folder/' | |
| - name: Create new PR for the newly created branch | |
| if: env.UPDATE_FILE == 'T' && env.HAS_OPEN_PR == 'false' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| console.log(`Created ${{env.BRANCH_NAME}} `) | |
| console.log("Commit to ${{env.BRANCH_NAME}} for PR") | |
| const owner = context.repo.owner; | |
| const repo = context.repo.repo; | |
| const baseBranch = context.payload.ref ? | |
| context.payload.ref.replace('refs/heads/', '') : 'main'; | |
| console.log(`Base branch for PR: ${baseBranch}`); | |
| const newBranch = '${{env.BRANCH_NAME}}'; | |
| const response = await github.rest.pulls.create({ | |
| owner, | |
| repo, | |
| title: 'Store Types Update - ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}}', | |
| head: newBranch, | |
| base: baseBranch, | |
| body: 'The cert store update from ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}} needs to be verified and merged if correct.', | |
| }); | |
| console.log(`Pull request created: ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}} : ${response.data.html_url}`); |