Skip to content

Commit ab2cd55

Browse files
yosefAlsuhaibaniYosef AlsuhaibaniAndre Kuhlenschmidtkopecssemgrep-ci[bot]
authored
feat(automate): automate version bump for pre-commit repo (#12)
* Do text subst * take arg * Attempt at script1 * write second script * Update scripts to branch + aproximation of what a workflow could look like? * Use right flag to checkout branch + change file name * Commit via workflow not via script * fix workflow file * change file name & remove dup * Add v before version * No idea if this works * Don't commit * hello world * bogus * Add work from other fork * consistant + remove useless checkout * Restirct autoapprove to only semgrep-ci[bot] * Make script less fragile? * Split workflow into two * add conditonal * add back github actions bot * spacing * actually call the right script * Add changes to tag-version * Update scripts/tag-version.sh Co-authored-by: Cooper Pierce <cooper@semgrep.com> * Add shebang * Sync frm test fork. (#24) * Add work from other fork * Hardcode configs + remove inc * adding remotes command * going to version 2 of checkout * using version 4 of checkout * using with submodules: true * remove fake reviwer` * add gh token * aaa * Add autoapprove bot * Remove approvals and merge from bump_version * remove bogus reviewer * wack script * Fix bump ver * Restore state? * change name * fix typo * Bump setup to 1.82.0 * Bump pre-commit yaml to 1.81.0 (#16) Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> * Bump pre-commit yaml to 1.84.1 (#18) Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> * Bump setup to 1.33.22 (#19) Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> * simplify workflow * Make 2nd step its own workflow * no dup name * maybe fix error * remove dup key * don't hardcode bump yaml * Bump setup to 3.33.3 (#21) Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> * Change trigger hook * Bump setup to 2.22.2 (#22) Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> * remove dispatch * try on:push * Bump setup to 3.33.3 (#23) Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> * Bump setup to 1.84.1 (#24) Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> * push a tag * make sed portable * reset version * commit all files * Bump setup to 1.84.1 (#26) Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> * Cooper edit * sync * actually get token * perms * Bump setup to 1.84.0 (#29) Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com> * Don't negate? * Bump setup to 1.84.1 (#30) Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com> * escape properlly? * Bump setup to 1.84.0 (#31) Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com> * remove conditional * Bump setup to 1.84.1 (#32) Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com> * add back conditional * fake file * Change ext * Bump setup to 1.84.0 (#34) Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com> * Update autoapprove? * Fix checks * add --squash * del tag and tag * Bump setup to 1.84.1 (#37) Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com> * add ref: develop * Bump setup to 1.84.0 (#38) Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com> * Bump setup to 1.84.1 (#39) Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com> * Remove tag-version script and workflow * Add a small comment why we change ids * Don't push bogus changes * bogus --------- Co-authored-by: Yosef Alsuhaibani <yosefalsuhaibani@Yosefs-MacBook-Pro-2.local> Co-authored-by: Andre Kuhlenschmidt <andre@semgrep.com> Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> Co-authored-by: semgrep-ci[bot] <106279034+semgrep-ci[bot]@users.noreply.github.com> Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com> * Remove test files * Only autoapprove via login == semgrep-ci[bot] * Add comments --------- Co-authored-by: Yosef Alsuhaibani <yosefalsuhaibani@Yosefs-MacBook-Pro-2.local> Co-authored-by: Andre Kuhlenschmidt <andre@semgrep.com> Co-authored-by: Cooper Pierce <cooper@semgrep.com> Co-authored-by: semgrep-ci[bot] <semgrep-ci[bot]@users.noreply.github.com> Co-authored-by: semgrep-ci[bot] <106279034+semgrep-ci[bot]@users.noreply.github.com> Co-authored-by: yosefAlsuhaibani <yosefAlsuhaibani@users.noreply.github.com>
1 parent 1630a15 commit ab2cd55

File tree

3 files changed

+171
-0
lines changed

3 files changed

+171
-0
lines changed

‎.github/workflows/autoapprove.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# This workflow auto approves the PR generated by the bump_version
2+
# workflow, and moves the tag that was created in the PR's branch
3+
# to develop.
4+
5+
name: github-actions auto-approve
6+
on: pull_request_target
7+
8+
permissions:
9+
pull-requests: write
10+
contents: write
11+
12+
jobs:
13+
approve-bot:
14+
runs-on: ubuntu-latest
15+
if: ${{ github.event.pull_request.user.login == 'semgrep-ci[bot]'}}
16+
steps:
17+
- name: Approve
18+
run: gh pr review --approve "$PR_URL"
19+
env:
20+
PR_URL: ${{ github.event.pull_request.html_url }}
21+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
22+
23+
- name: Watch untill PR checks are done
24+
run: gh pr checks --required --watch "$PR_URL"
25+
env:
26+
PR_URL: ${{ github.event.pull_request.html_url }}
27+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28+
29+
- name: Merge PR
30+
run: gh pr merge --squash "$PR_URL"
31+
env:
32+
PR_URL: ${{ github.event.pull_request.html_url }}
33+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34+
35+
# Now we switch to semgrep-ci[bot] to actually be able to
36+
# move the tag we created in bump_version.yml from the
37+
# release branch to develop
38+
39+
- id: jwt
40+
env:
41+
EXPIRATION: 600
42+
ISSUER: ${{ secrets.SEMGREP_CI_APP_ID }}
43+
PRIVATE_KEY: ${{ secrets.SEMGREP_CI_APP_KEY }}
44+
name: Get JWT for semgrep-ci GitHub App
45+
uses: docker://public.ecr.aws/y9k7q4m1/devops/cicd:latest
46+
47+
- id: token
48+
name: Get token for semgrep-ci GitHub App
49+
run: |
50+
TOKEN="$(curl -X POST \
51+
-H "Authorization: Bearer ${{ steps.jwt.outputs.jwt }}" \
52+
-H "Accept: application/vnd.github.v3+json" \
53+
"https://api.github.com/app/installations/${{ secrets.SEMGREP_CI_APP_INSTALLATION_ID }}/access_tokens" | \
54+
jq -r .token)"
55+
echo "::add-mask::$TOKEN"
56+
echo "token=$TOKEN" >> $GITHUB_OUTPUT
57+
58+
- uses: actions/checkout@v4
59+
with:
60+
ref: develop
61+
token: ${{ steps.token.outputs.token }}
62+
63+
- name: Move tag to develop branch
64+
env:
65+
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
66+
run: |
67+
CURR_VERSION=$(grep -o 'version=\"[0-9.]*\"' setup.py | sed "s/version=\"\([0-9.]*\)\"/\1/")
68+
# We tagged the release branch first in bump_version.yml
69+
# to allow tests to pass; now moving it to develop so
70+
# it can be a part of its history
71+
git push --delete origin "v${CURR_VERSION}"
72+
git tag "v${CURR_VERSION}" HEAD
73+
git push origin tag "v${CURR_VERSION}"

‎.github/workflows/bump_version.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# This workflow is called by the start release workflow to bump this
2+
# repo's semgrep version to the newly release version; triggered by
3+
# the start-release workflow.
4+
5+
jobs:
6+
bump-version:
7+
runs-on: ubuntu-latest
8+
permissions:
9+
id-token: write
10+
contents: write
11+
pull-requests: write
12+
checks: write
13+
env:
14+
NEW_SEMGREP_VERSION: ${{ github.event.inputs.version }}
15+
steps:
16+
- id: jwt
17+
env:
18+
EXPIRATION: 600
19+
ISSUER: ${{ secrets.SEMGREP_CI_APP_ID }}
20+
PRIVATE_KEY: ${{ secrets.SEMGREP_CI_APP_KEY }}
21+
name: Get JWT for semgrep-ci GitHub App
22+
uses: docker://public.ecr.aws/y9k7q4m1/devops/cicd:latest
23+
24+
- id: token
25+
name: Get token for semgrep-ci GitHub App
26+
run: |
27+
TOKEN="$(curl -X POST \
28+
-H "Authorization: Bearer ${{ steps.jwt.outputs.jwt }}" \
29+
-H "Accept: application/vnd.github.v3+json" \
30+
"https://api.github.com/app/installations/${{ secrets.SEMGREP_CI_APP_INSTALLATION_ID }}/access_tokens" | \
31+
jq -r .token)"
32+
echo "::add-mask::$TOKEN"
33+
echo "token=$TOKEN" >> $GITHUB_OUTPUT
34+
35+
- uses: actions/checkout@v4
36+
with:
37+
token: ${{ steps.token.outputs.token }}
38+
39+
- name: Bump version in this repo
40+
run: scripts/bump-version.sh "${NEW_SEMGREP_VERSION}"
41+
42+
- name: Commit and push
43+
id: commit
44+
env:
45+
BRANCH: "gha/bump-version-${{ github.event.inputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}"
46+
SUBJECT: "Bump setup to ${{ github.event.inputs.version }}"
47+
run: |
48+
git config user.name ${{ github.actor }}
49+
git config user.email ${{ github.actor }}@users.noreply.github.com
50+
git checkout -b $BRANCH
51+
git commit -am "$SUBJECT"
52+
git tag "v${NEW_SEMGREP_VERSION}" HEAD
53+
git remote -vv
54+
git push --set-upstream origin $BRANCH
55+
git push origin tag "v$NEW_SEMGREP_VERSION"
56+
echo "branch=$BRANCH" >> $GITHUB_OUTPUT
57+
echo "subject=$SUBJECT" >> $GITHUB_OUTPUT
58+
59+
- name: Create PR
60+
id: open-pr
61+
env:
62+
SOURCE: "${{ steps.commit.outputs.branch }}"
63+
TARGET: "${{ github.event.repository.default_branch }}"
64+
TITLE: "chore: update pre-commit to semgrep ${{ inputs.version }}"
65+
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
66+
VERSION: "${{ inputs.version }}"
67+
run: |
68+
# check if the branch already has a pull request open
69+
if gh pr list --head ${SOURCE} | grep -vq "no pull requests"; then
70+
# pull request already open
71+
echo "pull request from SOURCE ${SOURCE} to TARGET ${TARGET} is already open";
72+
echo "cancelling release"
73+
exit 1
74+
fi
75+
# open new pull request with the body of from the local template.
76+
res=$(gh pr create --title "${TITLE}" --body "Bump Semgrep Version to ${VERSION}" \
77+
--base "${TARGET}" --head "${SOURCE}")
78+
79+
name: bump-version
80+
on:
81+
workflow_dispatch:
82+
inputs:
83+
version:
84+
description: "Version of semgrep to use"
85+
required: true
86+
type: string

‎scripts/bump-version.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/sh
2+
3+
VERSION=$1
4+
OLD_VERSION=$(grep -o 'version=\"[0-9.]*\"' setup.py | sed "s/version=\"\([0-9.]*\)\"/\1/")
5+
6+
# Do text substitution in setup.py & README.md
7+
sed "s/$OLD_VERSION/$VERSION/" setup.py > tmp
8+
mv tmp setup.py
9+
sed "s/$OLD_VERSION/$VERSION/" README.md > tmp
10+
mv tmp README.md
11+
sed "s/$OLD_VERSION/$VERSION/" .pre-commit-config.yaml > tmp
12+
mv tmp .pre-commit-config.yaml

0 commit comments

Comments
 (0)