diff --git a/.github/actions/github-app-token/action.yml b/.github/actions/github-app-token/action.yml new file mode 100644 index 0000000..545f0c8 --- /dev/null +++ b/.github/actions/github-app-token/action.yml @@ -0,0 +1,32 @@ +name: GitHub App Token +description: Generate a GitHub App installation token for workflows. +inputs: + app-id: + description: GitHub App ID + required: true + private-key: + description: GitHub App private key + required: true + owner: + description: Installation owner + required: false + default: Azure + repositories: + description: Comma or newline separated list of repository names for token scoping + required: false + default: azure-sdk-for-java +outputs: + token: + description: GitHub App installation token + value: ${{ steps.app-token.outputs.token }} +runs: + using: composite + steps: + - name: Generate GitHub App Token + id: app-token + uses: actions/create-github-app-token@v3.2.0 + with: + app-id: ${{ inputs['app-id'] }} + private-key: ${{ inputs['private-key'] }} + owner: ${{ inputs.owner }} + repositories: ${{ inputs.repositories }} \ No newline at end of file diff --git a/.github/workflows/test-spring-boot-rc-version.yml b/.github/workflows/test-spring-boot-rc-version.yml index 5453c15..d65886e 100644 --- a/.github/workflows/test-spring-boot-rc-version.yml +++ b/.github/workflows/test-spring-boot-rc-version.yml @@ -6,9 +6,14 @@ jobs: name: Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 + - name: Generate GitHub App Token + id: app-token + uses: ./.github/actions/github-app-token with: - repository: 'Azure/spring-cloud-azure-tools' + app-id: ${{ secrets.GH_APP_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + repositories: azure-sdk-for-java - name: Generate Version File run: | mvn compile @@ -35,14 +40,15 @@ jobs: else echo "No RC version,cancel update!" fi - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 if: ${{ env.need_update_version == 'true' }} with: repository: 'Azure/azure-sdk-for-java' path: 'azure-sdk-for-java' ref: main - token: ${{ secrets.ACCESS_TOKEN }} + token: ${{ steps.app-token.outputs.token }} fetch-depth: 1 + persist-credentials: false - name: Generate spring_boot_managed_external_dependencies.txt if: ${{ env.need_update_version == 'true' }} run: | @@ -81,15 +87,15 @@ jobs: cp -f ../spring-cloud-azure-supported-spring.json sdk/spring/pipeline git add sdk/spring/pipeline/spring-cloud-azure-supported-spring.json git commit -m "Upgrade spring-cloud-azure-supported-spring" - git push "https://${{ secrets.USER }}:${{ secrets.ACCESS_TOKEN }}@github.com/${{ secrets.USER }}/azure-sdk-for-java.git" "HEAD:${{ env.update_branch }}" + git push "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/Azure/azure-sdk-for-java.git" "HEAD:${{ env.update_branch }}" - name: Create Pull Request if: ${{ env.need_update_version == 'true' }} - uses: vsoch/pull-request-action@master + uses: vsoch/pull-request-action@1.1.1 env: - PULL_REQUEST_TOKEN: ${{ secrets.ACCESS_TOKEN }} + PULL_REQUEST_TOKEN: ${{ steps.app-token.outputs.token }} PULL_REQUEST_REPOSITORY: Azure/azure-sdk-for-java PULL_REQUEST_TITLE: "${{ env.PR_TITLE }}" - PULL_REQUEST_FROM_BRANCH: "${{ secrets.USER }}:${{ env.update_branch }}" + PULL_REQUEST_FROM_BRANCH: "${{ env.update_branch }}" PULL_REQUEST_BRANCH: "main" PULL_REQUEST_BODY: "Test Spring Boot RC version [${{ env.spring_boot_version }}](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/${{ env.spring_boot_version }}/spring-boot-dependencies-${{ env.spring_boot_version }}.pom) and Spring Cloud version [${{ env.spring_cloud_version }}](https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-dependencies/${{ env.spring_cloud_version }}/spring-cloud-dependencies-${{ env.spring_cloud_version }}.pom).\n${{ env.pr_descriptions }}\n\nThis PR is created by GitHub Actions: https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}" PULL_REQUEST_DRAFT: true @@ -97,7 +103,7 @@ jobs: if: ${{ env.need_update_version == 'true' }} uses: actions/github-script@v7 with: - github-token: ${{ secrets.ACCESS_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} script: | const { data: pullRequests } = await github.rest.pulls.list({ owner: 'Azure', diff --git a/.github/workflows/update-spring-cloud-azure-support-file.yml b/.github/workflows/update-spring-cloud-azure-support-file.yml index e6ba84a..b91d1e9 100644 --- a/.github/workflows/update-spring-cloud-azure-support-file.yml +++ b/.github/workflows/update-spring-cloud-azure-support-file.yml @@ -13,11 +13,19 @@ jobs: outputs: has_open_pr: ${{ steps.check.outputs.has_open_pr }} steps: + - uses: actions/checkout@v4 + - name: Generate GitHub App Token + id: app-token + uses: ./.github/actions/github-app-token + with: + app-id: ${{ secrets.GH_APP_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + repositories: azure-sdk-for-java - name: Check for Existing Open Pull Request id: check uses: actions/github-script@v7 with: - github-token: ${{ secrets.ACCESS_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} script: | const prTitle = process.env.PR_TITLE; const { data: pullRequests } = await github.rest.pulls.list({ @@ -41,20 +49,26 @@ jobs: if: ${{ needs.check-open-pr.outputs.has_open_pr == 'false' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 + - name: Generate GitHub App Token + id: app-token + uses: ./.github/actions/github-app-token with: - repository: 'Azure/spring-cloud-azure-tools' + app-id: ${{ secrets.GH_APP_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + repositories: azure-sdk-for-java - name: Generate Spring Cloud Azure Support File run: | mvn compile mvn exec:java -P github-actions -ntp -Dupdate-spring-cloud-azure-support-file=true - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: repository: 'Azure/azure-sdk-for-java' path: 'azure-sdk-for-java' ref: main - token: ${{ secrets.ACCESS_TOKEN }} + token: ${{ steps.app-token.outputs.token }} fetch-depth: 0 + persist-credentials: false - name: Set Branch Name with Timestamp run: | TIMESTAMP=$(date +%Y%m%d-%H%M%S) @@ -126,23 +140,23 @@ jobs: git add sdk/spring/pipeline/spring-cloud-azure-supported-spring.json git add docs/spring/Spring-Cloud-Azure-Timeline.md git commit -m "${{ env.COMMIT_MESSAGE }}" - git push "https://${{ secrets.USER }}:${{ secrets.ACCESS_TOKEN }}@github.com/${{ secrets.USER }}/azure-sdk-for-java.git" + git push "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/Azure/azure-sdk-for-java.git" "${{ env.BRANCH_NAME }}" - name: Create Pull Request id: create_pr if: ${{ env.NEED_UPDATE_FILE == 'true' }} - uses: vsoch/pull-request-action@master + uses: vsoch/pull-request-action@1.1.1 env: - PULL_REQUEST_TOKEN: ${{ secrets.ACCESS_TOKEN }} + PULL_REQUEST_TOKEN: ${{ steps.app-token.outputs.token }} PULL_REQUEST_REPOSITORY: Azure/azure-sdk-for-java PULL_REQUEST_TITLE: "${{ env.PR_TITLE }}" - PULL_REQUEST_FROM_BRANCH: "${{ secrets.USER }}:${{ env.BRANCH_NAME }}" + PULL_REQUEST_FROM_BRANCH: "${{ env.BRANCH_NAME }}" PULL_REQUEST_BRANCH: "main" PULL_REQUEST_BODY: "${{ env.PULL_REQUEST_BODY }}" - name: Comment on Pull Requests if: ${{ env.NEED_UPDATE_FILE == 'true' }} uses: actions/github-script@v7 with: - github-token: ${{ secrets.ACCESS_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} script: | const prNumber = '${{ steps.create_pr.outputs.pull_request_number }}'; diff --git a/.github/workflows/update-spring-dependencies.yml b/.github/workflows/update-spring-dependencies.yml index c9e98fa..6d0862e 100644 --- a/.github/workflows/update-spring-dependencies.yml +++ b/.github/workflows/update-spring-dependencies.yml @@ -19,11 +19,19 @@ jobs: outputs: skip_pipeline: ${{ steps.check_prs.outputs.skip_pipeline }} steps: + - uses: actions/checkout@v4 + - name: Generate GitHub App Token + id: app-token + uses: ./.github/actions/github-app-token + with: + app-id: ${{ secrets.GH_APP_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + repositories: azure-sdk-for-java - name: Check for Open Spring Boot Upgrade PRs id: check_prs uses: actions/github-script@v7 with: - github-token: ${{ secrets.ACCESS_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} script: | const prTitlePrefix = process.env.PR_TITLE_PREFIX; const { data: pullRequests } = await github.rest.pulls.list({ @@ -51,9 +59,14 @@ jobs: needs: check if: ${{ needs.check.outputs.skip_pipeline != 'true' }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 + - name: Generate GitHub App Token + id: app-token + uses: ./.github/actions/github-app-token with: - repository: 'Azure/spring-cloud-azure-tools' + app-id: ${{ secrets.GH_APP_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + repositories: azure-sdk-for-java - name: Generate Version File run: | mvn compile @@ -74,14 +87,15 @@ jobs: echo "pr_descriptions=$(cat pr-descriptions.txt)" >> $GITHUB_ENV echo "PR_TITLE=${PR_TITLE_PREFIX} $(sed -n '1p' spring-versions.txt) and Spring Cloud $(sed -n '2p' spring-versions.txt)" >> $GITHUB_ENV fi - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 if: ${{ env.need_update_version == 'true' }} with: repository: 'Azure/azure-sdk-for-java' path: 'azure-sdk-for-java' ref: main - token: ${{ secrets.ACCESS_TOKEN }} + token: ${{ steps.app-token.outputs.token }} fetch-depth: 1 + persist-credentials: false - name: Generate spring_boot_managed_external_dependencies.txt if: ${{ env.need_update_version == 'true' }} run: | @@ -117,16 +131,16 @@ jobs: git rm ./sdk/spring/scripts/spring_boot_${{ env.last_spring_boot_version }}_managed_external_dependencies.txt git add -A git commit -m "Upgrade external dependencies to align with Spring Boot ${{ env.spring_boot_version }}" - git push "https://${{ secrets.USER }}:${{ secrets.ACCESS_TOKEN }}@github.com/${{ secrets.USER }}/azure-sdk-for-java.git" "HEAD:${{ env.update_branch }}" + git push "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/Azure/azure-sdk-for-java.git" "HEAD:${{ env.update_branch }}" - name: Create Pull Request id: create_pr if: ${{ env.need_update_version == 'true' }} - uses: vsoch/pull-request-action@master + uses: vsoch/pull-request-action@1.1.1 env: - PULL_REQUEST_TOKEN: ${{ secrets.ACCESS_TOKEN }} + PULL_REQUEST_TOKEN: ${{ steps.app-token.outputs.token }} PULL_REQUEST_REPOSITORY: Azure/azure-sdk-for-java PULL_REQUEST_TITLE: "${{ env.PR_TITLE }}" - PULL_REQUEST_FROM_BRANCH: "${{ secrets.USER }}:${{ env.update_branch }}" + PULL_REQUEST_FROM_BRANCH: "${{ env.update_branch }}" PULL_REQUEST_BRANCH: "main" PULL_REQUEST_BODY: "Updates external dependencies to align with Spring Boot version [${{ env.spring_boot_version }}](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/${{ env.spring_boot_version }}/spring-boot-dependencies-${{ env.spring_boot_version }}.pom) from [${{ env.last_spring_boot_version }}](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/${{ env.last_spring_boot_version }}/spring-boot-dependencies-${{ env.last_spring_boot_version }}.pom) and Spring Cloud version [${{ env.spring_cloud_version }}](https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-dependencies/${{ env.spring_cloud_version }}/spring-cloud-dependencies-${{ env.spring_cloud_version }}.pom) from [${{ env.last_spring_cloud_version }}](https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-dependencies/${{ env.last_spring_cloud_version }}/spring-cloud-dependencies-${{ env.last_spring_cloud_version }}.pom).\n${{ env.pr_descriptions }}\n\nThis PR is created by GitHub Actions: https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}" PULL_REQUEST_DRAFT: false @@ -134,7 +148,7 @@ jobs: if: ${{ env.need_update_version == 'true' }} uses: actions/github-script@v7 with: - github-token: ${{ secrets.ACCESS_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} script: | const prNumber = '${{ steps.create_pr.outputs.pull_request_number }}';