mirror of
https://github.com/enix/x509-certificate-exporter.git
synced 2026-08-18 19:47:28 +00:00
121 lines
5.1 KiB
YAML
121 lines
5.1 KiB
YAML
name: Dagger module
|
|
|
|
# Keeps dagger/go.mod + go.sum consistent with the module's bindings.
|
|
#
|
|
# Why this exists: Renovate bumps the Dagger version strings (dagger.json
|
|
# engineVersion + the dagger.io/dagger SDK, grouped into one PR) but
|
|
# cannot regenerate the module's bindings. The generated code drives
|
|
# dagger/go.mod's transitive deps — a newer SDK relocates packages like
|
|
# `querybuilder` — so after a bump the committed go.mod is stale. Nothing
|
|
# in CI notices, because `dagger call` regenerates inside its own sandbox;
|
|
# only host `go` tooling (`task go:tidy`, `go build ./dagger`) breaks, on
|
|
# maintainers' machines, days later.
|
|
#
|
|
# So this job runs `dagger develop` for them: on a same-repo PR (which
|
|
# includes every renovate/** branch) it commits the result, so the PR
|
|
# lands complete with no human step. On a fork PR it can't push, so it
|
|
# reports the drift and fails.
|
|
#
|
|
# The push uses the repo's GitHub App token (same App as renovate.yaml),
|
|
# NOT the workflow's GITHUB_TOKEN — for the same reason renovate.yaml
|
|
# does: events caused by GITHUB_TOKEN don't trigger workflows, so a
|
|
# GITHUB_TOKEN push would leave the PR's new head SHA with no
|
|
# `pull_request` runs at all, and branch protection would hold the PR on
|
|
# "expected — waiting for status" until someone re-runs checks by hand.
|
|
# The App push retriggers CI like any human push. The companion setting
|
|
# is `gitIgnoredAuthors` in renovate.json5: without it, Renovate treats
|
|
# a branch carrying our bot commit as "modified by another author" and
|
|
# stops rebasing/updating it.
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- "dagger.json"
|
|
- "dagger/**"
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "dagger.json"
|
|
- "dagger/**"
|
|
# Lets a maintainer exercise this job on any branch without waiting for
|
|
# a Dagger bump to touch the trigger paths.
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
DAGGER_NO_NAG: "1"
|
|
DAGGER_CLOUD_TOKEN: ""
|
|
DO_NOT_TRACK: "1"
|
|
|
|
jobs:
|
|
sync:
|
|
name: Sync generated deps
|
|
runs-on: ubuntu-latest
|
|
# No write permission on GITHUB_TOKEN: the push (when it happens)
|
|
# rides on the App token minted below, precisely so it does NOT come
|
|
# from GITHUB_TOKEN (see header). Inherits contents: read.
|
|
steps:
|
|
# Mint an App token for the push. Skipped on fork PRs twice over:
|
|
# GitHub withholds the App secrets from fork-triggered runs anyway,
|
|
# and the fork path below never pushes — it only reports drift.
|
|
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
|
|
id: app-token
|
|
if: ${{ !github.event.pull_request.head.repo.fork }}
|
|
with:
|
|
client-id: ${{ secrets.RENOVATE_APP_CLIENT_ID }}
|
|
private-key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }}
|
|
|
|
# Checkout the PR's head branch (not the merge commit) so a commit
|
|
# can be pushed back onto it. Credentials are deliberately
|
|
# persisted here — unlike every other job in this repo, this one
|
|
# needs git write access. On forks the app-token step is skipped
|
|
# and this falls back to the (read-only) GITHUB_TOKEN.
|
|
#
|
|
# `repository` must follow `ref`: on a fork PR, head.ref names a
|
|
# branch that only exists in the fork, so checking it out against
|
|
# the base repo would fail (or resolve a same-named base branch).
|
|
# Safe under `pull_request` — the token is read-only and no secrets
|
|
# are exposed, and the default checkout already contains the fork's
|
|
# code via the merge commit. The fork path only ever reads: pushing
|
|
# is gated on IS_FORK below.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
token: ${{ steps.app-token.outputs.token || github.token }}
|
|
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
|
|
ref: ${{ github.event.pull_request.head.ref || github.ref }}
|
|
fetch-depth: 1
|
|
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
# Regenerates dagger.gen.go + internal/ (both gitignored) and
|
|
# realigns dagger/go.mod with what they import.
|
|
- uses: ./.github/actions/dagger
|
|
with:
|
|
verb: develop
|
|
|
|
- run: go -C dagger mod tidy
|
|
|
|
- name: Commit regenerated module deps if changed
|
|
env:
|
|
IS_FORK: ${{ github.event.pull_request.head.repo.fork || false }}
|
|
run: |
|
|
if git diff --quiet -- dagger/go.mod dagger/go.sum; then
|
|
echo "dagger/go.mod already in sync."
|
|
exit 0
|
|
fi
|
|
git --no-pager diff --stat -- dagger/go.mod dagger/go.sum
|
|
if [ "$IS_FORK" = "true" ]; then
|
|
echo "::error::dagger/go.mod is out of sync with the module bindings." \
|
|
"Run 'task dagger:develop' and commit the result." >&2
|
|
exit 1
|
|
fi
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git add dagger/go.mod dagger/go.sum
|
|
git commit -m "build(dagger): regenerate module deps"
|
|
git push
|