-
Notifications
You must be signed in to change notification settings - Fork 135
feat(tools): add automated tool updater #12359
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
11 commits
Select commit
Hold shift + click to select a range
dd1801c
feat(tools): add tool updater
DariuszPorowski 117ca32
refactor(tools): streamline tool updater and manifest handling
DariuszPorowski 4c030f5
feat(manifest): reject multiple YAML documents in tool manifest loading
DariuszPorowski 8b36086
feat(tools): enhance Dependabot-manager integration with bot details …
DariuszPorowski 6bfcf03
docs(README): enhance commands section with detailed usage instructions
DariuszPorowski 9fe4459
feat(tools): implement automated tool update PR workflow and validati…
DariuszPorowski 80637c8
feat(tools): enhance checksum handling with streaming and error retries
DariuszPorowski 178b0d5
fix(script): use --force-with-lease for safer git push in update-tool…
DariuszPorowski 085656e
feat(manifest): enhance WriteManifest to patch tool versions and chec…
DariuszPorowski 9a17ac2
test(terraform): update init container tests to pin Terraform version…
DariuszPorowski d371c1f
fix(script): disable commit.gpgsign for test repository to prevent bl…
DariuszPorowski File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| #!/bin/bash | ||
|
|
||
| # ------------------------------------------------------------ | ||
| # Copyright 2026 The Radius Authors. | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
| # ------------------------------------------------------------ | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| readonly REPO_ROOT="${REPO_ROOT:-$(git rev-parse --show-toplevel)}" | ||
| readonly PR_BASE="${PR_BASE:-main}" | ||
|
|
||
| require_environment() { | ||
| local name | ||
| for name in GH_TOKEN GIT_USER_EMAIL GIT_USER_NAME PR_BRANCH PR_TITLE; do | ||
| if [[ -z "${!name:-}" ]]; then | ||
| echo "Error: ${name} is required" >&2 | ||
| return 1 | ||
| fi | ||
| done | ||
| } | ||
|
|
||
| pull_request_body() { | ||
| cat <<'EOF' | ||
| This automated PR refreshes the pinned command-line tool versions and SHA-256 | ||
| checksums from the release sources declared in `build/tools.yaml`. | ||
|
|
||
| `build/tools.generated.mk` is generated from the manifest and committed with | ||
| it. Bicep remains intentionally held at its compatibility-pinned version until | ||
| local `br:localhost` functional tests support a newer release. | ||
| EOF | ||
| } | ||
|
|
||
| # The workflow checks out only the base branch, so there is no remote-tracking | ||
| # ref to lease against. Read the destination SHA from the remote instead; an | ||
| # empty value leases on the branch not existing yet. | ||
| push_branch() { | ||
| local expected | ||
| expected="$( | ||
| git ls-remote origin "refs/heads/${PR_BRANCH}" | awk '{print $1}' | ||
| )" | ||
| git push --force-with-lease="refs/heads/${PR_BRANCH}:${expected}" \ | ||
| origin "HEAD:${PR_BRANCH}" | ||
| } | ||
|
|
||
| require_environment | ||
| cd "${REPO_ROOT}" | ||
|
|
||
| git config user.name "${GIT_USER_NAME}" | ||
| git config user.email "${GIT_USER_EMAIL}" | ||
| git checkout -B "${PR_BRANCH}" | ||
| git add -A | ||
| git commit --signoff -m "${PR_TITLE}" | ||
| gh auth setup-git | ||
| push_branch | ||
|
|
||
| existing_pr="$( | ||
| gh pr list --state open --head "${PR_BRANCH}" \ | ||
| --json number --jq '.[0].number' | ||
| )" | ||
| body="$(pull_request_body)" | ||
| if [[ -n "${existing_pr}" ]]; then | ||
| gh pr edit "${existing_pr}" --title "${PR_TITLE}" --body "${body}" | ||
| echo "Updated PR #${existing_pr}" | ||
| else | ||
| gh pr create --base "${PR_BASE}" --head "${PR_BRANCH}" \ | ||
| --title "${PR_TITLE}" --body "${body}" | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| #!/bin/bash | ||
|
|
||
| # ------------------------------------------------------------ | ||
| # Copyright 2026 The Radius Authors. | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
| # ------------------------------------------------------------ | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" | ||
| readonly SCRIPT_DIR | ||
| TEST_ROOT="$(mktemp -d)" | ||
| readonly TEST_ROOT | ||
| trap 'rm -rf "${TEST_ROOT}"' EXIT | ||
|
|
||
| fail() { | ||
| echo "FAIL: $*" >&2 | ||
| exit 1 | ||
| } | ||
|
|
||
| assert_contains() { | ||
| local actual="$1" | ||
| local expected="$2" | ||
| [[ "${actual}" == *"${expected}"* ]] || | ||
| fail "expected '${actual}' to contain '${expected}'" | ||
| } | ||
|
|
||
| readonly REPOSITORY="${TEST_ROOT}/repository" | ||
| readonly REMOTE="${TEST_ROOT}/remote.git" | ||
| readonly SEED="${TEST_ROOT}/seed" | ||
| readonly FAKE_BIN="${TEST_ROOT}/bin" | ||
| readonly GH_LOG_PATH="${TEST_ROOT}/gh.log" | ||
|
|
||
| git init -q --bare "${REMOTE}" | ||
| git init -q -b main "${SEED}" | ||
| git -C "${SEED}" config user.name "Test User" | ||
| git -C "${SEED}" config user.email "test@example.com" | ||
| # A contributor's global commit.gpgsign makes git commit block on a signing | ||
| # prompt. DCO --signoff is unrelated and still applies. | ||
| git -C "${SEED}" config commit.gpgsign false | ||
| echo "original" >"${SEED}/tools.yaml" | ||
| git -C "${SEED}" add tools.yaml | ||
| git -C "${SEED}" commit -q -m "initial" | ||
| git -C "${SEED}" remote add origin "${REMOTE}" | ||
| git -C "${SEED}" push -q origin main | ||
|
|
||
| # The workflow checks out the base branch only, so the automation branch never | ||
| # gains a remote-tracking ref. Mirror that here or the pushes below lease | ||
| # against a ref that CI does not have. | ||
| git clone -q --single-branch --branch main "${REMOTE}" "${REPOSITORY}" | ||
| # The script under test commits here, so it needs the same protection. | ||
| git -C "${REPOSITORY}" config commit.gpgsign false | ||
|
|
||
| mkdir -p "${FAKE_BIN}" | ||
| cat >"${FAKE_BIN}/gh" <<'EOF' | ||
|
DariuszPorowski marked this conversation as resolved.
|
||
| #!/bin/bash | ||
| set -euo pipefail | ||
| printf '%s\n' "$*" >>"${GH_LOG}" | ||
| if [[ "$1 $2" == "pr list" ]]; then | ||
| printf '%s\n' "${EXISTING_PR:-}" | ||
| fi | ||
| EOF | ||
| chmod +x "${FAKE_BIN}/gh" | ||
|
|
||
| run_script() { | ||
| local existing_pr="$1" | ||
| PATH="${FAKE_BIN}:${PATH}" \ | ||
| REPO_ROOT="${REPOSITORY}" \ | ||
| GH_LOG="${GH_LOG_PATH}" \ | ||
| EXISTING_PR="${existing_pr}" \ | ||
| GH_TOKEN="test-token" \ | ||
| GIT_USER_EMAIL="automation@example.com" \ | ||
| GIT_USER_NAME="Automation Bot" \ | ||
| PR_BRANCH="automation/update-tools" \ | ||
| PR_TITLE="chore: update pinned tool versions" \ | ||
| bash "${SCRIPT_DIR}/update-tools-pr.sh" >/dev/null | ||
| } | ||
|
|
||
| echo "first update" >>"${REPOSITORY}/tools.yaml" | ||
| run_script "" | ||
|
|
||
| commit_message="$( | ||
| git --git-dir="${REMOTE}" log -1 --format=%B \ | ||
| refs/heads/automation/update-tools | ||
| )" | ||
| assert_contains "${commit_message}" "chore: update pinned tool versions" | ||
| assert_contains \ | ||
| "${commit_message}" \ | ||
| "Signed-off-by: Automation Bot <automation@example.com>" | ||
| assert_contains "$(cat "${GH_LOG_PATH}")" "pr create" | ||
|
|
||
| if git -C "${REPOSITORY}" show-ref --quiet \ | ||
| refs/remotes/origin/automation/update-tools; then | ||
| fail "fixture drifted from CI: the automation branch is now tracked" | ||
| fi | ||
|
|
||
| before="$( | ||
| git --git-dir="${REMOTE}" rev-parse refs/heads/automation/update-tools | ||
| )" | ||
| git -C "${REPOSITORY}" checkout -q main | ||
| echo "second update" >>"${REPOSITORY}/tools.yaml" | ||
| run_script "42" | ||
| after="$( | ||
| git --git-dir="${REMOTE}" rev-parse refs/heads/automation/update-tools | ||
| )" | ||
| assert_contains "$(cat "${GH_LOG_PATH}")" "pr edit 42" | ||
| [[ "${before}" != "${after}" ]] || | ||
| fail "expected the remote automation branch to be updated" | ||
|
|
||
| echo "update-tools-pr tests passed" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.