You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2025/06/22 09:17:47 UTC
[PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
ppkarwasz opened a new pull request, #419:
URL: https://github.com/apache/logging-parent/pull/419
This PR introduces a **reusable GitHub Actions workflow**, `process-dependabot-reusable`, designed to streamline the handling of Dependabot pull requests across repositories β implemented entirely with **shell scripts**.
This serves as a Bash-based alternative to #418, which uses TypeScript.
### π Key Differences from #418
* **Trigger**: Runs on `pull_request_target` (not `push`), which is required by the `dependabot/fetch-metadata` action.
* **Implementation**: Written using **standard POSIX tools** with a few dependencies:
* **`bash`** β some Bash-specific constructs are used
* **`jq`** β for processing JSON output from `dependabot/fetch-metadata`
* **`xmlstarlet`** β for parsing `pom.xml` and generating a changelog XML file
* **`git`** β to commit and push any changes
* **`gh`** β to enable "auto-merge" on the pull request
This approach avoids the Node.js/TypeScript toolchain and relies only on standard CLI tools commonly available in CI environments.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3084449583
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
Review Comment:
I replaced these lines with the [payload of `workflow_run`](https://docs.github.com/en/webhooks/webhook-events-and-payloads#workflow_run). Unfortunately that one is badly documented.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3084554112
##########
src/site/antora/modules/ROOT/examples/process-dependabot.yaml:
##########
@@ -0,0 +1,52 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: "Dependabot Process PR"
+
+on:
+ workflow_run:
+ workflows:
+ - "Dependabot Analyze PR"
+ types:
+ - completed
+
+permissions: { }
+
+jobs:
+
+# tag::process-dependabot[]
+ process-dependabot:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.event.workflow_run.conclusion == 'success' && github.actor == 'dependabot[bot]' }}
Review Comment:
I added the check.
We probably should decide if we want the checks in the caller workflow, the callee or both, as a defense-in-depth mechanism.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #419:
URL: https://github.com/apache/logging-parent/pull/419#issuecomment-4260121046
> > A Personal Access Token (PAT) with `contents:write` permission must be provided instead.
>
> @ppkarwasz, would you mind explaining how do we do that, please? Do we create an INFRA ticket?
We can upload a secret via `gh secret create`. To test it, you can run:
```
gh secret list
```
on the main Log4j repository. There should be a `TEST_SECRET` I uploaded 7 months ago.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3084442333
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
Review Comment:
This part was simplified, since PR data is now taken from the `workflow_run`-triggered workflow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on PR #419:
URL: https://github.com/apache/logging-parent/pull/419#issuecomment-4259757813
> A Personal Access Token (PAT) with `contents:write` permission must be provided instead.
@ppkarwasz, would you mind explaining how do we do that, please? Do we create an INFRA ticket?
> I'm genuinely happy to look at alternative proposals
I suggest adding a Groovy script to `gha/v0` that maintainers can run using a Maven profile inherited from `logging-parent` and pass it a Dependabot PR URL. For instance:
./mvnw -P generate-dependabot-changelog https://github.com/apache/logging-parent/pull/X
This will
1. Checkout to the associated PR branch
2. Generate changelog entries
Consequently, the maintainer can review these changes, commit, and push them. Since the commits will be originating from a maintainer, the CI will run without any extra permissions, PAT tokens, etc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3094438802
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,59 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call: { }
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ analyze-pull-request:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.pull_request.user.login` skips PRs not opened by Dependabot.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.pull_request.user.login == 'dependabot[bot]'
+ }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # 3.0.0
+ with:
+ github-token: ${{ github.token }}
+
+ # Creates the data required by the `process-dependabot-reusable` workflow as a JSON file.
+ - name: Create artifact
+ shell: bash
+ env:
+ UPDATED_DEPENDENCIES: ${{ steps.dependabot.outputs.updated-dependencies-json }}
+ run: |
+ echo "$UPDATED_DEPENDENCIES" > updated_dependencies.json
+
+ - name: Upload artifact
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # 7.0.1
Review Comment:
This is intentional, all versions will be aligned later by upgrading to the latest.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3094493661
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,59 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call: { }
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
Review Comment:
All our are public: no permissions are the right permissions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3084472789
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
Review Comment:
I added a comment in https://github.com/apache/logging-parent/pull/419/commits/615116f2cab3221ca43a8c18f4222426b2788255
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #419:
URL: https://github.com/apache/logging-parent/pull/419#issuecomment-4275970731
You can for example:
- Convert the PR to draft and back, or
- Update the PR to the latest branch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3084412452
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
Review Comment:
I inlined the values in https://github.com/apache/logging-parent/pull/419/commits/9565410753299800e50564b8f97cb040dd768614
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3084500175
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+ with:
+ ref: ${{ env.PR_HEAD_REF }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Install `xmlstarlet`
+ shell: bash
+ run: sudo apt-get update && sudo apt-get install -y xmlstarlet
+
+ - name: Find the release version major
+ shell: bash
+ run: |
+ revision=$(
+ xmlstarlet sel \
+ -N m=http://maven.apache.org/POM/4.0.0 \
+ --template --value-of /m:project/m:properties/m:revision \
+ pom.xml
+ )
+ if [[ ! $revision =~ ^[0-9]+\.[0-9]+\.[0-9]+(-SNAPSHOT)?$ ]]; then
+ echo "Invalid version format: $revision"
+ exit 1
+ fi
+ parts=(${revision//./ })
+ echo "RELEASE_VERSION_MAJOR=${parts[0]}" >> $GITHUB_ENV
+
+ - name: Create changelog entries
+ shell: bash
+ run: |
+ PULL_REQUEST="$RUNNER_TEMP/dependabot-metadata/pull_request.json"
+ UPDATED_DEPENDENCIES="$RUNNER_TEMP/dependabot-metadata/updated_dependencies.json"
+ # Generates the content of a changelog entry
+ function generate_changelog_entry() {
+ local dependency="$1"
+ local issue_id=$(xmlstarlet esc "$PR_ID")
+ local issue_link=$(xmlstarlet esc "$PR_URL")
+ local dependency_name=$(echo "$dependency" | jq -r '.dependencyName' | xmlstarlet esc)
+ local new_version=$(echo "$dependency" | jq -r '.newVersion' | xmlstarlet esc)
+ cat << CHANGELOG_ENTRY
+ <?xml version="1.0" encoding="UTF-8"?>
+ <!-- SPDX-License-Identifier: Apache-2.0 -->
Review Comment:
This is not related with SBOM formats.
SPDX identifiers are a standard set of identifiers for licenses: https://spdx.org/licenses/
RAT recognizes a `SPDX-License-Identifier` as a replacement for a βstandardβ license header.
Anyway, I removed this in https://github.com/apache/logging-parent/pull/419/commits/499214f92d8e2ae70aa41ce013ec137b0b7438ee
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on PR #419:
URL: https://github.com/apache/logging-parent/pull/419#issuecomment-4275597947
> @vy, do you have anything against this PR if we **don't** use a PAT, but tricks?
@ppkarwasz, if we don't use a PAT, how will it work?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r2163708137
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,171 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ AUTO_MERGE_TOKEN:
+ description: GitHub token to enable auto-merge on PR
+ required: true
+ CONTENT_WRITE_TOKEN:
+ description: GitHub token to push changes
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
Review Comment:
Thank you, but I'll pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r2496256595
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
Review Comment:
Good point, no! I need these parameters for now to test the workflow with a different GPG key in my fork.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3094151067
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,59 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call: { }
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ analyze-pull-request:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.pull_request.user.login` skips PRs not opened by Dependabot.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.pull_request.user.login == 'dependabot[bot]'
+ }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # 3.0.0
+ with:
+ github-token: ${{ github.token }}
+
+ # Creates the data required by the `process-dependabot-reusable` workflow as a JSON file.
+ - name: Create artifact
+ shell: bash
+ env:
+ UPDATED_DEPENDENCIES: ${{ steps.dependabot.outputs.updated-dependencies-json }}
+ run: |
+ echo "$UPDATED_DEPENDENCIES" > updated_dependencies.json
+
+ - name: Upload artifact
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # 7.0.1
Review Comment:
This workflow pins `actions/upload-artifact` to a different commit than the rest of the repo (most workflows use `actions/upload-artifact@ea165f8d... # 4.6.2`, e.g. `.github/workflows/build-reusable.yaml:143`). Aligning on a single vetted pin/version across workflows makes supply-chain auditing and maintenance easier.
```suggestion
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # 4.6.2
```
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,142 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ changelog-path:
+ description: The path to the changelog directory (e.g. `src/changelog/.2.x.x`)
+ required: true
+ type: string
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.workflow_run.conclusion` only runs after a successful analysis workflow.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ runs-on: ubuntu-latest
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
+ contents: write
+ pull-requests: write
+
+ steps:
+
+ - name: Get pull request metadata
+ id: pr
+ env:
+ # Reference of the payload: https://docs.github.com/en/webhooks/webhook-events-and-payloads#workflow_run
+ #
+ # The structure of `pull_requests` is not documented, so we'll dump it for debugging purposes.
+ PULL_REQUESTS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
+ run: |
+ # Print payload for debugging
+ jq <<< "$PULL_REQUESTS"
+ echo "id=$(echo "$PULL_REQUESTS" | jq -r '.[0].number')" >> "$GITHUB_OUTPUT"
+ echo "head-ref=$(echo "$PULL_REQUESTS" | jq -r '.[0].head.ref')" >> "$GITHUB_OUTPUT"
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}
+ run-id: ${{ github.event.workflow_run.id }}
+
+ - name: Check out repository
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+ with:
+ ref: ${{ steps.pr.outputs.head-ref }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Create changelog entries
+ shell: bash
+ env:
+ PR_ID: ${{ steps.pr.outputs.id }}
+ PR_URL: ${{ github.server_url }}/${{ github.repository }}/pull/${{ steps.pr.outputs.id }}
+ CHANGELOG_PATH: ${{ inputs.changelog-path }}
+ UPDATED_DEPENDENCIES: ${{ runner.temp }}/updated_dependencies.json
+ run: |
+ # Escapes special XML characters in a string
+ xml_escape() { sed 's/&/\&/g; s/</\</g; s/>/\>/g; s/"/\"/g'; }
+
+ # Generates the content of a changelog entry
+ function generate_changelog_entry() {
+ local dependency="$1"
+ local issue_id=$(xml_escape <<< "$PR_ID")
+ local issue_link=$(xml_escape <<< "$PR_URL")
+ local dependency_name=$(echo "$dependency" | jq -r '.dependencyName' | xml_escape)
+ local new_version=$(echo "$dependency" | jq -r '.newVersion' | xml_escape)
+ cat << CHANGELOG_ENTRY
+ <?xml version="1.0" encoding="UTF-8"?>
+ <entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="https://logging.apache.org/xml/ns"
+ xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+ type="updated">
+ <issue id="$issue_id" link="$issue_link"/>
+ <description format="asciidoc">Update \`$dependency_name\` to version \`$new_version\`</description>
+ </entry>
+ CHANGELOG_ENTRY
+ }
+
+ # Ensure the changelog directory exists
+ mkdir -p "$CHANGELOG_PATH"
+ cd "$CHANGELOG_PATH"
+
+ # Generate the changelog entries for each updated dependency
+ cat "$UPDATED_DEPENDENCIES" | jq --compact-output '.[]' | while read -r dependency; do
+ # Extract the dependency name and version
+ dependency_name=$(echo "$dependency" | jq -r '.dependencyName')
+ changelog_file_name=$(echo "update_${dependency_name,,}.xml" | sed -r -e 's/[^a-z0-9.-]/_/g' -e 's/_+/_/g')
+ generate_changelog_entry "$dependency" > "$changelog_file_name"
+ done
+
+ - name: Add & commit changes
+ shell: bash
+ env:
+ CHANGELOG_PATH: ${{ inputs.changelog-path }}
+ PR_ID: ${{ steps.pr.outputs.id }}
+ run: |
+ git add "$CHANGELOG_PATH"
+ git config user.name "github-actions[bot]"
+ git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+ git commit -m "Generate changelog entries for #$PR_ID"
+ git push origin
Review Comment:
`git commit` will fail the job when there are no staged changes (e.g., reruns or when files already exist). Also, `git push origin` relies on upstream configuration. Consider guarding the commit with a staged-diff check (skip if clean) and pushing explicitly to the PR head ref to make the behavior deterministic.
```suggestion
HEAD_REF: ${{ steps.pr.outputs.head-ref }}
run: |
git add "$CHANGELOG_PATH"
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
if git diff --cached --quiet; then
echo "No changelog changes to commit."
else
git commit -m "Generate changelog entries for #$PR_ID"
git push origin "HEAD:${HEAD_REF}"
fi
```
##########
src/site/antora/modules/ROOT/examples/process-dependabot.yaml:
##########
@@ -0,0 +1,50 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: "Dependabot Process PR"
+
+on:
+ workflow_run:
+ workflows:
+ - "Dependabot Analyze PR"
+ types:
+ - completed
+
+permissions: { }
+
+jobs:
+
+# tag::process-dependabot[]
+ process-dependabot:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{
+ github.repository == 'apache/logging-parent'
+ && github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ uses: apache/logging-parent/.github/workflows/process-dependabot-reusable.yaml@rel/{project-version}
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
Review Comment:
This caller workflow grants only `contents: write` and `pull-requests: write`. Since the reusable `process-dependabot` workflow downloads an artifact from another workflow run, the caller likely also needs to grant `actions: read` (token permissions in a called workflow are capped by the caller).
```suggestion
# and to allow the reusable workflow to download artifacts from another workflow run.
actions: read
```
##########
src/site/antora/modules/ROOT/pages/workflows.adoc:
##########
@@ -104,10 +104,64 @@ To verify the reproducibility of a release, you can use:
include::example$build.yaml[tag=verify-reproducibility-release,indent=0]
----
-[#merge-dependabot]
-== {project-github-url}/blob/main/.github/workflows/merge-dependabot-reusable.yaml[`merge-dependabot-reusable.yaml`]
+[#analyze-dependabot]
+== {project-github-url}/blob/main/.github/workflows/analyze-dependabot-reusable.yaml[`analyze-dependabot-reusable.yaml`]
-Merges Dependabot PRs along with changelog entries.
+Analyzes Dependabot pull requests to collect detailed information about updated dependencies.
+Stores the results in the `dependabot-metadata` artifact,
+which is later consumed by the <<process-dependabot>> workflow to automate changelog generation and PR processing.
+
Review Comment:
This change removes/replaces the `merge-dependabot` section (anchor `[#merge-dependabot]`), but `workflows.adoc` still references `<<merge-dependabot>>` in the workflow list near the top of the page. Please update the list (and any other cross-references) to point to the new `analyze-dependabot` / `process-dependabot` sections so the docs don't contain broken links.
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,142 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ changelog-path:
+ description: The path to the changelog directory (e.g. `src/changelog/.2.x.x`)
+ required: true
+ type: string
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.workflow_run.conclusion` only runs after a successful analysis workflow.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ runs-on: ubuntu-latest
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
Review Comment:
The job downloads an artifact from a different workflow run (`actions/download-artifact` with `run-id:`). That typically requires `actions: read` on the `GITHUB_TOKEN`, but the job only grants `contents: write` and `pull-requests: write`. Please add the minimal `actions: read` permission so artifact download works reliably.
```suggestion
# The default GITHUB_TOKEN is used both to download an artifact from the
# triggering workflow run and to enable the "auto-merge" on the PR.
actions: read
```
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,59 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call: { }
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ analyze-pull-request:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.pull_request.user.login` skips PRs not opened by Dependabot.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.pull_request.user.login == 'dependabot[bot]'
+ }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # 3.0.0
+ with:
+ github-token: ${{ github.token }}
+
Review Comment:
`dependabot/fetch-metadata` is invoked with `github-token: ${{ github.token }}`, but with the current `permissions: { }` the token may not be able to read PR metadata. Please ensure the job/workflow grants the required read permissions so this step can reliably access the GitHub API.
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,142 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ changelog-path:
+ description: The path to the changelog directory (e.g. `src/changelog/.2.x.x`)
+ required: true
+ type: string
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.workflow_run.conclusion` only runs after a successful analysis workflow.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ runs-on: ubuntu-latest
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
+ contents: write
+ pull-requests: write
+
+ steps:
+
+ - name: Get pull request metadata
+ id: pr
+ env:
+ # Reference of the payload: https://docs.github.com/en/webhooks/webhook-events-and-payloads#workflow_run
+ #
+ # The structure of `pull_requests` is not documented, so we'll dump it for debugging purposes.
+ PULL_REQUESTS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
+ run: |
+ # Print payload for debugging
+ jq <<< "$PULL_REQUESTS"
+ echo "id=$(echo "$PULL_REQUESTS" | jq -r '.[0].number')" >> "$GITHUB_OUTPUT"
+ echo "head-ref=$(echo "$PULL_REQUESTS" | jq -r '.[0].head.ref')" >> "$GITHUB_OUTPUT"
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}
+ run-id: ${{ github.event.workflow_run.id }}
+
+ - name: Check out repository
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
Review Comment:
`actions/checkout` is pinned to a different commit/version than the rest of the repository (most workflows use `actions/checkout@11bd7190... # 4.2.2`). For consistency and easier security auditing, consider using the same vetted pin across workflows unless there's a specific need for a different version.
```suggestion
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
```
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,59 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call: { }
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
Review Comment:
This reusable workflow sets `permissions: { }`, which makes `GITHUB_TOKEN` permissionless. Because the workflow uses `github.token` later, it should explicitly grant the minimal read permissions it needs (typically `pull-requests: read` and `contents: read`) at the workflow or job level.
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,142 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ changelog-path:
+ description: The path to the changelog directory (e.g. `src/changelog/.2.x.x`)
+ required: true
+ type: string
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.workflow_run.conclusion` only runs after a successful analysis workflow.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ runs-on: ubuntu-latest
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
+ contents: write
+ pull-requests: write
+
+ steps:
+
+ - name: Get pull request metadata
+ id: pr
+ env:
+ # Reference of the payload: https://docs.github.com/en/webhooks/webhook-events-and-payloads#workflow_run
+ #
+ # The structure of `pull_requests` is not documented, so we'll dump it for debugging purposes.
+ PULL_REQUESTS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
+ run: |
+ # Print payload for debugging
+ jq <<< "$PULL_REQUESTS"
+ echo "id=$(echo "$PULL_REQUESTS" | jq -r '.[0].number')" >> "$GITHUB_OUTPUT"
+ echo "head-ref=$(echo "$PULL_REQUESTS" | jq -r '.[0].head.ref')" >> "$GITHUB_OUTPUT"
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}
+ run-id: ${{ github.event.workflow_run.id }}
+
+ - name: Check out repository
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+ with:
+ ref: ${{ steps.pr.outputs.head-ref }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Create changelog entries
+ shell: bash
+ env:
+ PR_ID: ${{ steps.pr.outputs.id }}
+ PR_URL: ${{ github.server_url }}/${{ github.repository }}/pull/${{ steps.pr.outputs.id }}
+ CHANGELOG_PATH: ${{ inputs.changelog-path }}
+ UPDATED_DEPENDENCIES: ${{ runner.temp }}/updated_dependencies.json
+ run: |
+ # Escapes special XML characters in a string
+ xml_escape() { sed 's/&/\&/g; s/</\</g; s/>/\>/g; s/"/\"/g'; }
+
+ # Generates the content of a changelog entry
+ function generate_changelog_entry() {
+ local dependency="$1"
+ local issue_id=$(xml_escape <<< "$PR_ID")
+ local issue_link=$(xml_escape <<< "$PR_URL")
+ local dependency_name=$(echo "$dependency" | jq -r '.dependencyName' | xml_escape)
+ local new_version=$(echo "$dependency" | jq -r '.newVersion' | xml_escape)
+ cat << CHANGELOG_ENTRY
+ <?xml version="1.0" encoding="UTF-8"?>
+ <entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="https://logging.apache.org/xml/ns"
+ xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+ type="updated">
+ <issue id="$issue_id" link="$issue_link"/>
+ <description format="asciidoc">Update \`$dependency_name\` to version \`$new_version\`</description>
+ </entry>
+ CHANGELOG_ENTRY
+ }
+
+ # Ensure the changelog directory exists
+ mkdir -p "$CHANGELOG_PATH"
+ cd "$CHANGELOG_PATH"
+
+ # Generate the changelog entries for each updated dependency
+ cat "$UPDATED_DEPENDENCIES" | jq --compact-output '.[]' | while read -r dependency; do
+ # Extract the dependency name and version
+ dependency_name=$(echo "$dependency" | jq -r '.dependencyName')
+ changelog_file_name=$(echo "update_${dependency_name,,}.xml" | sed -r -e 's/[^a-z0-9.-]/_/g' -e 's/_+/_/g')
+ generate_changelog_entry "$dependency" > "$changelog_file_name"
+ done
Review Comment:
Changelog filenames are derived from a sanitized `dependencyName` only. Different dependency names can sanitize to the same filename (e.g., `foo/bar` vs `foo-bar`), which would cause one entry to overwrite another in multi-dependency PRs. Consider incorporating an additional unique field (like `dependencyName` plus ecosystem / directory) or detecting collisions and failing with a clear error.
```suggestion
declare -A generated_changelog_files=()
while read -r dependency; do
# Extract the dependency name and version
dependency_name=$(echo "$dependency" | jq -r '.dependencyName')
changelog_file_name=$(echo "update_${dependency_name,,}.xml" | sed -r -e 's/[^a-z0-9.-]/_/g' -e 's/_+/_/g')
if [[ -n "${generated_changelog_files[$changelog_file_name]+x}" ]] && [[ "${generated_changelog_files[$changelog_file_name]}" != "$dependency_name" ]]; then
echo "::error title=Duplicate changelog filename::Dependencies '${generated_changelog_files[$changelog_file_name]}' and '$dependency_name' both map to '$changelog_file_name' after sanitization. Update the filename generation to include an additional unique field."
exit 1
fi
generated_changelog_files["$changelog_file_name"]="$dependency_name"
generate_changelog_entry "$dependency" > "$changelog_file_name"
done < <(jq --compact-output '.[]' "$UPDATED_DEPENDENCIES")
```
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,142 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ changelog-path:
+ description: The path to the changelog directory (e.g. `src/changelog/.2.x.x`)
+ required: true
+ type: string
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.workflow_run.conclusion` only runs after a successful analysis workflow.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ runs-on: ubuntu-latest
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
+ contents: write
+ pull-requests: write
+
+ steps:
+
+ - name: Get pull request metadata
+ id: pr
+ env:
+ # Reference of the payload: https://docs.github.com/en/webhooks/webhook-events-and-payloads#workflow_run
+ #
+ # The structure of `pull_requests` is not documented, so we'll dump it for debugging purposes.
+ PULL_REQUESTS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
+ run: |
+ # Print payload for debugging
+ jq <<< "$PULL_REQUESTS"
Review Comment:
This step assumes `github.event.workflow_run.pull_requests[0]` exists. If the `workflow_run` payload has an empty `pull_requests` array (or multiple PRs), this will emit `null` outputs and later steps will fail. Add a guard that checks the array length and errors out with a clear message (or selects the intended PR deterministically).
```suggestion
jq <<< "$PULL_REQUESTS"
pr_count="$(echo "$PULL_REQUESTS" | jq 'length')"
if [ "$pr_count" -ne 1 ]; then
echo "::error::Expected workflow_run.pull_requests to contain exactly 1 pull request, found $pr_count."
exit 1
fi
```
##########
src/site/antora/modules/ROOT/pages/workflows.adoc:
##########
@@ -104,10 +104,64 @@ To verify the reproducibility of a release, you can use:
include::example$build.yaml[tag=verify-reproducibility-release,indent=0]
----
-[#merge-dependabot]
-== {project-github-url}/blob/main/.github/workflows/merge-dependabot-reusable.yaml[`merge-dependabot-reusable.yaml`]
+[#analyze-dependabot]
+== {project-github-url}/blob/main/.github/workflows/analyze-dependabot-reusable.yaml[`analyze-dependabot-reusable.yaml`]
-Merges Dependabot PRs along with changelog entries.
+Analyzes Dependabot pull requests to collect detailed information about updated dependencies.
+Stores the results in the `dependabot-metadata` artifact,
+which is later consumed by the <<process-dependabot>> workflow to automate changelog generation and PR processing.
+
+[NOTE]
+====
+This workflow must be triggered by an event that includes the `pull_request` payload and does not require any privileges.
+It can then be used in a `pull_request` workflow.
+====
+
+.Snippet from an {examples-base-link}/analyze-dependabot.yaml[example `analyze-dependabot.yaml`] using this workflow
+[source,yaml,subs=+attributes]
+----
+include::example$analyze-dependabot.yaml[tag=analyze-dependabot,indent=0]
+----
+
+[#process-dependabot]
+== {project-github-url}/blob/main/.github/workflows/process-dependabot-reusable.yaml[`process-dependabot-reusable.yaml`]
+
+Helps to process Dependabot pull requests by:
+
+* Generating changelog entries for the updated dependencies.
+* Enabling the "auto-merge" option for the pull request.
+
+The workflow needs the following privileged tokens:
+
+`GITHUB_TOKEN`::
+The default GitHub token with `contents:write` and `pull_requests:write` permissions,
Review Comment:
Docs refer to the permission as `pull_requests:write`, but the actual workflow permission key is `pull-requests: write`. Please update the documentation to use the correct permission name so readers configure permissions correctly.
```suggestion
The default GitHub token with `contents:write` and `pull-requests: write` permissions,
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r2496228471
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,55 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call:
+
+jobs:
+
+ analyze-pull-request:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: ppkarwasz/fetch-metadata@feat/multi-versions
Review Comment:
I'll try to make it work with `dependabot/fetch-metadata`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r2496229727
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,55 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call:
+
+jobs:
+
+ analyze-pull-request:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: ppkarwasz/fetch-metadata@feat/multi-versions
+ with:
+ github-token: ${{ github.token }}
+
+ #
+ # Stores the data required by the process-dependabot-reusable workflow as JSON files.
+ #
+ - name: Create artifacts
+ shell: bash
+ env:
+ PULL_REQUEST: ${{ toJSON(github.event.pull_request) }}
+ UPDATED_DEPENDENCIES: ${{ steps.dependabot.outputs.updated-dependencies-json }}
+ run: |
+ mkdir -p dependabot-metadata
Review Comment:
Fixed in https://github.com/apache/logging-parent/pull/419/commits/fbdf6093748a47a3627cbc9ec15fc9cc1c9a345e
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #419:
URL: https://github.com/apache/logging-parent/pull/419#issuecomment-4261602080
I haven't tested yet, but apparently converting a PR to draft and back triggers workflows.
@vy, do you have anything against this PR if we **don't** use a PAT, but tricks?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3094441959
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,142 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ changelog-path:
+ description: The path to the changelog directory (e.g. `src/changelog/.2.x.x`)
+ required: true
+ type: string
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.workflow_run.conclusion` only runs after a successful analysis workflow.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ runs-on: ubuntu-latest
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
+ contents: write
+ pull-requests: write
+
+ steps:
+
+ - name: Get pull request metadata
+ id: pr
+ env:
+ # Reference of the payload: https://docs.github.com/en/webhooks/webhook-events-and-payloads#workflow_run
+ #
+ # The structure of `pull_requests` is not documented, so we'll dump it for debugging purposes.
+ PULL_REQUESTS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
+ run: |
+ # Print payload for debugging
+ jq <<< "$PULL_REQUESTS"
+ echo "id=$(echo "$PULL_REQUESTS" | jq -r '.[0].number')" >> "$GITHUB_OUTPUT"
+ echo "head-ref=$(echo "$PULL_REQUESTS" | jq -r '.[0].head.ref')" >> "$GITHUB_OUTPUT"
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}
+ run-id: ${{ github.event.workflow_run.id }}
+
+ - name: Check out repository
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
Review Comment:
This is intentional, all versions will be aligned later by upgrading to the latest.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on PR #419:
URL: https://github.com/apache/logging-parent/pull/419#issuecomment-4250145998
Can you keep this PR on hold, please? I will suggest an alternative in a day or two.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r2163671774
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,171 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ AUTO_MERGE_TOKEN:
+ description: GitHub token to enable auto-merge on PR
+ required: true
+ CONTENT_WRITE_TOKEN:
+ description: GitHub token to push changes
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
Review Comment:
[nitpick] Pinning the checkout action to a commit hash is acceptable, but consider using a stable release tag (e.g. actions/checkout@v3) to benefit from official versioning and easier maintenance.
```suggestion
uses: actions/checkout@v3
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3094533706
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,142 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ changelog-path:
+ description: The path to the changelog directory (e.g. `src/changelog/.2.x.x`)
+ required: true
+ type: string
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.workflow_run.conclusion` only runs after a successful analysis workflow.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ runs-on: ubuntu-latest
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
Review Comment:
This didn't pose a problem in tests: all the repos are public.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3084572171
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,55 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call:
+
+jobs:
+
+ analyze-pull-request:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: ppkarwasz/fetch-metadata@feat/multi-versions
+ with:
+ github-token: ${{ github.token }}
+
+ #
+ # Stores the data required by the process-dependabot-reusable workflow as JSON files.
+ #
+ - name: Create artifacts
+ shell: bash
+ env:
+ PULL_REQUEST: ${{ toJSON(github.event.pull_request) }}
+ UPDATED_DEPENDENCIES: ${{ steps.dependabot.outputs.updated-dependencies-json }}
+ run: |
+ mkdir -p dependabot-metadata
+ echo "$PULL_REQUEST" > dependabot-metadata/pull_request.json
+ echo "$UPDATED_DEPENDENCIES" > dependabot-metadata/updated_dependencies.json
Review Comment:
The main question is: are we confident enough these workflows will not run on a malicious PR? I prefer to split them in two and running something on `workflow_run` is easier to validate by INFRA then running on `pull_request_target`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz merged PR #419:
URL: https://github.com/apache/logging-parent/pull/419
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r2309248142
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,55 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call:
+
+jobs:
+
+ analyze-pull-request:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: ppkarwasz/fetch-metadata@feat/multi-versions
Review Comment:
I presume this will be replaced once dependabot/fetch-metadata#632 is merged.
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,55 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call:
+
+jobs:
+
+ analyze-pull-request:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: ppkarwasz/fetch-metadata@feat/multi-versions
+ with:
+ github-token: ${{ github.token }}
+
+ #
+ # Stores the data required by the process-dependabot-reusable workflow as JSON files.
+ #
+ - name: Create artifacts
+ shell: bash
+ env:
+ PULL_REQUEST: ${{ toJSON(github.event.pull_request) }}
+ UPDATED_DEPENDENCIES: ${{ steps.dependabot.outputs.updated-dependencies-json }}
+ run: |
+ mkdir -p dependabot-metadata
Review Comment:
Is `-p` necessary here, since we only provide a single folder name?
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
Review Comment:
Do we expect an occasion where these defaults will be overriden? If not, please consider inlining them. I prefer code that is 8 lines shorter compared to a functionality that we don't use.
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+ with:
+ ref: ${{ env.PR_HEAD_REF }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Install `xmlstarlet`
+ shell: bash
+ run: sudo apt-get update && sudo apt-get install -y xmlstarlet
+
+ - name: Find the release version major
+ shell: bash
+ run: |
+ revision=$(
+ xmlstarlet sel \
+ -N m=http://maven.apache.org/POM/4.0.0 \
+ --template --value-of /m:project/m:properties/m:revision \
+ pom.xml
+ )
+ if [[ ! $revision =~ ^[0-9]+\.[0-9]+\.[0-9]+(-SNAPSHOT)?$ ]]; then
+ echo "Invalid version format: $revision"
+ exit 1
+ fi
+ parts=(${revision//./ })
+ echo "RELEASE_VERSION_MAJOR=${parts[0]}" >> $GITHUB_ENV
Review Comment:
We can alternatively use the parameter expansion:
```suggestion
revisionMajor=${revision%%.*}
echo "RELEASE_VERSION_MAJOR=$revisionMajor" >> $GITHUB_ENV
```
##########
src/site/antora/modules/ROOT/examples/process-dependabot.yaml:
##########
@@ -0,0 +1,52 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: "Dependabot Process PR"
+
+on:
+ workflow_run:
+ workflows:
+ - "Dependabot Analyze PR"
+ types:
+ - completed
+
+permissions: { }
+
+jobs:
+
+# tag::process-dependabot[]
+ process-dependabot:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.event.workflow_run.conclusion == 'success' && github.actor == 'dependabot[bot]' }}
Review Comment:
Again, I'd keep the repository name validation.
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,55 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call:
Review Comment:
```suggestion
workflow_call: { }
```
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,55 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call:
+
+jobs:
+
+ analyze-pull-request:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: ppkarwasz/fetch-metadata@feat/multi-versions
+ with:
+ github-token: ${{ github.token }}
+
+ #
+ # Stores the data required by the process-dependabot-reusable workflow as JSON files.
+ #
Review Comment:
```suggestion
# Creates the data required by the `process-dependabot-reusable` workflow as JSON files.
```
##########
.github/workflows/analyze-dependabot-reusable.yaml:
##########
@@ -0,0 +1,55 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Analyze PR
+
+on:
+ workflow_call:
+
+jobs:
+
+ analyze-pull-request:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ id: dependabot
+ uses: ppkarwasz/fetch-metadata@feat/multi-versions
+ with:
+ github-token: ${{ github.token }}
+
+ #
+ # Stores the data required by the process-dependabot-reusable workflow as JSON files.
+ #
+ - name: Create artifacts
+ shell: bash
+ env:
+ PULL_REQUEST: ${{ toJSON(github.event.pull_request) }}
+ UPDATED_DEPENDENCIES: ${{ steps.dependabot.outputs.updated-dependencies-json }}
+ run: |
+ mkdir -p dependabot-metadata
+ echo "$PULL_REQUEST" > dependabot-metadata/pull_request.json
+ echo "$UPDATED_DEPENDENCIES" > dependabot-metadata/updated_dependencies.json
Review Comment:
This is the meat of this entire reusable workflow, 2 LoC, the rest is just ceremony. I think this should consider integrating this into `process-d-r`, and removing `analyze-d-r`.
IIRC, you introduce this split for `analyze-d-r` needs less privileges compared to `process-d-r`. But the former is useless without the latter, hence, the split just inflates 2 LoC to 55 LoC, not to mention the inflation at call sites invoking these reusables.
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+ with:
+ ref: ${{ env.PR_HEAD_REF }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Install `xmlstarlet`
+ shell: bash
+ run: sudo apt-get update && sudo apt-get install -y xmlstarlet
+
+ - name: Find the release version major
+ shell: bash
+ run: |
+ revision=$(
+ xmlstarlet sel \
+ -N m=http://maven.apache.org/POM/4.0.0 \
+ --template --value-of /m:project/m:properties/m:revision \
+ pom.xml
+ )
+ if [[ ! $revision =~ ^[0-9]+\.[0-9]+\.[0-9]+(-SNAPSHOT)?$ ]]; then
+ echo "Invalid version format: $revision"
+ exit 1
+ fi
+ parts=(${revision//./ })
+ echo "RELEASE_VERSION_MAJOR=${parts[0]}" >> $GITHUB_ENV
+
+ - name: Create changelog entries
+ shell: bash
+ run: |
+ PULL_REQUEST="$RUNNER_TEMP/dependabot-metadata/pull_request.json"
+ UPDATED_DEPENDENCIES="$RUNNER_TEMP/dependabot-metadata/updated_dependencies.json"
+ # Generates the content of a changelog entry
+ function generate_changelog_entry() {
+ local dependency="$1"
+ local issue_id=$(xmlstarlet esc "$PR_ID")
+ local issue_link=$(xmlstarlet esc "$PR_URL")
+ local dependency_name=$(echo "$dependency" | jq -r '.dependencyName' | xmlstarlet esc)
+ local new_version=$(echo "$dependency" | jq -r '.newVersion' | xmlstarlet esc)
+ cat << CHANGELOG_ENTRY
+ <?xml version="1.0" encoding="UTF-8"?>
+ <!-- SPDX-License-Identifier: Apache-2.0 -->
Review Comment:
AFAIK, Logging Services speak CDX, not SPDX. I think we should discuss this with the rest of the crew and introduce it in a mass roll out instead of piggybacking.
```suggestion
<!-- SPDX-License-Identifier: Apache-2.0 -->
```
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
Review Comment:
Do we have a spec. somewhere on the JSON schema of the dependabot PR payload? If yes, sharing it here in a comment would be very useful for the next maintainer troubleshooting an issue here.
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
Review Comment:
All of this can be avoided if 2 LoC moved from `analyze-d-r` to here.
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+ with:
+ ref: ${{ env.PR_HEAD_REF }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Install `xmlstarlet`
+ shell: bash
+ run: sudo apt-get update && sudo apt-get install -y xmlstarlet
+
+ - name: Find the release version major
+ shell: bash
+ run: |
+ revision=$(
+ xmlstarlet sel \
+ -N m=http://maven.apache.org/POM/4.0.0 \
+ --template --value-of /m:project/m:properties/m:revision \
+ pom.xml
+ )
+ if [[ ! $revision =~ ^[0-9]+\.[0-9]+\.[0-9]+(-SNAPSHOT)?$ ]]; then
+ echo "Invalid version format: $revision"
+ exit 1
+ fi
+ parts=(${revision//./ })
+ echo "RELEASE_VERSION_MAJOR=${parts[0]}" >> $GITHUB_ENV
+
+ - name: Create changelog entries
+ shell: bash
+ run: |
+ PULL_REQUEST="$RUNNER_TEMP/dependabot-metadata/pull_request.json"
+ UPDATED_DEPENDENCIES="$RUNNER_TEMP/dependabot-metadata/updated_dependencies.json"
+ # Generates the content of a changelog entry
+ function generate_changelog_entry() {
+ local dependency="$1"
+ local issue_id=$(xmlstarlet esc "$PR_ID")
+ local issue_link=$(xmlstarlet esc "$PR_URL")
+ local dependency_name=$(echo "$dependency" | jq -r '.dependencyName' | xmlstarlet esc)
+ local new_version=$(echo "$dependency" | jq -r '.newVersion' | xmlstarlet esc)
+ cat << CHANGELOG_ENTRY
+ <?xml version="1.0" encoding="UTF-8"?>
+ <!-- SPDX-License-Identifier: Apache-2.0 -->
+ <entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="https://logging.apache.org/xml/ns"
+ xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+ type="updated">
+ <issue id="$issue_id" link="$issue_link"/>
+ <description format="asciidoc">Update \`$dependency_name\` to version \`$new_version\`.</description>
+ </entry>
+ CHANGELOG_ENTRY
+ }
+ # Ensure the changelog directory exists
+ release_changelog_path="src/changelog/.${RELEASE_VERSION_MAJOR}.x.x"
+ mkdir -p "$release_changelog_path"
+ cd "$release_changelog_path"
+ # Generate the changelog entries for each updated dependency
+ cat "$UPDATED_DEPENDENCIES" | jq --compact-output '.[]' | while read -r dependency; do
+ # Extract the dependency name and version
+ dependency_name=$(echo "$dependency" | jq -r '.dependencyName')
+ changelog_file_name=$(echo "update_${dependency_name,,}.xml" | sed -r -e 's/[^a-z0-9.-]/_/g' -e 's/_+/_/g')
+ generate_changelog_entry "$dependency" > "$changelog_file_name"
+ done
+
+ - name: Set up GPG
+ uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # 6.3.0
Review Comment:
_"In `crazy-max` we trust."_ :tm: We won't be shot by the ASF police for using this, right?
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+ with:
+ ref: ${{ env.PR_HEAD_REF }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Install `xmlstarlet`
+ shell: bash
+ run: sudo apt-get update && sudo apt-get install -y xmlstarlet
+
+ - name: Find the release version major
+ shell: bash
+ run: |
+ revision=$(
+ xmlstarlet sel \
+ -N m=http://maven.apache.org/POM/4.0.0 \
+ --template --value-of /m:project/m:properties/m:revision \
+ pom.xml
+ )
+ if [[ ! $revision =~ ^[0-9]+\.[0-9]+\.[0-9]+(-SNAPSHOT)?$ ]]; then
+ echo "Invalid version format: $revision"
+ exit 1
+ fi
+ parts=(${revision//./ })
+ echo "RELEASE_VERSION_MAJOR=${parts[0]}" >> $GITHUB_ENV
+
+ - name: Create changelog entries
+ shell: bash
+ run: |
+ PULL_REQUEST="$RUNNER_TEMP/dependabot-metadata/pull_request.json"
+ UPDATED_DEPENDENCIES="$RUNNER_TEMP/dependabot-metadata/updated_dependencies.json"
+ # Generates the content of a changelog entry
+ function generate_changelog_entry() {
+ local dependency="$1"
+ local issue_id=$(xmlstarlet esc "$PR_ID")
+ local issue_link=$(xmlstarlet esc "$PR_URL")
+ local dependency_name=$(echo "$dependency" | jq -r '.dependencyName' | xmlstarlet esc)
+ local new_version=$(echo "$dependency" | jq -r '.newVersion' | xmlstarlet esc)
+ cat << CHANGELOG_ENTRY
+ <?xml version="1.0" encoding="UTF-8"?>
+ <!-- SPDX-License-Identifier: Apache-2.0 -->
+ <entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="https://logging.apache.org/xml/ns"
+ xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+ type="updated">
+ <issue id="$issue_id" link="$issue_link"/>
+ <description format="asciidoc">Update \`$dependency_name\` to version \`$new_version\`.</description>
Review Comment:
I'd stick to the existing description:
```suggestion
<description format="asciidoc">Update \`$dependency_name\` to version \`$new_version\`</description>
```
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+ with:
+ ref: ${{ env.PR_HEAD_REF }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Install `xmlstarlet`
+ shell: bash
+ run: sudo apt-get update && sudo apt-get install -y xmlstarlet
+
+ - name: Find the release version major
+ shell: bash
+ run: |
+ revision=$(
+ xmlstarlet sel \
+ -N m=http://maven.apache.org/POM/4.0.0 \
+ --template --value-of /m:project/m:properties/m:revision \
+ pom.xml
+ )
+ if [[ ! $revision =~ ^[0-9]+\.[0-9]+\.[0-9]+(-SNAPSHOT)?$ ]]; then
+ echo "Invalid version format: $revision"
+ exit 1
+ fi
+ parts=(${revision//./ })
+ echo "RELEASE_VERSION_MAJOR=${parts[0]}" >> $GITHUB_ENV
+
+ - name: Create changelog entries
+ shell: bash
+ run: |
Review Comment:
I'd really appreciate it if you can ventilate this big chunk of code with some empty lines delimiting the blocks by their semantics.
##########
src/site/antora/modules/ROOT/examples/analyze-dependabot.yaml:
##########
@@ -15,28 +15,18 @@
# limitations under the License.
#
-name: merge-dependabot
+name: "Dependabot Analyze PR"
on:
- pull_request_target:
- paths-ignore:
- - "**.adoc"
- - "**.md"
- - "**.txt"
+ pull_request:
-permissions: read-all
+permissions: { }
jobs:
- build:
- if: github.repository == 'apache/logging-parent' && github.event_name == 'pull_request_target' && github.actor == 'dependabot[bot]'
- uses: ./.github/workflows/build-reusable.yaml
-
- merge-dependabot:
- needs: build
- uses: ./.github/workflows/merge-dependabot-reusable.yaml
- permissions:
- contents: write # to push changelog commits
- pull-requests: write # to close the PR
- secrets:
- GPG_SECRET_KEY: ${{ secrets.LOGGING_GPG_SECRET_KEY }} # to sign commits
+# tag::analyze-dependabot[]
+ analyze-dependabot:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
Review Comment:
I'd keep the extra check against the repository for DiD reasons:
```suggestion
if: ${{ github.repository == 'apache/logging-parent' && github.actor == 'dependabot[bot]' }}
```
(I don't know if above change necessitates an `workflows.adoc` update.)
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+ with:
+ ref: ${{ env.PR_HEAD_REF }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Install `xmlstarlet`
+ shell: bash
+ run: sudo apt-get update && sudo apt-get install -y xmlstarlet
+
+ - name: Find the release version major
+ shell: bash
+ run: |
+ revision=$(
+ xmlstarlet sel \
+ -N m=http://maven.apache.org/POM/4.0.0 \
+ --template --value-of /m:project/m:properties/m:revision \
+ pom.xml
+ )
+ if [[ ! $revision =~ ^[0-9]+\.[0-9]+\.[0-9]+(-SNAPSHOT)?$ ]]; then
+ echo "Invalid version format: $revision"
+ exit 1
+ fi
+ parts=(${revision//./ })
+ echo "RELEASE_VERSION_MAJOR=${parts[0]}" >> $GITHUB_ENV
+
+ - name: Create changelog entries
+ shell: bash
+ run: |
+ PULL_REQUEST="$RUNNER_TEMP/dependabot-metadata/pull_request.json"
+ UPDATED_DEPENDENCIES="$RUNNER_TEMP/dependabot-metadata/updated_dependencies.json"
+ # Generates the content of a changelog entry
+ function generate_changelog_entry() {
+ local dependency="$1"
+ local issue_id=$(xmlstarlet esc "$PR_ID")
+ local issue_link=$(xmlstarlet esc "$PR_URL")
+ local dependency_name=$(echo "$dependency" | jq -r '.dependencyName' | xmlstarlet esc)
+ local new_version=$(echo "$dependency" | jq -r '.newVersion' | xmlstarlet esc)
+ cat << CHANGELOG_ENTRY
+ <?xml version="1.0" encoding="UTF-8"?>
+ <!-- SPDX-License-Identifier: Apache-2.0 -->
+ <entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="https://logging.apache.org/xml/ns"
+ xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+ type="updated">
+ <issue id="$issue_id" link="$issue_link"/>
+ <description format="asciidoc">Update \`$dependency_name\` to version \`$new_version\`.</description>
+ </entry>
+ CHANGELOG_ENTRY
+ }
+ # Ensure the changelog directory exists
+ release_changelog_path="src/changelog/.${RELEASE_VERSION_MAJOR}.x.x"
+ mkdir -p "$release_changelog_path"
+ cd "$release_changelog_path"
+ # Generate the changelog entries for each updated dependency
+ cat "$UPDATED_DEPENDENCIES" | jq --compact-output '.[]' | while read -r dependency; do
+ # Extract the dependency name and version
+ dependency_name=$(echo "$dependency" | jq -r '.dependencyName')
+ changelog_file_name=$(echo "update_${dependency_name,,}.xml" | sed -r -e 's/[^a-z0-9.-]/_/g' -e 's/_+/_/g')
+ generate_changelog_entry "$dependency" > "$changelog_file_name"
+ done
+
+ - name: Set up GPG
+ uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # 6.3.0
+ with:
+ gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+ passphrase: ${{ secrets.GPG_PASSPHRASE }}
+
+ - name: Add & commit changes
+ shell: bash
+ env:
+ USER_NAME: ${{ inputs.user-name }}
+ USER_EMAIL: ${{ inputs.user-email }}
+ run: |
+ git add src/changelog
+ git config user.name "$USER_NAME"
+ git config user.email "$USER_EMAIL"
+ git commit -S -m "Generate changelog entries for PR #$PR_ID"
Review Comment:
```suggestion
git commit -S -m "Generate changelog entries for #$PR_ID"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #419:
URL: https://github.com/apache/logging-parent/pull/419#issuecomment-2994150613
After running some tests, I identified the following limitations with this workflow stemming from the use of `dependabot/fetch-metadata`:
* As previously mentioned, the workflow must run with the `pull_request_target` event (see dependabot/fetch-metadata#490). This imposes a restriction: the token with write permissions to the repository cannot be stored in **Dependabot Secrets**, and instead must be stored in **Actions Secrets**. The downside is that Actions Secrets are accessible to a broader range of workflows, not just those triggered by `dependabot[bot]`.
* Until dependabot/fetch-metadata#402 is resolved, version metadata will not be available for **grouped PRs**, which is a blocker: the changelog entries will not have any information about the version to which the dependency was upgraded.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3094535735
##########
src/site/antora/modules/ROOT/examples/process-dependabot.yaml:
##########
@@ -0,0 +1,50 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: "Dependabot Process PR"
+
+on:
+ workflow_run:
+ workflows:
+ - "Dependabot Analyze PR"
+ types:
+ - completed
+
+permissions: { }
+
+jobs:
+
+# tag::process-dependabot[]
+ process-dependabot:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{
+ github.repository == 'apache/logging-parent'
+ && github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ uses: apache/logging-parent/.github/workflows/process-dependabot-reusable.yaml@rel/{project-version}
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
Review Comment:
This didn't pose a problem in tests: all the repos are public.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3084501293
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+ with:
+ ref: ${{ env.PR_HEAD_REF }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Install `xmlstarlet`
+ shell: bash
+ run: sudo apt-get update && sudo apt-get install -y xmlstarlet
+
+ - name: Find the release version major
+ shell: bash
+ run: |
+ revision=$(
+ xmlstarlet sel \
+ -N m=http://maven.apache.org/POM/4.0.0 \
+ --template --value-of /m:project/m:properties/m:revision \
+ pom.xml
+ )
+ if [[ ! $revision =~ ^[0-9]+\.[0-9]+\.[0-9]+(-SNAPSHOT)?$ ]]; then
+ echo "Invalid version format: $revision"
+ exit 1
+ fi
+ parts=(${revision//./ })
+ echo "RELEASE_VERSION_MAJOR=${parts[0]}" >> $GITHUB_ENV
+
+ - name: Create changelog entries
+ shell: bash
+ run: |
Review Comment:
It should be aerated now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #419:
URL: https://github.com/apache/logging-parent/pull/419#issuecomment-4251217704
Sure, happy to wait a bit, though I'll note this PR has been open since June last year, mostly blocked on the `dependabot/fetch-metadata` side. Now that a new release finally landed on March 26th, I took the opportunity to bring it back in shape and strip it down to the bare essentials: no GPG signing, no unnecessary inputs or dependencies. I think it's about as simple as it gets at this point.
PR ppkarwasz/logging-log4j2#606 tests this in practice if you want to see how it behaves end-to-end.
I'm genuinely happy to look at alternative proposals, but one heads-up: please don't suggest collapsing this into a single `pull_request_target` workflow just to save a step or two. Even setting aside whether it'd be safe in this specific case, `pull_request_target` is a hard no under the ASF GitHub Actions policy: https://infra.apache.org/github-actions-policy.html
Getting an exception through INFRA would create way more churn than the two-workflow split is worth. If the policy ever tightens up around `workflow_run` too (as it should), we can revisit, but for now, the split is both policy-compliant and the right call.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #419:
URL: https://github.com/apache/logging-parent/pull/419#issuecomment-4260430407
> I suggest adding a Groovy script to `gha/v0` that maintainers can run using a Maven profile inherited from `logging-parent` and pass it a Dependabot PR URL. For instance:
>
> ```
> ./mvnw -P generate-dependabot-changelog https://github.com/apache/logging-parent/pull/X
> ```
On one side, I would like to generate changelogs manually, but on the other hand I don't want to do it, if the CI can.
I wouldn't be too much concerned about using a PAT: we use reusable workflows after all and all secrets must be passed by the caller explicitly. The only workflow with access to the PAT will be `process-dependabot-reusable`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r3094525287
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,142 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ changelog-path:
+ description: The path to the changelog directory (e.g. `src/changelog/.2.x.x`)
+ required: true
+ type: string
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+
+# Explicitly drop all permissions inherited from the caller for security.
+# Reference: https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Defense-in-depth (in case the caller forgets):
+ # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR;
+ # `github.event.workflow_run.conclusion` only runs after a successful analysis workflow.
+ if: ${{
+ github.actor == 'dependabot[bot]'
+ && github.event.workflow_run.conclusion == 'success'
+ }}
+ runs-on: ubuntu-latest
+ permissions:
+ # The default GITHUB_TOKEN will be used to enable the "auto-merge" on the PR
+ # This requires the following two permissions:
+ contents: write
+ pull-requests: write
+
+ steps:
+
+ - name: Get pull request metadata
+ id: pr
+ env:
+ # Reference of the payload: https://docs.github.com/en/webhooks/webhook-events-and-payloads#workflow_run
+ #
+ # The structure of `pull_requests` is not documented, so we'll dump it for debugging purposes.
+ PULL_REQUESTS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
+ run: |
+ # Print payload for debugging
+ jq <<< "$PULL_REQUESTS"
+ echo "id=$(echo "$PULL_REQUESTS" | jq -r '.[0].number')" >> "$GITHUB_OUTPUT"
+ echo "head-ref=$(echo "$PULL_REQUESTS" | jq -r '.[0].head.ref')" >> "$GITHUB_OUTPUT"
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}
+ run-id: ${{ github.event.workflow_run.id }}
+
+ - name: Check out repository
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+ with:
+ ref: ${{ steps.pr.outputs.head-ref }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Create changelog entries
+ shell: bash
+ env:
+ PR_ID: ${{ steps.pr.outputs.id }}
+ PR_URL: ${{ github.server_url }}/${{ github.repository }}/pull/${{ steps.pr.outputs.id }}
+ CHANGELOG_PATH: ${{ inputs.changelog-path }}
+ UPDATED_DEPENDENCIES: ${{ runner.temp }}/updated_dependencies.json
+ run: |
+ # Escapes special XML characters in a string
+ xml_escape() { sed 's/&/\&/g; s/</\</g; s/>/\>/g; s/"/\"/g'; }
+
+ # Generates the content of a changelog entry
+ function generate_changelog_entry() {
+ local dependency="$1"
+ local issue_id=$(xml_escape <<< "$PR_ID")
+ local issue_link=$(xml_escape <<< "$PR_URL")
+ local dependency_name=$(echo "$dependency" | jq -r '.dependencyName' | xml_escape)
+ local new_version=$(echo "$dependency" | jq -r '.newVersion' | xml_escape)
+ cat << CHANGELOG_ENTRY
+ <?xml version="1.0" encoding="UTF-8"?>
+ <entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="https://logging.apache.org/xml/ns"
+ xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+ type="updated">
+ <issue id="$issue_id" link="$issue_link"/>
+ <description format="asciidoc">Update \`$dependency_name\` to version \`$new_version\`</description>
+ </entry>
+ CHANGELOG_ENTRY
+ }
+
+ # Ensure the changelog directory exists
+ mkdir -p "$CHANGELOG_PATH"
+ cd "$CHANGELOG_PATH"
+
+ # Generate the changelog entries for each updated dependency
+ cat "$UPDATED_DEPENDENCIES" | jq --compact-output '.[]' | while read -r dependency; do
+ # Extract the dependency name and version
+ dependency_name=$(echo "$dependency" | jq -r '.dependencyName')
+ changelog_file_name=$(echo "update_${dependency_name,,}.xml" | sed -r -e 's/[^a-z0-9.-]/_/g' -e 's/_+/_/g')
+ generate_changelog_entry "$dependency" > "$changelog_file_name"
+ done
Review Comment:
This is an unlikely event, not worth the additional code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add `process-dependabot-reusable` workflow (Bash-based alternative) [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #419:
URL: https://github.com/apache/logging-parent/pull/419#discussion_r2481121621
##########
.github/workflows/process-dependabot-reusable.yaml:
##########
@@ -0,0 +1,169 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: Dependabot Process PR
+
+on:
+ workflow_call:
+ inputs:
+ user-name:
+ description: The name of the user to use for the commit
+ default: 'ASF Logging Services RM'
+ type: string
+ user-email:
+ description: The email of the user to use for the commit
+ default: 'private@logging.apache.org'
+ type: string
+ analyze-workflow-run-id:
+ description: The ID of the workflow run that analyzed the PR
+ required: true
+ type: number
+ secrets:
+ RECURSIVE_TOKEN:
+ description: "A PAT with `contents: write` permission to push changes and trigger the next workflow run"
+ required: true
+ GPG_PASSPHRASE:
+ description: GPG passphrase for signing commits
+ required: false
+ GPG_PRIVATE_KEY:
+ description: GPG secret key for signing commits
+ required: true
+
+permissions: { }
+
+jobs:
+
+ generate-changelog:
+ # Skip this workflow on commits not pushed by Dependabot
+ if: ${{ github.actor == 'dependabot[bot]' }}
+ runs-on: ubuntu-latest
+
+ steps:
+
+ - name: Fetch Dependabot metadata
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0
+ with:
+ github-token: ${{ github.token }}
+ name: dependabot-metadata
+ path: ${{ runner.temp }}/dependabot-metadata
+ run-id: ${{ inputs.analyze-workflow-run-id }}
+
+ - name: Process Dependabot metadata
+ shell: bash
+ run: |
+ # Extract the pull request metadata from the downloaded artifact
+ path="$RUNNER_TEMP/dependabot-metadata"
+ if [[ ! -f "$path/pull_request.json" ]]; then
+ echo "Pull request metadata not found at $path/pull_request.json"
+ exit 1
+ fi
+ if [[ ! -f "$path/updated_dependencies.json" ]]; then
+ echo "Updated dependencies metadata not found at $path/updated_dependencies.json"
+ exit 1
+ fi
+ # Extract the required metadata and set it as environment variables
+ pull_request="$path/pull_request.json"
+ echo "PR_ID=$(jq -r '.number' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_URL=$(jq -r '.html_url' < "$pull_request")" >> $GITHUB_ENV
+ echo "PR_HEAD_REF=$(jq -r '.head.ref' < "$pull_request")" >> $GITHUB_ENV
+
+ - name: Check out repository
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+ with:
+ ref: ${{ env.PR_HEAD_REF }}
+ token: ${{ secrets.RECURSIVE_TOKEN }}
+
+ - name: Install `xmlstarlet`
+ shell: bash
+ run: sudo apt-get update && sudo apt-get install -y xmlstarlet
+
+ - name: Find the release version major
+ shell: bash
+ run: |
+ revision=$(
+ xmlstarlet sel \
+ -N m=http://maven.apache.org/POM/4.0.0 \
+ --template --value-of /m:project/m:properties/m:revision \
+ pom.xml
+ )
+ if [[ ! $revision =~ ^[0-9]+\.[0-9]+\.[0-9]+(-SNAPSHOT)?$ ]]; then
+ echo "Invalid version format: $revision"
+ exit 1
+ fi
+ parts=(${revision//./ })
+ echo "RELEASE_VERSION_MAJOR=${parts[0]}" >> $GITHUB_ENV
+
+ - name: Create changelog entries
+ shell: bash
+ run: |
+ PULL_REQUEST="$RUNNER_TEMP/dependabot-metadata/pull_request.json"
+ UPDATED_DEPENDENCIES="$RUNNER_TEMP/dependabot-metadata/updated_dependencies.json"
+ # Generates the content of a changelog entry
+ function generate_changelog_entry() {
+ local dependency="$1"
+ local issue_id=$(xmlstarlet esc "$PR_ID")
+ local issue_link=$(xmlstarlet esc "$PR_URL")
+ local dependency_name=$(echo "$dependency" | jq -r '.dependencyName' | xmlstarlet esc)
+ local new_version=$(echo "$dependency" | jq -r '.newVersion' | xmlstarlet esc)
+ cat << CHANGELOG_ENTRY
+ <?xml version="1.0" encoding="UTF-8"?>
+ <!-- SPDX-License-Identifier: Apache-2.0 -->
+ <entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="https://logging.apache.org/xml/ns"
+ xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+ type="updated">
+ <issue id="$issue_id" link="$issue_link"/>
+ <description format="asciidoc">Update \`$dependency_name\` to version \`$new_version\`.</description>
+ </entry>
+ CHANGELOG_ENTRY
+ }
+ # Ensure the changelog directory exists
+ release_changelog_path="src/changelog/.${RELEASE_VERSION_MAJOR}.x.x"
+ mkdir -p "$release_changelog_path"
+ cd "$release_changelog_path"
+ # Generate the changelog entries for each updated dependency
+ cat "$UPDATED_DEPENDENCIES" | jq --compact-output '.[]' | while read -r dependency; do
+ # Extract the dependency name and version
+ dependency_name=$(echo "$dependency" | jq -r '.dependencyName')
+ changelog_file_name=$(echo "update_${dependency_name,,}.xml" | sed -r -e 's/[^a-z0-9.-]/_/g' -e 's/_+/_/g')
+ generate_changelog_entry "$dependency" > "$changelog_file_name"
+ done
+
+ - name: Set up GPG
+ uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # 6.3.0
Review Comment:
This seems solved: the action is on the allowed list (https://github.com/apache/infrastructure-actions/blob/main/actions.yml).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org