diff --git a/.github/cdk/main.ts b/.github/cdk/main.ts index 3471a5e..3421af0 100644 --- a/.github/cdk/main.ts +++ b/.github/cdk/main.ts @@ -1,6 +1,22 @@ // The workflows in .github/workflows are generated from here. Run // `yarn build` in this directory and commit both sides. -import { App, Job, RunnerLabel, Stack, Workflow } from '@factbird/cdkactions'; +import { + App, + checkoutV7, + DependabotActionPinSync, + determinateNixV3, + Job, + RunnerLabel, + Stack, + setupNodeV6, + updateFlakeLockV29, + Workflow, +} from '@factbird/cdkactions'; + +const checkout = checkoutV7.pinned('3d3c42e5aac5ba805825da76410c181273ba90b1', 'v7.0.1'); +const determinateNix = determinateNixV3.pinned('d0c908e6cbe9f89f36ed8205a3ab6f092636916a', 'v3.23.1'); +const updateFlakeLock = updateFlakeLockV29.pinned('da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3', 'v29'); +const setupNode = setupNodeV6.pinned('249970729cb0ef3589644e2896645e5dc5ba9c38', 'v6.5.0'); const app = new App({ createValidateWorkflow: false, outdir: '../workflows' }); const stack = new Stack(app, 'devkit'); @@ -27,21 +43,30 @@ new Job(updateNixpkgs, 'update', { runsOn: RunnerLabel.UBUNTU_LATEST, permissions: { contents: 'write', pullRequests: 'write' }, steps: [ - { uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' }, // v7.0.1 - { - name: 'Install Nix', - uses: 'DeterminateSystems/determinate-nix-action@d0c908e6cbe9f89f36ed8205a3ab6f092636916a', // v3.23.1 - }, - { + checkout({ id: 'checkout' }), + determinateNix({ name: 'Install Nix' }), + updateFlakeLock({ + id: 'update-flake-lock', name: 'Update nixpkgs and open pull request', - uses: 'DeterminateSystems/update-flake-lock@da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3', // v29 with: { inputs: 'nixpkgs', branch: 'chore/update-nixpkgs', - 'commit-msg': 'chore(nix): update nixpkgs', - 'pr-title': 'chore(nix): update nixpkgs', + commitMsg: 'chore(nix): update nixpkgs', + prTitle: 'chore(nix): update nixpkgs', }, - }, + }), + ], +}); + +// The CLI and the synth run from the repository root, while this package +// keeps its own node_modules. +new DependabotActionPinSync(stack, 'dependabot-action-pin-sync', { + sources: ['.github/cdk/main.ts'], + cliCommand: '.github/cdk/node_modules/.bin/cdkactions', + synthCommand: 'yarn --cwd .github/cdk build', + setupSteps: [ + setupNode({ id: 'setup-node', with: { nodeVersion: '24' } }), + { name: 'Install', run: 'corepack enable && yarn --cwd .github/cdk install --immutable' }, ], }); diff --git a/.github/cdk/package.json b/.github/cdk/package.json index 0c2abf6..953cb4c 100644 --- a/.github/cdk/package.json +++ b/.github/cdk/package.json @@ -8,8 +8,8 @@ "typecheck": "tsc --noEmit" }, "devDependencies": { - "@factbird/cdkactions": "2.1.2", - "@factbird/cdkactions-cli": "2.1.2", + "@factbird/cdkactions": "^2.2.0", + "@factbird/cdkactions-cli": "^2.2.0", "@types/node": "^24.0.0", "constructs": "10.4.2", "typescript": "^5.7.3" diff --git a/.github/cdk/yarn.lock b/.github/cdk/yarn.lock index a654dcf..f359f49 100644 --- a/.github/cdk/yarn.lock +++ b/.github/cdk/yarn.lock @@ -5,30 +5,30 @@ __metadata: version: 9 cacheKey: 10c0 -"@factbird/cdkactions-cli@npm:2.1.2": - version: 2.1.2 - resolution: "@factbird/cdkactions-cli@npm:2.1.2" +"@factbird/cdkactions-cli@npm:^2.2.0": + version: 2.2.0 + resolution: "@factbird/cdkactions-cli@npm:2.2.0" dependencies: - "@factbird/cdkactions": "npm:2.1.2" + "@factbird/cdkactions": "npm:2.2.0" constructs: "npm:^10.4.2" fs-extra: "npm:^11.3.0" yaml: "npm:^2.7.1" yargs: "npm:^16.2.0" bin: cdkactions: bin/cdkactions - checksum: 10c0/7d92934edeee42ba771f852140189caba9e74c1ee91e4f6733529034d378acb460c8ddbf6dc10db827af615ee28894b65c14d0481db6c92e2c9dd960febce5bb + checksum: 10c0/cdeaacbf365ff83dfb262a26bd2fb538eb39f37e1cd5deb62ea97bd7d7ed2b2f78e094921213fcdccfb9c149e81f53f2f4f41ac7da72c2ce8a112c070f649807 languageName: node linkType: hard -"@factbird/cdkactions@npm:2.1.2": - version: 2.1.2 - resolution: "@factbird/cdkactions@npm:2.1.2" +"@factbird/cdkactions@npm:2.2.0, @factbird/cdkactions@npm:^2.2.0": + version: 2.2.0 + resolution: "@factbird/cdkactions@npm:2.2.0" dependencies: js-yaml: "npm:^4.0.0" ts-dedent: "npm:^2.2.0" peerDependencies: constructs: ^10.4.2 - checksum: 10c0/28e6666887eec322ea7dc012c3a87fdf282393589c5e58cf5d486732380ec9fd0ce31614ce788c90f582a1830a00968fef66f62fedb706315f4c11d4c9d76451 + checksum: 10c0/275783658cc6281fa1a4672f25f0c2dcc46e48a1ab0fb4604666492fd32788559290ed915748857030022beeab02317a11429fad86fe1bcc249a459e83d3ec40 languageName: node linkType: hard @@ -109,8 +109,8 @@ __metadata: version: 0.0.0-use.local resolution: "devkit-workflows@workspace:." dependencies: - "@factbird/cdkactions": "npm:2.1.2" - "@factbird/cdkactions-cli": "npm:2.1.2" + "@factbird/cdkactions": "npm:^2.2.0" + "@factbird/cdkactions-cli": "npm:^2.2.0" "@types/node": "npm:^24.0.0" constructs: "npm:10.4.2" typescript: "npm:^5.7.3" diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1768109..162ec58 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,16 @@ updates: flake-inputs: patterns: - '*' + - package-ecosystem: github-actions + directory: '/' + schedule: + interval: weekly + cooldown: + default-days: 7 + groups: + actions: + patterns: + - '*' - package-ecosystem: npm directory: '/.github/cdk' schedule: diff --git a/.github/workflows/cdkactions_dependabot-action-pin-sync.yaml b/.github/workflows/cdkactions_dependabot-action-pin-sync.yaml new file mode 100644 index 0000000..3b39c6d --- /dev/null +++ b/.github/workflows/cdkactions_dependabot-action-pin-sync.yaml @@ -0,0 +1,117 @@ +# Generated by cdkactions. Do not modify +# Generated as part of the 'devkit' stack. +name: Carry Dependabot action bumps into the workflow source +on: + pull_request: + paths: + - .github/workflows/** + types: + - opened + - synchronize + - reopened +permissions: + contents: read +jobs: + push: + if: ((github.event.pull_request.user.login == 'dependabot[bot]' && github.actor == 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository) && needs.regenerate.outputs.changed == 'true') + needs: regenerate + permissions: {} + runs-on: ubuntu-latest + steps: + - id: app-token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 + with: + client-id: ${{ secrets.APP_ID }} + permission-contents: write + private-key: ${{ secrets.APP_PEM }} + - id: download + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 + with: + artifact-ids: ${{ needs.regenerate.outputs.artifactId }} + path: ${{ runner.temp }}/action-pin-sync + - env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} + HEAD_REF: ${{ github.event.pull_request.head.ref }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + REPOSITORY: ${{ github.repository }} + SOURCE_PATTERN: ^\.github/cdk/main\.ts$ + name: Write the source files to the pull request branch + run: |- + set -euo pipefail + root="$RUNNER_TEMP/action-pin-sync" + expected_head="$HEAD_SHA" + while IFS= read -r -d '' file; do + case "$file" in + /* | ../* | */../* | */.. | ..) echo "::error::Refusing path $file"; exit 1 ;; + esac + if ! printf '%s' "$file" | grep -Eq "$SOURCE_PATTERN"; then + echo "::error::$file is not one of the configured sources"; exit 1 + fi + if [ ! -f "$root/files/$file" ] || [ -L "$root/files/$file" ]; then + echo "::error::$file is not a regular file in the artifact"; exit 1 + fi + head=$(gh api "repos/$REPOSITORY/git/ref/heads/$HEAD_REF" --jq .object.sha) + if [ "$head" != "$expected_head" ]; then + echo "::error::$HEAD_REF moved to $head after $expected_head; not overwriting it"; exit 1 + fi + blob=$(gh api "repos/$REPOSITORY/contents/$file?ref=$expected_head" --jq .sha) + expected_head=$(gh api -X PUT "repos/$REPOSITORY/contents/$file" \ + -f message="chore(deps): carry action bumps into the workflow source" \ + -f content="$(base64 -w0 "$root/files/$file")" \ + -f branch="$HEAD_REF" \ + -f sha="$blob" \ + --jq .commit.sha) + echo "Wrote $file in $expected_head" + done < "$root/paths" + regenerate: + if: (github.event.pull_request.user.login == 'dependabot[bot]' && github.actor == 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository) + outputs: + artifactId: ${{ steps.upload.outputs.artifact-id }} + changed: ${{ steps.changes.outputs.changed }} + permissions: + contents: read + runs-on: ubuntu-latest + steps: + - id: checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + fetch-depth: 0 + persist-credentials: false + ref: ${{ github.event.pull_request.head.sha }} + - id: setup-node + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 + with: + node-version: "24" + - name: Install + run: corepack enable && yarn --cwd .github/cdk install --immutable + - env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + name: Carry the bumps into the source + run: .github/cdk/node_modules/.bin/cdkactions sync-action-pins --base "$BASE_SHA" --workflows '.github/workflows' '.github/cdk/main.ts' + - name: Verify each versioned pin against its tag + run: .github/cdk/node_modules/.bin/cdkactions verify-action-pins '.github/cdk/main.ts' + - name: Synthesize + run: yarn --cwd .github/cdk build + - name: Check the source reproduces the workflows + run: git diff --exit-code -- '.github/workflows' + - id: changes + name: Collect the changed source files + run: |- + git diff --name-only -z -- ':(glob).github/cdk/main.ts' > "$RUNNER_TEMP/changed-sources" + if [ ! -s "$RUNNER_TEMP/changed-sources" ]; then + echo "changed=false" >> "$GITHUB_OUTPUT" + exit 0 + fi + mkdir -p "$RUNNER_TEMP/action-pin-sync/files" + cp "$RUNNER_TEMP/changed-sources" "$RUNNER_TEMP/action-pin-sync/paths" + xargs -0 cp --parents -t "$RUNNER_TEMP/action-pin-sync/files" < "$RUNNER_TEMP/changed-sources" + echo "changed=true" >> "$GITHUB_OUTPUT" + - id: upload + if: steps.changes.outputs.changed == 'true' + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 + with: + if-no-files-found: error + include-hidden-files: true + name: action-pin-sync + path: ${{ runner.temp }}/action-pin-sync + retention-days: 1 diff --git a/.github/workflows/cdkactions_update-nixpkgs.yaml b/.github/workflows/cdkactions_update-nixpkgs.yaml index 5ec7073..0f7fccb 100644 --- a/.github/workflows/cdkactions_update-nixpkgs.yaml +++ b/.github/workflows/cdkactions_update-nixpkgs.yaml @@ -14,10 +14,12 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - id: checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install Nix uses: DeterminateSystems/determinate-nix-action@d0c908e6cbe9f89f36ed8205a3ab6f092636916a - - name: Update nixpkgs and open pull request + - id: update-flake-lock + name: Update nixpkgs and open pull request uses: DeterminateSystems/update-flake-lock@da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3 with: branch: chore/update-nixpkgs