Kloet/release single #3997
Draft
Kloet/release single #3997
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🦋 Changeset detectedLatest commit: d66886c The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+14
to
+102
| name: Upsert Release PR | ||
| runs-on: ubuntu-latest | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| UPSTREAM_BRANCH: 'main' | ||
| steps: | ||
| - name: Checkout Repo | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits | ||
| fetch-depth: 0 | ||
| # We install only the changesets tool so we can do the mock changesets before installing dependencies, | ||
| # as the setup action will only build the files relevant to the changed adapters | ||
| - name: Install changesets tool | ||
| run: | | ||
| yarn add @changesets/cli@$(jq -r '.devDependencies."@changesets/cli"' package.json) | ||
| - name: Configure git | ||
| shell: bash | ||
| run: | | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "github-actions[bot]@users.noreply.github.com" | ||
| - name: Set CHANGESET_IGNORE_ARGS env var | ||
| run: | | ||
| CHANGESET_IGNORE_ARGS="$(.github/scripts/packages-to-ignore.sh ${{ github.event.inputs.adapters }} | sed -e 's/^/--ignore /' | tr '\n' ' ')" | ||
| echo "$CHANGESET_IGNORE_ARGS" | ||
| echo "CHANGESET_IGNORE_ARGS=$CHANGESET_IGNORE_ARGS" >> $GITHUB_ENV | ||
| cat $GITHUB_ENV | ||
| - name: Temporarily calculate changesets to generate readmes with proper versions | ||
| run: | | ||
| # Get from output of previous step: | ||
| PACKAGES_TO_IGNORE="${{ env.packages_to_ignore }}" | ||
| yarn changeset version $CHANGESET_IGNORE_ARGS | ||
| git add -A | ||
| git commit -m "Changesets mock" | ||
| - name: Set up and install dependencies | ||
| uses: ./.github/actions/setup | ||
| with: | ||
| build-all: 'true' | ||
| - name: Increase monorepo version | ||
| run: | | ||
| BUMPED_VERSION=$(jq -r '.version | split(".")[1] | tonumber | . + 1 | tostring | "1." + . + ".0"' package.json) | ||
| jq ".version = \"$BUMPED_VERSION\"" package.json > package.tmp.json | ||
| mv package.tmp.json package.json | ||
| echo "BUMPED_VERSION=$BUMPED_VERSION" >> $GITHUB_ENV | ||
| - name: Generate documentation | ||
| run: | | ||
| yarn generate:master-list -v | ||
| yarn generate:readme -v | ||
| - name: Undo temporary changesets and commit docs | ||
| run: | | ||
| git stash | ||
| git reset HEAD^ --hard | ||
| git stash pop | ||
| - name: Commit docs | ||
| run: | | ||
| git add MASTERLIST.md | ||
| git add "*README.md" | ||
| yarn lint-staged | ||
| - name: Stash changes for changesets action to pick up in custom script | ||
| run: | | ||
| git stash | ||
| - name: Create Release Pull Request | ||
| uses: smartcontractkit/.github/actions/signed-commits@4b7aa1d5b60f0d5704400a1d2b192905ad386e6c # changesets-signed-commits@1.2.4 | ||
| with: | ||
| # This version command is not only necessary because of yarn pnp, but because the changeset action | ||
| # performs git resets and we want to keep those changes, so we stash and then pop them here. | ||
| # All the previous steps would technically make more sense in the script itself, but we | ||
| # keep them as separate ones so it's easier to see them from the github UI to debug. | ||
| version: ./.github/scripts/run-changesets.sh ${{ env.CHANGESET_IGNORE_ARGS }} | ||
| title: 'testing Release ${{ env.BUMPED_VERSION }}' | ||
| commit: 'testing Release ${{ env.BUMPED_VERSION }}' | ||
| - name: Tag changesets commit | ||
| run: | | ||
| # Delete the tags if they already exist (ignore errors if they don't) | ||
| #git tag -d "v$BUMPED_VERSION" || true | ||
| #git push --delete origin "v$BUMPED_VERSION" || true | ||
| #git tag "v$BUMPED_VERSION" | ||
| #git push origin "v$BUMPED_VERSION" | ||
| # Because the workflows won't run and we technically don't need them for this autogenerated PR, | ||
| # we manually skip all the required checks by using the GitHub API directly. | ||
| - name: Skip required checks manually | ||
| run: | | ||
| COMMIT_SHA=$(git rev-parse HEAD) | ||
| ./.github/scripts/skip-check.sh $COMMIT_SHA "Adapter changes accompanied by a changeset" | ||
| ./.github/scripts/skip-check.sh $COMMIT_SHA "Documentation generation test" | ||
| ./.github/scripts/skip-check.sh $COMMIT_SHA "Install and verify dependencies" | ||
| ./.github/scripts/skip-check.sh $COMMIT_SHA "Run integration tests for changed adapters" | ||
| ./.github/scripts/skip-check.sh $COMMIT_SHA "Run linters and formatters" | ||
| ./.github/scripts/skip-check.sh $COMMIT_SHA "Run unit tests for changed adapters" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 days ago
To fix this issue, add a permissions block specifying the minimal required permissions for the job or workflow. The block can be added either at the workflow level (top-level, before jobs:) to apply to all jobs, or within each individual job if some jobs need broader permissions than others. For this workflow, since all operations are within a single job (consume-changesets), add the block to that job. As a minimum, set contents: write since the job performs git commits and push operations, and may require write access to repository contents. If the job interacts with issues or pull requests (as seems likely due to the creation of release PRs), also consider pull-requests: write. If only reading contents is required, specify contents: read. Adjust permissions according to the tasks performed—here, contents: write and pull-requests: write are suitable starting points.
Specifically:
- Edit
.github/workflows/release-individual.yml, in thejobs.consume-changesetsblock (preferably immediately belowname: Upsert Release PR, but any location within the job is valid). - Add:
permissions: contents: write pull-requests: write
- No imports or definitions needed beyond standard GitHub Actions YAML.
- No other file changes are required.
Suggested changeset
1
.github/workflows/release-individual.yml
| @@ -12,6 +12,9 @@ | ||
| jobs: | ||
| consume-changesets: | ||
| name: Upsert Release PR | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| runs-on: ubuntu-latest | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #ISSUE_NUMBER_GOES_HERE
Description
......
Changes
Steps to Test
Quality Assurance
infra-k8sconfiguration file.adapter-secretsconfiguration file or update the soak testing blacklist.test-payload.jsonfile with relevant requests.feature/x,chore/x,release/x,hotfix/x,fix/x) or is created from Jira.