Skip to content

Commit 4350f61

Browse files
authored
Label dependency update PRs and drop pull_request_target (#1454)
* Label dependency update pull requests with semver bump Compute the highest semver bump between buildpack.toml before and after the update and expose it as semver_bump. Use it to add semver:major/minor/patch when opening dependency update pull requests. * Use pull_request instead of pull_request_target for PR labels Run the label workflow on pull requests with explicit GITHUB_TOKEN write permissions. Same-repo and Dependabot pull requests can still be auto-labeled, while fork pull requests are skipped because they receive a read-only token. * Use libpak-tools for dependency semver bump calculation Add a setup tools action that installs jam and libpak-tools from scripts/.util/tools.json or input versions. Replace the inline jam install and Python helper in update-from-metadata with the setup action and libpak-tools ci calculate-semver-bump.
1 parent 3dafe2c commit 4350f61

7 files changed

Lines changed: 291 additions & 32 deletions

File tree

‎actions/dependency/update-from-metadata/action.yml‎

Lines changed: 26 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -15,35 +15,26 @@ outputs:
1515
new-versions:
1616
description: Newly added dependency versions
1717
value: ${{ steps.update.outputs.new_versions }}
18+
semver_bump:
19+
description: 'The highest semver bump across all updated dependencies'
20+
value: ${{ steps.semver.outputs.semver_bump }}
1821

1922
runs:
2023
using: 'composite'
2124
steps:
2225

23-
- name: Choose Jam Version
24-
id: version
25-
shell: bash
26-
run: |
27-
#!/usr/bin/env bash
28-
set -euo pipefail
29-
shopt -s inherit_errexit
30-
version=$(jq -r .jam "scripts/.util/tools.json")
31-
echo "version=${version#v}" >> "$GITHUB_OUTPUT"
26+
- name: Setup Tools
27+
uses: paketo-buildpacks/github-config/actions/tools/setup@main
3228

33-
- name: Install Jam
29+
- name: Back Up buildpack.toml
3430
shell: bash
31+
env:
32+
BUILDPACK_TOML_PATH: ${{ inputs.buildpack_toml_path }}
3533
run: |
3634
#!/usr/bin/env bash
3735
set -euo pipefail
3836
shopt -s inherit_errexit
39-
mkdir -p "${HOME}"/bin
40-
echo "PATH=${HOME}/bin:${PATH}" >> "${GITHUB_ENV}"
41-
mkdir -p "${HOME}/bin"
42-
curl "https://github.com/paketo-buildpacks/jam/releases/download/v${{ steps.version.outputs.version }}/jam-linux" \
43-
--silent \
44-
--location \
45-
--output "${HOME}/bin/jam"
46-
chmod +x "${HOME}/bin/jam"
37+
cp "${BUILDPACK_TOML_PATH}" "${{ runner.temp }}/buildpack.toml.before"
4738
4839
- name: Update Dependencies From Metadata
4940
shell: bash
@@ -60,3 +51,20 @@ runs:
6051
versions="$(echo ${versions} | cut -d'[' -f2- | cut -d']' -f-1 | sed 's/ /, /g')"
6152
echo "new_versions=${versions}" >> "$GITHUB_OUTPUT"
6253
echo "Added versions ${versions}"
54+
55+
- name: Calculate Semver Bump
56+
id: semver
57+
shell: bash
58+
env:
59+
BEFORE_BUILDPACK_TOML_PATH: ${{ runner.temp }}/buildpack.toml.before
60+
AFTER_BUILDPACK_TOML_PATH: ${{ inputs.buildpack_toml_path }}
61+
run: |
62+
#!/usr/bin/env bash
63+
set -euo pipefail
64+
shopt -s inherit_errexit
65+
semver_bump="$(libpak-tools ci calculate-semver-bump --before "${BEFORE_BUILDPACK_TOML_PATH}" --after "${AFTER_BUILDPACK_TOML_PATH}")"
66+
if [[ "${semver_bump}" == "none" ]]; then
67+
semver_bump=""
68+
fi
69+
echo "semver_bump=${semver_bump}" >> "$GITHUB_OUTPUT"
70+
echo "Semver bump: ${semver_bump:-none}"

‎actions/tools/setup/action.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: 'Setup Paketo Tools'
2+
3+
description: |
4+
Installs jam and libpak-tools and adds them to PATH. Versions are read from
5+
scripts/.util/tools.json by default and can be overridden with inputs.
6+
7+
inputs:
8+
jam-version:
9+
description: 'Version of jam to install. Overrides the tools config file.'
10+
required: false
11+
default: ''
12+
libpak-tools-version:
13+
description: 'Version of libpak-tools to install. Overrides the tools config file.'
14+
required: false
15+
default: ''
16+
tools-config:
17+
description: 'Path to a JSON file containing tool versions.'
18+
required: false
19+
default: 'scripts/.util/tools.json'
20+
directory:
21+
description: 'Directory to install the tools into.'
22+
required: false
23+
default: ''
24+
25+
outputs:
26+
directory:
27+
description: 'Directory containing the installed tools.'
28+
value: ${{ steps.setup.outputs.directory }}
29+
30+
runs:
31+
using: 'composite'
32+
steps:
33+
- name: Install Tools
34+
id: setup
35+
shell: bash
36+
env:
37+
JAM_VERSION: ${{ inputs.jam-version }}
38+
LIBPAK_TOOLS_VERSION: ${{ inputs.libpak-tools-version }}
39+
TOOLS_CONFIG: ${{ inputs.tools-config }}
40+
TOOLS_DIRECTORY: ${{ inputs.directory }}
41+
run: |
42+
#!/usr/bin/env bash
43+
set -euo pipefail
44+
shopt -s inherit_errexit
45+
bash "${GITHUB_ACTION_PATH}/setup.sh"

‎actions/tools/setup/setup.sh‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
shopt -s inherit_errexit
4+
5+
function main() {
6+
local directory jam_version libpak_tools_version
7+
directory="${TOOLS_DIRECTORY:-${HOME}/bin}"
8+
jam_version="${JAM_VERSION:-}"
9+
libpak_tools_version="${LIBPAK_TOOLS_VERSION:-}"
10+
11+
mkdir -p "${directory}"
12+
13+
jam_version="$(resolve_version "jam" "${jam_version}" "${TOOLS_CONFIG:-}")"
14+
libpak_tools_version="$(resolve_version "libpaktools" "${libpak_tools_version}" "${TOOLS_CONFIG:-}")"
15+
16+
if [[ -z "${jam_version}" && -z "${libpak_tools_version}" ]]; then
17+
echo "unable to determine a tool version from inputs or ${TOOLS_CONFIG:-the tools config file}" >&2
18+
exit 1
19+
fi
20+
21+
if [[ -n "${jam_version}" ]]; then
22+
install_jam "${jam_version}" "${directory}"
23+
else
24+
echo "Skipping jam: no version provided or found"
25+
fi
26+
27+
if [[ -n "${libpak_tools_version}" ]]; then
28+
install_libpak_tools "${libpak_tools_version}" "${directory}"
29+
else
30+
echo "Skipping libpak-tools: no version provided or found"
31+
fi
32+
33+
if [[ -n "${GITHUB_PATH:-}" ]]; then
34+
echo "${directory}" >> "${GITHUB_PATH}"
35+
fi
36+
37+
if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
38+
echo "directory=${directory}" >> "${GITHUB_OUTPUT}"
39+
fi
40+
}
41+
42+
function resolve_version() {
43+
local key input config version
44+
key="${1}"
45+
input="${2}"
46+
config="${3}"
47+
48+
if [[ -n "${input}" ]]; then
49+
echo "${input#v}"
50+
return
51+
fi
52+
53+
if [[ -n "${config}" && -f "${config}" ]]; then
54+
version="$(jq -r --arg key "${key}" '.[$key] // empty' "${config}")"
55+
echo "${version#v}"
56+
return
57+
fi
58+
59+
echo ""
60+
}
61+
62+
function install_jam() {
63+
local version directory os arch
64+
version="${1#v}"
65+
directory="${2}"
66+
os="$(tool_os)"
67+
arch="$(tool_arch)"
68+
69+
echo "Installing jam v${version}"
70+
download \
71+
"https://github.com/paketo-buildpacks/jam/releases/download/v${version}/jam-${os}-${arch}" \
72+
"${directory}/jam"
73+
chmod +x "${directory}/jam"
74+
}
75+
76+
function install_libpak_tools() {
77+
local version directory os arch archive
78+
version="${1#v}"
79+
directory="${2}"
80+
os="$(tool_os_capitalized)"
81+
arch="$(libpak_tools_arch)"
82+
archive="$(mktemp "${TMPDIR:-/tmp}/libpak-tools.XXXXXX")"
83+
84+
echo "Installing libpak-tools v${version}"
85+
download \
86+
"https://github.com/paketo-buildpacks/libpak-tools/releases/download/v${version}/libpak-tools_${os}_${arch}.tar.gz" \
87+
"${archive}"
88+
tar -xzf "${archive}" -C "${directory}" libpak-tools
89+
rm -f "${archive}"
90+
chmod +x "${directory}/libpak-tools"
91+
}
92+
93+
function download() {
94+
local url output
95+
url="${1}"
96+
output="${2}"
97+
98+
curl \
99+
--fail \
100+
--show-error \
101+
--silent \
102+
--location \
103+
--retry 3 \
104+
--connect-timeout 5 \
105+
--max-time 120 \
106+
--output "${output}" \
107+
"${url}"
108+
}
109+
110+
function tool_os() {
111+
case "$(uname -s)" in
112+
"Darwin")
113+
echo "darwin"
114+
;;
115+
116+
"Linux")
117+
echo "linux"
118+
;;
119+
120+
*)
121+
echo "unsupported operating system: $(uname -s)" >&2
122+
exit 1
123+
;;
124+
esac
125+
}
126+
127+
function tool_os_capitalized() {
128+
case "$(uname -s)" in
129+
"Darwin")
130+
echo "Darwin"
131+
;;
132+
133+
"Linux")
134+
echo "Linux"
135+
;;
136+
137+
*)
138+
echo "unsupported operating system: $(uname -s)" >&2
139+
exit 1
140+
;;
141+
esac
142+
}
143+
144+
function tool_arch() {
145+
case "$(uname -m)" in
146+
"amd64"|"x86_64")
147+
echo "amd64"
148+
;;
149+
150+
"arm64"|"aarch64")
151+
echo "arm64"
152+
;;
153+
154+
"s390x")
155+
echo "s390x"
156+
;;
157+
158+
*)
159+
echo "unsupported architecture: $(uname -m)" >&2
160+
exit 1
161+
;;
162+
esac
163+
}
164+
165+
function libpak_tools_arch() {
166+
case "$(uname -m)" in
167+
"amd64"|"x86_64")
168+
echo "x86_64"
169+
;;
170+
171+
"arm64"|"aarch64")
172+
echo "arm64"
173+
;;
174+
175+
*)
176+
echo "unsupported architecture for libpak-tools: $(uname -m)" >&2
177+
exit 1
178+
;;
179+
esac
180+
}
181+
182+
main "${@:-}"

‎implementation/.github/workflows/label-pr.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Set / Validate PR Labels
22
on:
3-
pull_request_target:
3+
pull_request:
44
branches:
55
- main
66
types:
@@ -22,8 +22,9 @@ jobs:
2222
name: Ensure Minimal Semver Labels
2323
runs-on: ubuntu-24.04
2424
permissions:
25-
issues: read # read the issue's current labels
26-
pull-requests: read # read the pull request's metadata
25+
contents: read # check out the repository to determine which files changed
26+
issues: write # add the semver label
27+
pull-requests: write # update the pull request's labels
2728
steps:
2829
- name: Check Minimal Semver Labels
2930
uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
@@ -35,7 +36,9 @@ jobs:
3536
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3637

3738
- name: Auto-label Semver
38-
if: ${{ failure() }}
39+
# Pull requests from forks receive a read-only token, so they cannot be
40+
# auto-labeled. A maintainer must add the label to those pull requests.
41+
if: ${{ failure() && github.event.pull_request.head.repo.full_name == github.repository }}
3942
uses: paketo-buildpacks/github-config/actions/pull-request/auto-semver-label@main
4043
env:
41-
GITHUB_TOKEN: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
44+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎implementation/.github/workflows/update-dependencies-from-metadata.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -398,13 +398,22 @@ jobs:
398398
branch: automation/dependencies/update-from-metadata
399399
token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
400400
401+
- name: Open Pull Request (no semver label)
402+
if: ${{ steps.commit.outputs.commit_sha != '' && steps.update.outputs.semver_bump == '' }}
403+
uses: paketo-buildpacks/github-config/actions/pull-request/open@main
404+
with:
405+
token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
406+
title: "Updates buildpack.toml with ${{ steps.update.outputs.new-versions }}"
407+
branch: automation/dependencies/update-from-metadata
408+
401409
- name: Open Pull Request
402-
if: ${{ steps.commit.outputs.commit_sha != '' }}
410+
if: ${{ steps.commit.outputs.commit_sha != '' && steps.update.outputs.semver_bump != '' }}
403411
uses: paketo-buildpacks/github-config/actions/pull-request/open@main
404412
with:
405413
token: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
406414
title: "Updates buildpack.toml with ${{ steps.update.outputs.new-versions }}"
407415
branch: automation/dependencies/update-from-metadata
416+
label: "semver:${{ steps.update.outputs.semver_bump }}"
408417
409418
failure:
410419
name: Alert on Failure

‎language-family/.github/workflows/label-pr.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Set / Validate PR Labels
22
on:
3-
pull_request_target:
3+
pull_request:
44
branches:
55
- main
66
types:
@@ -22,8 +22,9 @@ jobs:
2222
name: Ensure Minimal Semver Labels
2323
runs-on: ubuntu-24.04
2424
permissions:
25-
issues: read # read the issue's current labels
26-
pull-requests: read # read the pull request's metadata
25+
contents: read # check out the repository to determine which files changed
26+
issues: write # add the semver label
27+
pull-requests: write # update the pull request's labels
2728
steps:
2829
- name: Check Minimal Semver Labels
2930
uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
@@ -35,7 +36,9 @@ jobs:
3536
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3637

3738
- name: Auto-label Semver
38-
if: ${{ failure() }}
39+
# Pull requests from forks receive a read-only token, so they cannot be
40+
# auto-labeled. A maintainer must add the label to those pull requests.
41+
if: ${{ failure() && github.event.pull_request.head.repo.full_name == github.repository }}
3942
uses: paketo-buildpacks/github-config/actions/pull-request/auto-semver-label@main
4043
env:
41-
GITHUB_TOKEN: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
44+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)