diff --git a/.github/workflows/release-notes-sync.yaml b/.github/workflows/release-notes-sync.yaml index 577e0a6..de9fb77 100644 --- a/.github/workflows/release-notes-sync.yaml +++ b/.github/workflows/release-notes-sync.yaml @@ -6,8 +6,7 @@ on: - cron: "0 6 * * 1" permissions: - contents: write - pull-requests: write + contents: read jobs: sync-release-notes: @@ -15,6 +14,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: + - name: "Generate GitHub App token" + id: app-token + uses: actions/create-github-app-token@v3.2.0 + with: + client-id: "${{ secrets.APP_CLIENT_ID }}" + private-key: "${{ secrets.APP_PEM_FILE }}" + - name: "Checkout code" uses: actions/checkout@v4 @@ -34,21 +40,46 @@ jobs: echo "has_changes=true" >> "$GITHUB_OUTPUT" fi - - name: "Create pull request" + - name: "Commit and raise pull request" if: steps.changes.outputs.has_changes == 'true' - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 - with: - token: "${{ secrets.GITHUB_TOKEN }}" - branch: "automation/release-notes-cache" - delete-branch: true - commit-message: "sync release notes" - title: "CCM-18043: Sync release notes" - body: | - ## Summary - - This PR syncs the release notes generated from JIRA for the last year. - - - Trigger: `${{ github.event_name }}` - - Source: `JIRA_URL secret (expanded to REST API base path)` - add-paths: | - docs/_data/release-notes.json + env: + GH_TOKEN: "${{ steps.app-token.outputs.token }}" + shell: bash + run: | + DEFAULT_SHA=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq '.object.sha') + + # Create branch pointing to main, or force-reset it if it already exists + gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \ + -f ref="refs/heads/automation/release-notes-cache" \ + -f sha="$DEFAULT_SHA" 2>/dev/null || \ + gh api --method PATCH "repos/$GITHUB_REPOSITORY/git/refs/heads/automation/release-notes-cache" \ + -f sha="$DEFAULT_SHA" \ + -F force=true + + # Commits via the Contents API are automatically verified by GitHub + FILE_SHA=$(gh api "repos/$GITHUB_REPOSITORY/contents/docs/_data/release-notes.json?ref=automation/release-notes-cache" --jq '.sha' 2>/dev/null || echo "") + FILE_CONTENT=$(base64 -w 0 docs/_data/release-notes.json) + + if [ -n "$FILE_SHA" ]; then + gh api --method PUT "repos/$GITHUB_REPOSITORY/contents/docs/_data/release-notes.json" \ + -f message="sync release notes" \ + -f content="$FILE_CONTENT" \ + -f sha="$FILE_SHA" \ + -f branch="automation/release-notes-cache" + else + gh api --method PUT "repos/$GITHUB_REPOSITORY/contents/docs/_data/release-notes.json" \ + -f message="sync release notes" \ + -f content="$FILE_CONTENT" \ + -f branch="automation/release-notes-cache" + fi + + gh pr create \ + --title "CCM-18043: Sync release notes" \ + --body "## Summary + + This PR syncs the release notes generated from JIRA for the last year. + + - Trigger: \`${{ github.event_name }}\` + - Source: \`JIRA_URL secret (expanded to REST API base path)\`" \ + --base main \ + --head automation/release-notes-cache 2>/dev/null || echo "PR already exists" diff --git a/.github/workflows/stage-1-commit.yaml b/.github/workflows/stage-1-commit.yaml index 63b7c79..afcfeb1 100644 --- a/.github/workflows/stage-1-commit.yaml +++ b/.github/workflows/stage-1-commit.yaml @@ -46,7 +46,16 @@ jobs: with: fetch-depth: 0 # Full history is needed to scan all commits - name: "Scan secrets" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-secrets@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-secrets@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + validate-action-pins: + name: "Validate action SHA pins" + runs-on: ubuntu-latest + timeout-minutes: 2 + steps: + - name: "Checkout code" + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: "Validate action SHA pins" + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/validate-action-pins@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag check-file-format: name: "Check file format" runs-on: ubuntu-latest @@ -57,7 +66,7 @@ jobs: with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check file format" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-file-format@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-file-format@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag check-markdown-format: name: "Check Markdown format" runs-on: ubuntu-latest @@ -68,7 +77,7 @@ jobs: with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check Markdown format" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-markdown-format@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-markdown-format@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag check-english-usage: name: "Check English usage" runs-on: ubuntu-latest @@ -79,7 +88,7 @@ jobs: with: fetch-depth: 0 # Full history is needed to compare branches - name: "Check English usage" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-english-usage@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-english-usage@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag count-lines-of-code: name: "Count lines of code" runs-on: ubuntu-latest @@ -91,7 +100,7 @@ jobs: - name: "Checkout code" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 - name: "Count lines of code" - uses: NHSDigital/nhs-notify-shared-modules/.github/actions/create-lines-of-code-report@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag + uses: NHSDigital/nhs-notify-shared-modules/.github/actions/create-lines-of-code-report@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag with: build_datetime: "${{ inputs.build_datetime }}" build_timestamp: "${{ inputs.build_timestamp }}"