Skip to content

CCM-18043: adding auth automation to raise PR #282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aidenvaines-cgi merged 7 commits into from
Sep 9, 2026
Merged

CCM-18043: adding auth automation to raise PR #282

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
96063bd
CCM-18043: Adding GPG Key for bot
aidenvaines-cgi Aug 25, 2026
7e932b7
CCM-18043: Adding GPG Key for bot
aidenvaines-cgi Aug 25, 2026
90b0d8c
CCM-18043: Adding GPG Key for bot
aidenvaines-cgi Aug 26, 2026
8ad67f5
CCM-18043: Adding GPG Key for bot
aidenvaines-cgi Aug 26, 2026
25730e0
CCM-18043: Adding GPG Key for bot
aidenvaines-cgi Aug 26, 2026
f287d4b
CCM-18043: Adding GPG Key for bot
aidenvaines-cgi Aug 26, 2026
c2a5820
Merge branch 'main' into CCM-18043_AddingGPG
aidenvaines-cgi Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 50 additions & 19 deletions .github/workflows/release-notes-sync.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,21 @@ on:
- cron: "0 6 * * 1"

permissions:
contents: write
pull-requests: write
contents: read

jobs:
sync-release-notes:
name: "Sync release notes"
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: "Generate GitHub App token"
id: app-token
uses: actions/create-github-app-token@v3.2.0
with:
client-id: "${{ secrets.APP_CLIENT_ID }}"
private-key: "${{ secrets.APP_PEM_FILE }}"

- name: "Checkout code"
uses: actions/checkout@v4

Expand All @@ -34,21 +40,46 @@ jobs:
echo "has_changes=true" >> "$GITHUB_OUTPUT"
fi

- name: "Create pull request"
- name: "Commit and raise pull request"
if: steps.changes.outputs.has_changes == 'true'
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
token: "${{ secrets.GITHUB_TOKEN }}"
branch: "automation/release-notes-cache"
delete-branch: true
commit-message: "sync release notes"
title: "CCM-18043: Sync release notes"
body: |
## Summary

This PR syncs the release notes generated from JIRA for the last year.

- Trigger: `${{ github.event_name }}`
- Source: `JIRA_URL secret (expanded to REST API base path)`
add-paths: |
docs/_data/release-notes.json
env:
GH_TOKEN: "${{ steps.app-token.outputs.token }}"
shell: bash
run: |
DEFAULT_SHA=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq '.object.sha')

# Create branch pointing to main, or force-reset it if it already exists
gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \
-f ref="refs/heads/automation/release-notes-cache" \
-f sha="$DEFAULT_SHA" 2>/dev/null || \
gh api --method PATCH "repos/$GITHUB_REPOSITORY/git/refs/heads/automation/release-notes-cache" \
-f sha="$DEFAULT_SHA" \
-F force=true

# Commits via the Contents API are automatically verified by GitHub
FILE_SHA=$(gh api "repos/$GITHUB_REPOSITORY/contents/docs/_data/release-notes.json?ref=automation/release-notes-cache" --jq '.sha' 2>/dev/null || echo "")
FILE_CONTENT=$(base64 -w 0 docs/_data/release-notes.json)

if [ -n "$FILE_SHA" ]; then
gh api --method PUT "repos/$GITHUB_REPOSITORY/contents/docs/_data/release-notes.json" \
-f message="sync release notes" \
-f content="$FILE_CONTENT" \
-f sha="$FILE_SHA" \
-f branch="automation/release-notes-cache"
else
gh api --method PUT "repos/$GITHUB_REPOSITORY/contents/docs/_data/release-notes.json" \
-f message="sync release notes" \
-f content="$FILE_CONTENT" \
-f branch="automation/release-notes-cache"
fi

gh pr create \
--title "CCM-18043: Sync release notes" \
--body "## Summary

This PR syncs the release notes generated from JIRA for the last year.

- Trigger: \`${{ github.event_name }}\`
- Source: \`JIRA_URL secret (expanded to REST API base path)\`" \
--base main \
--head automation/release-notes-cache 2>/dev/null || echo "PR already exists"
19 changes: 14 additions & 5 deletions .github/workflows/stage-1-commit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,16 @@ jobs:
with:
fetch-depth: 0 # Full history is needed to scan all commits
- name: "Scan secrets"
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-secrets@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-secrets@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
validate-action-pins:
name: "Validate action SHA pins"
runs-on: ubuntu-latest
timeout-minutes: 2
steps:
- name: "Checkout code"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: "Validate action SHA pins"
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/validate-action-pins@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
check-file-format:
name: "Check file format"
runs-on: ubuntu-latest
Expand All @@ -57,7 +66,7 @@ jobs:
with:
fetch-depth: 0 # Full history is needed to compare branches
- name: "Check file format"
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-file-format@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-file-format@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
check-markdown-format:
name: "Check Markdown format"
runs-on: ubuntu-latest
Expand All @@ -68,7 +77,7 @@ jobs:
with:
fetch-depth: 0 # Full history is needed to compare branches
- name: "Check Markdown format"
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-markdown-format@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-markdown-format@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
check-english-usage:
name: "Check English usage"
runs-on: ubuntu-latest
Expand All @@ -79,7 +88,7 @@ jobs:
with:
fetch-depth: 0 # Full history is needed to compare branches
- name: "Check English usage"
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-english-usage@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/check-english-usage@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
count-lines-of-code:
name: "Count lines of code"
runs-on: ubuntu-latest
Expand All @@ -91,7 +100,7 @@ jobs:
- name: "Checkout code"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
- name: "Count lines of code"
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/create-lines-of-code-report@5.1.0 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
uses: NHSDigital/nhs-notify-shared-modules/.github/actions/create-lines-of-code-report@5.1.3 # NOSONAR - githubactions:S7637 - internally controlled repo, pinned by tag
with:
build_datetime: "${{ inputs.build_datetime }}"
build_timestamp: "${{ inputs.build_timestamp }}"
Expand Down
Loading