From 643777126a846d197bbd9477919bc5de8f5ebb15 Mon Sep 17 00:00:00 2001 From: Zhenya Tikhonov Date: Tue, 28 Jul 2026 13:01:10 +0400 Subject: [PATCH] build: refactor Dockerfile --- .github/PULL_REQUEST_TEMPLATE.md | 20 +++--- .github/actions/bump-version/action.yml | 87 +++++++++++++++++++++++++ .github/dependabot.yml | 37 +++++++++++ .github/release-drafter.yaml | 6 +- .github/workflows/version-bump.yml | 81 +++++++++++++++++++++++ Dockerfile | 4 +- service.yaml | 2 +- 7 files changed, 219 insertions(+), 18 deletions(-) create mode 100644 .github/actions/bump-version/action.yml create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/version-bump.yml diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 45d23193e41..fdb35372c24 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,18 +1,16 @@ ## What -## Why - -## Notes - - -## Labels - -Assign the following labels to the PR: - -`security` - to trigger image scanning in CI build + ## PR Comments Add the following comments to the PR: -`/e2e` - to trigger E2E build +* `/e2e` - to trigger E2E build +* `/bump patch` - to bump the patch version +* `/bump minor` - to bump the minor version +* `/bump major` - to bump the major version diff --git a/.github/actions/bump-version/action.yml b/.github/actions/bump-version/action.yml new file mode 100644 index 00000000000..62313f93a7c --- /dev/null +++ b/.github/actions/bump-version/action.yml @@ -0,0 +1,87 @@ +name: Bump version +description: Compute and apply a semver bump to service.yaml, commit, push, and report on the PR. + +inputs: + bump: + description: Version component to bump (major, minor, or patch) + required: true + base: + description: Base branch name + required: true + head: + description: Head branch name + required: true + pr: + description: Pull request number + required: true + github-token: + description: GitHub token + required: true + +runs: + using: composite + steps: + - name: Check out PR branch + uses: actions/checkout@v4 + with: + ref: ${{ inputs.head }} + fetch-depth: 0 + token: ${{ inputs.github-token }} + + - name: Compute and apply version bump + id: bump + shell: bash + env: + BUMP: ${{ inputs.bump }} + BASE: ${{ inputs.base }} + run: | + git fetch origin "$BASE" --depth=1 + base_version=$(git show "origin/$BASE:service.yaml" | grep '^version:' | awk '{print $2}') + echo "Base ($BASE) version: $base_version" + + IFS='.' read -r major minor patch <<< "$base_version" + case "$BUMP" in + major) major=$((major + 1)); minor=0; patch=0 ;; + minor) minor=$((minor + 1)); patch=0 ;; + patch) patch=$((patch + 1)) ;; + esac + new_version="${major}.${minor}.${patch}" + echo "New version: $new_version" + echo "new_version=$new_version" >> "$GITHUB_OUTPUT" + echo "base_version=$base_version" >> "$GITHUB_OUTPUT" + + # Reset to base version first, then apply bump — result depends only on + # base branch, never on a previous bump. + sed -i "s/^version:.*/version: $new_version/" service.yaml + + if git diff --quiet -- service.yaml; then + echo "changed=false" >> "$GITHUB_OUTPUT" + else + echo "changed=true" >> "$GITHUB_OUTPUT" + fi + + - name: Commit and push + if: steps.bump.outputs.changed == 'true' + shell: bash + env: + NEW_VERSION: ${{ steps.bump.outputs.new_version }} + HEAD: ${{ inputs.head }} + run: | + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add service.yaml + git commit -m "ci: bump version to ${NEW_VERSION}" + git push origin "HEAD:${HEAD}" + + - name: Report result + shell: bash + env: + GH_TOKEN: ${{ inputs.github-token }} + PR: ${{ inputs.pr }} + run: | + if [ '${{ steps.bump.outputs.changed }}' = 'true' ]; then + body="✅ Bumped version to \`${{ steps.bump.outputs.new_version }}\` (\`${{ inputs.bump }}\` from \`${{ steps.bump.outputs.base_version }}\` on \`${{ inputs.base }}\`)." + else + body="ℹ️ Version is already \`${{ steps.bump.outputs.new_version }}\` (\`${{ inputs.bump }}\` from \`${{ steps.bump.outputs.base_version }}\` on \`${{ inputs.base }}\`). Nothing to do." + fi + gh pr comment "$PR" --repo "${{ github.repository }}" --body "$body" diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000000..0e60101c989 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,37 @@ +# Please see the documentation for all configuration options: +# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + +version: 2 + +registries: + docker-registry: + type: docker-registry + url: https://registry.hub.docker.com + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + +multi-ecosystem-groups: + docker-weekly: + schedule: + interval: "weekly" + +updates: + - package-ecosystem: "docker" + directory: "/" + registries: "*" + schedule: + interval: "weekly" + labels: + - "dependabot" + - "review-required" + - "docker" + multi-ecosystem-group: "docker-weekly" + patterns: + - "*" + ignore: + - dependency-name: "octopusdeploy/dhi-debian-base" + update-types: + - version-update:semver-major + - dependency-name: "docker/compose-bin" + update-types: + - version-update:semver-major diff --git a/.github/release-drafter.yaml b/.github/release-drafter.yaml index 56a10844605..68d7e1af30a 100644 --- a/.github/release-drafter.yaml +++ b/.github/release-drafter.yaml @@ -1,8 +1,8 @@ -name-template: 'v$RESOLVED_VERSION' -tag-template: 'v$RESOLVED_VERSION' +name-template: '$RESOLVED_VERSION' +tag-template: '$RESOLVED_VERSION' change-template: '- $TITLE @$AUTHOR (#$NUMBER)' change-title-escapes: '\<*_&' # You can add # and @ to disable mentions, and add ` to disable code blocks. template: | ## Changes - $CHANGES \ No newline at end of file + $CHANGES diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml new file mode 100644 index 00000000000..e8149e6b453 --- /dev/null +++ b/.github/workflows/version-bump.yml @@ -0,0 +1,81 @@ +name: Bump version on comment + +# Bumps the "version" field in service.yaml when a maintainer comments +# "/bump major", "/bump minor" or "/bump patch" on a pull request. +# +# The new version is always computed relative to the PR's target (base) branch, +# so commenting several times only ever produces a single bump from the base — +# it never stacks on top of a previous comment. + +on: + issue_comment: + types: [created] + +permissions: + contents: write + pull-requests: write + +jobs: + bump-version: + # Only run on PR comments, only for users that can write to the repo, and + # only when the comment is one of the supported /bump commands. + if: > + github.event.issue.pull_request && + contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) && + (startsWith(github.event.comment.body, '/bump major') || + startsWith(github.event.comment.body, '/bump minor') || + startsWith(github.event.comment.body, '/bump patch')) + runs-on: ubuntu-latest + steps: + - name: Acknowledge command + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh api \ + --method POST \ + "/repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions" \ + -f content='eyes' + + - name: Parse command + id: parse + env: + COMMENT_BODY: ${{ github.event.comment.body }} + run: | + # Pass the comment via env (never interpolated into the script) to + # avoid shell injection from untrusted comment content. + # Only parse the first line: integrations (e.g. Linear) may append + # extra lines such as "". + bump=$(printf '%s' "$COMMENT_BODY" | awk 'NR==1{print $2}') + case "$bump" in + major|minor|patch) + echo "bump=$bump" >> "$GITHUB_OUTPUT" + ;; + *) + echo "::error::Unsupported version command: '$bump'" + exit 1 + ;; + esac + + - name: Resolve PR branches + id: pr + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh pr view "${{ github.event.issue.number }}" \ + --repo "${{ github.repository }}" \ + --json headRefName,baseRefName \ + > pr.json + echo "head=$(jq -r .headRefName pr.json)" >> "$GITHUB_OUTPUT" + echo "base=$(jq -r .baseRefName pr.json)" >> "$GITHUB_OUTPUT" + + - name: Check out repository + uses: actions/checkout@v4 + + - name: Bump version + uses: ./.github/actions/bump-version + with: + bump: ${{ steps.parse.outputs.bump }} + base: ${{ steps.pr.outputs.base }} + head: ${{ steps.pr.outputs.head }} + pr: ${{ github.event.issue.number }} + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/Dockerfile b/Dockerfile index 75b7648c410..afb365c5e4c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,4 @@ -# CI relies on this ARG. Don't remove or rename it -ARG COMPOSE_VERSION=v5.2.0 -FROM docker/compose-bin:${COMPOSE_VERSION} AS compose-bin +FROM docker/compose-bin:v5.2.0@sha256:54c280c16d23289af63a9391626e3d09ddcd1253d4a5eef1f6ed52a531168e91 AS compose-bin # DHI source: https://hub.docker.com/repository/docker/octopusdeploy/dhi-debian-base diff --git a/service.yaml b/service.yaml index f21b920d49f..7e14708d494 100644 --- a/service.yaml +++ b/service.yaml @@ -1 +1 @@ -version: 1.6.7 +version: 1.6.8