Skip to content

Commit b818c34

Browse files
ytimocinDariuszPorowski
ytimocin
and
DariuszPorowski
authored
Down-Merge for SHA fix in actions (#1634)
* ci(workflows): pin actions to full sha (#1598) * ci(workflows): pin actions to full sha Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> * ci(dependabot): add configuration for GitHub Actions updates Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> * ci(workflows): ensure deployment skips when secrets are missing Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> * fix(workflows): correct syntax for Azure DevOps token retrieval step Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> --------- Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> * fix: broken links (#1607) Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> * ci(workflows): enhance permissions for jobs (#1627) Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> --------- Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> Co-authored-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
1 parent 24537bf commit b818c34

File tree

20 files changed

+344
-202
lines changed

20 files changed

+344
-202
lines changed

‎.github/dependabot.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/dependabot-2.0.json
2+
# See GitHub's documentation for more information on this file:
3+
# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
4+
---
5+
version: 2
6+
7+
updates:
8+
- package-ecosystem: github-actions
9+
directory: /
10+
schedule:
11+
interval: weekly
12+
commit-message:
13+
prefix: ci
14+
include: scope
15+
groups:
16+
all:
17+
patterns:
18+
- "*"

‎.github/workflows/close-stale-prs.yml‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,29 @@
22
#
33
# For more information, see:
44
# https://github.com/actions/stale
5+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
6+
---
57
name: Close stale pull requests
68

79
on:
810
schedule:
9-
- cron: '0 18 * * *' # Run the workflow every day at 6PM UTC (10AM PST).
11+
- cron: "0 18 * * *" # Run the workflow every day at 6PM UTC (10AM PST).
12+
13+
permissions: {}
1014

1115
jobs:
1216
stale:
13-
14-
runs-on: ubuntu-latest
17+
runs-on: ubuntu-24.04
18+
timeout-minutes: 5
1519
permissions:
1620
pull-requests: write
17-
1821
steps:
19-
- uses: actions/stale@v9
20-
with:
21-
repo-token: ${{ secrets.GITHUB_TOKEN }}
22-
stale-pr-message: 'This pull request has been automatically marked as stale because it has been inactive for 90 days. Remove stale label or comment or this PR will be closed in 7 days.'
23-
stale-pr-label: 'stale'
24-
days-before-pr-stale: 90 # 3 months
25-
days-before-pr-close: 7
26-
days-before-issue-stale: -1
27-
days-before-issue-close: -1
22+
- uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
23+
with:
24+
repo-token: ${{ github.token }}
25+
stale-pr-message: This pull request has been automatically marked as stale because it has been inactive for 90 days. Remove stale label or comment or this PR will be closed in 7 days.
26+
stale-pr-label: stale
27+
days-before-pr-stale: 90 # 3 months
28+
days-before-pr-close: 7
29+
days-before-issue-stale: -1
30+
days-before-issue-close: -1

.github/workflows/issues.yml renamed to .github/workflows/devops-boards.yaml

Lines changed: 25 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
13
name: Sync issue to Azure DevOps work item
24

35
on:
@@ -9,41 +11,46 @@ concurrency:
911
group: issue-${{ github.event.issue.number }}
1012
cancel-in-progress: false
1113

12-
# Extra permissions needed to login with Entra ID service principal via federated identity
13-
permissions:
14-
id-token: write
15-
issues: write
14+
permissions: {}
1615

1716
jobs:
1817
ado:
19-
runs-on: ubuntu-latest
18+
runs-on: ubuntu-24.04
19+
timeout-minutes: 5
20+
permissions:
21+
id-token: write
22+
issues: write
2023
environment:
2124
name: issues
2225
steps:
2326
# Auth using Azure Service Principals was added as a part of v2.3
2427
# reference: https://github.com/danhellem/github-actions-issue-to-work-item/pull/143
2528
- name: Login to Azure
26-
uses: azure/login@v2
29+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
2730
with:
2831
client-id: ${{ vars.AZURE_SP_DEVOPS_SYNC_CLIENT_ID }}
2932
tenant-id: ${{ vars.AZURE_SP_DEVOPS_SYNC_TENANT_ID }}
3033
allow-no-subscriptions: true
34+
3135
- name: Get Azure DevOps token
3236
id: get_ado_token
33-
run:
37+
run: |
3438
# The resource ID for Azure DevOps is always 499b84ac-1321-427f-aa17-267ca6975798
3539
# https://learn.microsoft.com/azure/devops/integrate/get-started/authentication/service-principal-managed-identity
36-
echo "ADO_TOKEN=$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query "accessToken" --output tsv)" >> $GITHUB_ENV
40+
ADO_TOKEN=$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken --output tsv)
41+
echo "::add-mask::${ADO_TOKEN}"
42+
echo "ADO_TOKEN=${ADO_TOKEN}" >> "${GITHUB_ENV}"
43+
3744
- name: Sync issue to Azure DevOps
38-
uses: danhellem/github-actions-issue-to-work-item@v2.3
45+
uses: danhellem/github-actions-issue-to-work-item@8d0ead9b49a65aa66dac6949b1ff149d7ef8b4de # v2.5
3946
env:
4047
ado_token: ${{ env.ADO_TOKEN }}
41-
github_token: '${{ secrets.GH_RAD_CI_BOT_PAT }}'
42-
ado_organization: 'azure-octo'
43-
ado_project: 'Incubations'
44-
ado_area_path: "Incubations\\Radius"
45-
ado_iteration_path: "Incubations\\Radius"
46-
ado_new_state: 'New'
47-
ado_active_state: 'Active'
48-
ado_close_state: 'Closed'
49-
ado_wit: 'GitHub Issue'
48+
github_token: ${{ github.token }}
49+
ado_organization: azure-octo
50+
ado_project: Incubations
51+
ado_area_path: Incubations\\Radius
52+
ado_iteration_path: Incubations\\Radius
53+
ado_new_state: New
54+
ado_active_state: Active
55+
ado_close_state: Closed
56+
ado_wit: GitHub Issue

‎.github/workflows/pr-checks.yaml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,25 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
13
name: PR Checks
24

35
on:
46
pull_request:
57
types: [opened, reopened, synchronize, labeled, unlabeled]
68

9+
permissions: {}
10+
711
jobs:
812
check-do-not-merge-tag:
913
name: Check for do-not-merge tag
10-
runs-on: ubuntu-latest
14+
runs-on: ubuntu-24.04
15+
timeout-minutes: 5
16+
permissions:
17+
issues: read
18+
pull-requests: read
1119
steps:
1220
- name: Check for do-not-merge label
13-
uses: mheap/github-action-required-labels@v5
21+
uses: mheap/github-action-required-labels@8afbe8ae6ab7647d0c9f0cfa7c2f939650d22509 # v5.5.1
1422
with:
15-
labels: "do-not-merge"
16-
mode: exactly
17-
count: 0
23+
labels: do-not-merge
24+
mode: exactly
25+
count: 0

‎.github/workflows/redirect.yml‎

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
13
name: Radius Redirect
24

35
on:
@@ -6,43 +8,56 @@ on:
68
branches:
79
- edge
810
- v*.*
9-
paths:
10-
- 'redirect/**'
11-
- '.github/workflows/redirect.yml'
11+
paths:
12+
- "redirect/**"
13+
- ".github/workflows/redirect.yml"
1214
pull_request:
1315
branches:
1416
- edge
1517
- v*.*
16-
paths:
17-
- 'redirect/**'
18-
- '.github/workflows/redirect.yml'
18+
paths:
19+
- "redirect/**"
20+
- ".github/workflows/redirect.yml"
21+
22+
permissions: {}
1923

2024
jobs:
2125
deploy-website:
2226
name: Deploy Redirect Website
23-
runs-on: ubuntu-latest
27+
runs-on: ubuntu-24.04
28+
timeout-minutes: 5
29+
permissions:
30+
contents: read
2431
steps:
2532
- name: Checkout repo
26-
uses: actions/checkout@v4
33+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
2734
with:
2835
submodules: false
36+
persist-credentials: false
37+
2938
- name: Deploy staging site
30-
uses: Azure/static-web-apps-deploy@v1
39+
uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1
3140
with:
3241
azure_static_web_apps_api_token: ${{ secrets.SWA_REDIRECT_TOKEN }}
33-
action: "upload"
34-
app_location: "redirect/src"
42+
action: upload
43+
app_location: redirect/src
3544
skip_api_build: true
3645
skip_app_build: true
46+
skip_deploy_on_missing_secrets: true
3747

3848
close_pr_site:
3949
name: Close PR Staging Site
4050
if: github.event_name == 'pull_request' && github.event.action == 'closed'
41-
runs-on: ubuntu-latest
51+
runs-on: ubuntu-24.04
52+
timeout-minutes: 5
53+
permissions:
54+
contents: read
4255
steps:
4356
- name: Close Pull Request
4457
id: closepullrequest
45-
uses: Azure/static-web-apps-deploy@v1
58+
uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1
4659
with:
4760
azure_static_web_apps_api_token: ${{ secrets.SWA_REDIRECT_TOKEN }}
48-
action: "close"
61+
action: close
62+
app_location: redirect/src
63+
skip_deploy_on_missing_secrets: true

‎.github/workflows/release.yaml‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,57 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
13
name: Release docs
24

35
on:
46
workflow_dispatch:
57
inputs:
68
version:
7-
description: 'Radius version number to use (e.g. 0.22.0, 0.23.0-rc1)'
9+
description: "Radius version number to use (e.g. 0.22.0, 0.23.0-rc1)"
810
required: true
9-
default: ''
11+
default: ""
1012
type: string
1113

14+
permissions: {}
15+
1216
env:
1317
GITHUB_TOKEN: ${{ secrets.GH_RAD_CI_BOT_PAT }}
14-
GITHUB_EMAIL: 'radiuscoreteam@service.microsoft.com'
15-
GITHUB_USER: 'Radius CI Bot'
18+
GITHUB_EMAIL: radiuscoreteam@service.microsoft.com
19+
GITHUB_USER: Radius CI Bot
1620

1721
jobs:
1822
release-docs:
19-
runs-on: ubuntu-latest
23+
runs-on: ubuntu-24.04
24+
timeout-minutes: 5
25+
permissions:
26+
contents: read
2027
steps:
21-
- uses: actions/checkout@v4
28+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
2229
with:
2330
token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
2431
ref: edge
2532
path: docs
33+
persist-credentials: false
34+
2635
- name: Configure git
2736
run: |
2837
git config --global user.email "${{ env.GITHUB_EMAIL }}"
2938
git config --global user.name "${{ env.GITHUB_USER }}"
39+
3040
- name: Ensure inputs.version is valid semver
3141
run: |
3242
python ./docs/.github/scripts/validate_semver.py ${{ inputs.version }}
43+
3344
- name: Parse release channel
3445
id: parse_release_channel
3546
run: |
3647
# CHANNEL is the major and minor version of the VERSION_NUMBER (e.g. 0.1)
3748
CHANNEL="$(echo ${{ inputs.version }} | cut -d '.' -f 1,2)"
38-
echo "channel=$CHANNEL" >> $GITHUB_OUTPUT
49+
echo "channel=$CHANNEL" >> "${GITHUB_OUTPUT}"
50+
3951
- name: Release docs
4052
run: |
4153
./docs/.github/scripts/release-docs.sh ${{ inputs.version }}
54+
4255
- name: Change the default branch
4356
run: |
4457
gh api \

0 commit comments

Comments
 (0)