2nd attempt: Fix automerge CI permissions via job-level #154
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Merge PRs labeled release to master | |
| name: git-flow-automerge | |
| # Controls when the workflow will run | |
| on: | |
| # Trigger on pull request events tagged 'release' only for the develop branch | |
| pull_request: | |
| branches: [ develop ] | |
| types: [ labeled, closed, edited ] | |
| jobs: | |
| master-branch: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| with: | |
| ref: master | |
| - name: Extract master SHA | |
| run: echo "::set-output name=sha::$(git rev-parse master)" | |
| id: master_branch | |
| - name: Dump GitHub context | |
| env: | |
| GITHUB_CONTEXT: ${{ toJson(github) }} | |
| run: | | |
| echo "$GITHUB_CONTEXT" | jq '.' | |
| - name: Check triggering user permissions | |
| id: check_user_permissions | |
| uses: actions-cool/[email protected] | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| username: ${{ github.triggering_actor }} | |
| require: write | |
| outputs: | |
| sha: ${{ steps.master_branch.outputs.sha }} | |
| authorized: ${{ steps.check_user_permissions.outputs.require-result }} | |
| debug-automerge: | |
| runs-on: ubuntu-latest | |
| needs: master-branch | |
| steps: | |
| - name: Debug needs.master-branch.outputs.authorized | |
| run: echo ${{ needs.master-branch.outputs.authorized }} | |
| - name: Debug Authorized == true | |
| run: echo DEBUG AUTHZ = ${{ needs.master-branch.outputs.authorized == true }} | |
| - name: Debug Authorized fromJson | |
| run: echo DEBUG AUTHZ = ${{ fromJSON(needs.master-branch.outputs.authorized) }} | |
| - name: Debug Authorized fromJson to Boolean ... fromJSON(needs.master-branch.outputs.authorized) == true | |
| run: echo DEBUG AUTHZ = ${{ fromJSON(needs.master-branch.outputs.authorized) == true }} | |
| - name: Debug Authorized cast to String, then boolean check ...format('{0}', needs.master-branch.outputs.authorized) == 'true' | |
| run: echo DEBUG AUTHZ = ${{ format('{0}', needs.master-branch.outputs.authorized) == 'true' }} | |
| - name: Debug FULL Boolean | |
| run: echo DEBUG BOOLEAN = ${{ format('{0}', needs.master-branch.outputs.authorized) == 'true' && github.event.pull_request.merged == true && (contains(github.event.pull_request.labels.*.name, 'release') || github.event.label.name == 'release') }} | |
| automerge: | |
| if: format('{0}', needs.master-branch.outputs.authorized) == 'true' && github.event.pull_request.merged == true && (contains(github.event.pull_request.labels.*.name, 'release') || github.event.label.name == 'release') | |
| runs-on: ubuntu-latest | |
| needs: master-branch | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Dump GitHub context | |
| env: | |
| GITHUB_CONTEXT: ${{ toJson(github) }} | |
| run: | | |
| echo "$GITHUB_CONTEXT" | jq '.' | |
| - name: Debug Master SHA | |
| run: echo ${{ needs.master-branch.outputs.sha }} | |
| - uses: actions/checkout@v3 | |
| - uses: ruby/setup-ruby@v1 | |
| with: | |
| ruby-version: 2.6 # Not needed with a .ruby-version file | |
| bundler-cache: true # runs 'bundle install' and caches installed gems automatically | |
| - name: Extract Chef Version | |
| run: | | |
| bundle exec gem list --quiet --local --exact 'chef' | \ | |
| ruby -ne 'version = gsub(/chef\s*\((?<version>.*)\)$/, %q/\k<version>/); \ | |
| print "::set-output name=chef_version::#{version.chomp}"' | |
| id: extract_chef_version | |
| - name: Set release/chef-version branch name | |
| run: | | |
| echo '::set-output name=branch::release/chef-v${{ steps.extract_chef_version.outputs.chef_version }}' | |
| id: chef_release | |
| - uses: peterjgrainger/[email protected] | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| branch: ${{ steps.chef_release.outputs.branch }} | |
| sha: ${{ needs.master-branch.outputs.sha }} | |
| - name: git-flow-merge-action | |
| uses: yanamura/git-flow-merge-action@v1 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| branch: 'develop' | |
| # Can't turn off merging branch into both: develop_branch & main_branch... so hack it to just do master | |
| develop_branch: ${{ steps.chef_release.outputs.branch }} | |
| main_branch: 'master' |