Victor Lyuboslavsky
457aad6db9
- misfeature — rule enabled, waived only for the 6 Windows shell: cmd workflows (catches any future misuse elsewhere). - excessive-permissions and artipacked — fixed and fully enforced (removed from gate). <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41198 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Improved CI/CD security by disabling credential persistence across many workflows. * Tightened workflow permissions to least-privilege for selected build and analysis jobs. * Made runner hardening and credential handling explicit in several deployment and test workflows. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
232 lines
11 KiB
YAML
232 lines
11 KiB
YAML
name: "Automated policy updates for dogfood"
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 */6 * * *' # Run every 6 hours
|
|
workflow_dispatch: # Allow manual trigger
|
|
|
|
# This allows a subsequently queued workflow run to interrupt previous runs
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
|
shell: bash
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
update-policies:
|
|
permissions:
|
|
contents: write # Required to push new branch
|
|
pull-requests: write # Required to open PRs
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout repository
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
fetch-depth: 1
|
|
persist-credentials: false
|
|
|
|
- name: Set up Git
|
|
run: |
|
|
git config --local user.name "GitHub Action"
|
|
git config --local user.email "action@github.com"
|
|
|
|
- name: Run macOS version update script
|
|
id: update-macos
|
|
run: |
|
|
chmod +x ./.github/scripts/dogfood-policy-updater-latest-macos.sh
|
|
./.github/scripts/dogfood-policy-updater-latest-macos.sh
|
|
if [ $? -eq 0 ]; then
|
|
# Check if there are any changes
|
|
if git diff --quiet; then
|
|
echo "changed=false" >> $GITHUB_OUTPUT
|
|
echo "No changes detected for macOS policy"
|
|
else
|
|
echo "changed=true" >> $GITHUB_OUTPUT
|
|
echo "Changes detected for macOS policy"
|
|
git diff
|
|
fi
|
|
else
|
|
echo "changed=false" >> $GITHUB_OUTPUT
|
|
exit 0
|
|
fi
|
|
env:
|
|
DOGFOOD_AUTOMATION_TOKEN: ${{ secrets.DOGFOOD_AUTOMATION_TOKEN }}
|
|
DOGFOOD_AUTOMATION_USER_NAME: ${{ secrets.DOGFOOD_AUTOMATION_USER_NAME }}
|
|
DOGFOOD_AUTOMATION_USER_EMAIL: ${{ secrets.DOGFOOD_AUTOMATION_USER_EMAIL }}
|
|
|
|
- name: Run 1Password macOS version update script
|
|
id: update-1password
|
|
run: |
|
|
chmod +x ./.github/scripts/dogfood-policy-updater-latest-1password-macos.sh
|
|
./.github/scripts/dogfood-policy-updater-latest-1password-macos.sh
|
|
if [ $? -eq 0 ]; then
|
|
# Check if there are any changes
|
|
if git diff --quiet; then
|
|
echo "changed=false" >> $GITHUB_OUTPUT
|
|
echo "No changes detected for 1Password policy"
|
|
else
|
|
echo "changed=true" >> $GITHUB_OUTPUT
|
|
echo "Changes detected for 1Password policy"
|
|
git diff
|
|
fi
|
|
else
|
|
echo "changed=false" >> $GITHUB_OUTPUT
|
|
exit 0
|
|
fi
|
|
env:
|
|
DOGFOOD_AUTOMATION_TOKEN: ${{ secrets.DOGFOOD_AUTOMATION_TOKEN }}
|
|
DOGFOOD_AUTOMATION_USER_NAME: ${{ secrets.DOGFOOD_AUTOMATION_USER_NAME }}
|
|
DOGFOOD_AUTOMATION_USER_EMAIL: ${{ secrets.DOGFOOD_AUTOMATION_USER_EMAIL }}
|
|
|
|
- name: Run Safari version update script
|
|
id: update-safari
|
|
run: |
|
|
chmod +x ./.github/scripts/dogfood-policy-updater-latest-safari.sh
|
|
./.github/scripts/dogfood-policy-updater-latest-safari.sh
|
|
if [ $? -eq 0 ]; then
|
|
# Check if there are any changes
|
|
if git diff --quiet; then
|
|
echo "changed=false" >> $GITHUB_OUTPUT
|
|
echo "No changes detected for Safari policy"
|
|
else
|
|
echo "changed=true" >> $GITHUB_OUTPUT
|
|
echo "Changes detected for Safari policy"
|
|
git diff
|
|
fi
|
|
else
|
|
echo "changed=false" >> $GITHUB_OUTPUT
|
|
exit 0
|
|
fi
|
|
env:
|
|
DOGFOOD_AUTOMATION_TOKEN: ${{ secrets.DOGFOOD_AUTOMATION_TOKEN }}
|
|
DOGFOOD_AUTOMATION_USER_NAME: ${{ secrets.DOGFOOD_AUTOMATION_USER_NAME }}
|
|
DOGFOOD_AUTOMATION_USER_EMAIL: ${{ secrets.DOGFOOD_AUTOMATION_USER_EMAIL }}
|
|
|
|
- name: Search for Existing PRs
|
|
if: steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true' || steps.update-safari.outputs.changed == 'true'
|
|
id: search_pr
|
|
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
|
|
with:
|
|
script: |
|
|
const { data: pullRequests } = await github.rest.pulls.list({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
state: 'open',
|
|
per_page: 100
|
|
});
|
|
const matchingPRs = pullRequests.filter(pr =>
|
|
(pr.title.includes('Update macOS policy versions') ||
|
|
pr.title.includes('Update 1Password macOS policy version') ||
|
|
pr.title.includes('Update Safari policy version') ||
|
|
pr.title.includes('Update macOS and 1Password policy versions') ||
|
|
pr.title.includes('Update macOS and Safari policy versions') ||
|
|
pr.title.includes('Update 1Password and Safari policy versions') ||
|
|
pr.title.includes('Update macOS, 1Password, and Safari policy versions') ||
|
|
pr.title.includes('Update latest macOS versions') ||
|
|
pr.title.includes('Update latest macOS version')) &&
|
|
pr.user.login === 'github-actions[bot]'
|
|
);
|
|
return matchingPRs.map(pr => pr.number);
|
|
|
|
- name: Determine update type and generate branch name
|
|
if: steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true' || steps.update-safari.outputs.changed == 'true'
|
|
id: update-info
|
|
run: |
|
|
BRANCH_DATE=$(date +'%y%m%d%H%M')
|
|
MACOS_CHANGED="${{ steps.update-macos.outputs.changed }}"
|
|
ONEPASSWORD_CHANGED="${{ steps.update-1password.outputs.changed }}"
|
|
SAFARI_CHANGED="${{ steps.update-safari.outputs.changed }}"
|
|
|
|
# Determine what changed and create appropriate branch name and title
|
|
if [ "$MACOS_CHANGED" == "true" ] && [ "$ONEPASSWORD_CHANGED" == "true" ] && [ "$SAFARI_CHANGED" == "true" ]; then
|
|
BRANCH_NAME="update-macos-1password-safari-policy-versions-$BRANCH_DATE"
|
|
PR_TITLE="Update macOS, 1Password, and Safari policy versions"
|
|
PR_BODY="This PR automatically updates macOS version policies, 1Password macOS version policy, and Safari version policy for dogfood."
|
|
elif [ "$MACOS_CHANGED" == "true" ] && [ "$ONEPASSWORD_CHANGED" == "true" ]; then
|
|
BRANCH_NAME="update-macos-and-1password-policy-versions-$BRANCH_DATE"
|
|
PR_TITLE="Update macOS and 1Password policy versions"
|
|
PR_BODY="This PR automatically updates both macOS version policies and 1Password macOS version policy for dogfood."
|
|
elif [ "$MACOS_CHANGED" == "true" ] && [ "$SAFARI_CHANGED" == "true" ]; then
|
|
BRANCH_NAME="update-macos-and-safari-policy-versions-$BRANCH_DATE"
|
|
PR_TITLE="Update macOS and Safari policy versions"
|
|
PR_BODY="This PR automatically updates both macOS version policies and Safari version policy for dogfood."
|
|
elif [ "$ONEPASSWORD_CHANGED" == "true" ] && [ "$SAFARI_CHANGED" == "true" ]; then
|
|
BRANCH_NAME="update-1password-and-safari-policy-versions-$BRANCH_DATE"
|
|
PR_TITLE="Update 1Password and Safari policy versions"
|
|
PR_BODY="This PR automatically updates both 1Password macOS version policy and Safari version policy for dogfood."
|
|
elif [ "$ONEPASSWORD_CHANGED" == "true" ]; then
|
|
BRANCH_NAME="update-1password-policy-version-$BRANCH_DATE"
|
|
PR_TITLE="Update 1Password macOS policy version"
|
|
PR_BODY="This PR automatically updates the 1Password macOS version policy for dogfood."
|
|
elif [ "$SAFARI_CHANGED" == "true" ]; then
|
|
BRANCH_NAME="update-safari-policy-version-$BRANCH_DATE"
|
|
PR_TITLE="Update Safari policy version"
|
|
PR_BODY="This PR automatically updates the Safari version policy for dogfood."
|
|
else
|
|
BRANCH_NAME="update-macos-policy-versions-$BRANCH_DATE"
|
|
PR_TITLE="Update macOS policy versions"
|
|
PR_BODY="This PR automatically updates macOS version policies for dogfood."
|
|
fi
|
|
|
|
echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
|
|
echo "pr_title=$PR_TITLE" >> $GITHUB_OUTPUT
|
|
echo "pr_body=$PR_BODY" >> $GITHUB_OUTPUT
|
|
echo "Generated branch name: $BRANCH_NAME"
|
|
echo "PR title: $PR_TITLE"
|
|
|
|
- name: Create Pull Request
|
|
if: steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true' || steps.update-safari.outputs.changed == 'true'
|
|
id: create-pr
|
|
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e #v7.0.8
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
commit-message: |
|
|
${{ steps.update-info.outputs.pr_title }}
|
|
|
|
Automatically updated policy versions for dogfood.
|
|
title: ${{ steps.update-info.outputs.pr_title }}
|
|
body: |
|
|
${{ steps.update-info.outputs.pr_body }}
|
|
|
|
The changes were generated automatically by the [dogfood-automated-policy-updates workflow](https://github.com/${{ github.repository }}/actions/workflows/dogfood-automated-policy-updates.yml).
|
|
branch: ${{ steps.update-info.outputs.branch_name }}
|
|
delete-branch: true
|
|
assignees: allenhouchins
|
|
|
|
- name: Close Existing PRs
|
|
if: (steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true' || steps.update-safari.outputs.changed == 'true') && steps.search_pr.outputs.result != '[]'
|
|
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
|
|
with:
|
|
script: |
|
|
const prNumbers = JSON.parse('${{ steps.search_pr.outputs.result }}');
|
|
const newPrNumber = '${{ steps.create-pr.outputs.pull-request-number }}';
|
|
for (const prNumber of prNumbers) {
|
|
if (prNumber.toString() !== newPrNumber) {
|
|
await github.rest.issues.createComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: prNumber,
|
|
body: `Closing in favor of #${newPrNumber}.`,
|
|
});
|
|
await github.rest.pulls.update({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: prNumber,
|
|
state: 'closed',
|
|
});
|
|
}
|
|
}
|