From 726e5fb2ee38881005636eaa79af3baf66d623a8 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Wed, 21 Aug 2024 03:59:22 -0400 Subject: [PATCH] Fully switch to the GitHubApp token action - Fix --ensure-release not having the token set. - Remove `--token-output-file` command. - Remove upload code coverage dependency on releasenotes. --- .github/workflows/ci-pipeline.yml | 155 ++++++++++++------ .github/workflows/ci-security.yml | 13 +- .github/workflows/dependabot-automerge.yml | 23 +-- .github/workflows/size-label.yml | 13 +- .github/workflows/stable-merge.yml | 34 +--- .github/workflows/update-ss13-org-mirror.yml | 36 +--- .../Tgstation.Server.ReleaseNotes/Program.cs | 93 ++--------- 7 files changed, 162 insertions(+), 205 deletions(-) diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index 7dc7731287..62cebdaf33 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -39,7 +39,6 @@ env: TGS_DOTNET_QUALITY: ga TGS_WEBPANEL_NODE_VERSION: 20.x TGS_TEST_GITHUB_TOKEN: ${{ secrets.LIVE_TESTS_TOKEN }} - TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }} PACKAGING_PRIVATE_KEY_PASSPHRASE: ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }} concurrency: @@ -345,17 +344,20 @@ jobs: name: release_notes_bins path: release_notes_bins + - name: Generate App Token + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + - name: Compile Changelog (Incremental) + env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} run: | mv $HOME/tgsdox/changelog.yml ./ 2>/dev/null dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --generate-full-notes - - name: Generate App Token - run: | - dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} - echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV - rm ${{ runner.temp }}/installation_secret.txt - - name: Patch Doxyfile run: | VERSION=$(cat "build/Version.props" | grep -oPm1 "(?<=)[^<]+") @@ -367,7 +369,7 @@ jobs: doxyfile-path: "docs/Doxyfile" - name: gh-pages Push - if: github.event_name == 'push' && github.event.ref == 'refs/heads/dev' && env.TGS_RELEASE_NOTES_TOKEN != '' + if: github.event_name == 'push' && github.event.ref == 'refs/heads/dev' run: | pushd $HOME/tgsdox rm -r * @@ -388,7 +390,7 @@ jobs: echo "Committing..." git diff-index --quiet HEAD || git commit -m "Deploy code docs to GitHub Pages for workflow run ${{ github.run_number }}" -m "Commit: ${{ github.event.head_commit.id }}" echo "Pushing..." - git push -f "https://tgstation-server-ci:${{ env.INSTALLATION_TOKEN }}@github.com/tgstation/tgstation-server" 2>&1 + git push -f "https://tgstation-server-ci:${{ steps.app-token-generation.outputs.token }}@github.com/tgstation/tgstation-server" 2>&1 docker-build: name: Build Docker Image @@ -973,7 +975,6 @@ jobs: linux-integration-tests, windows-unit-tests, windows-integration-tests, - build-releasenotes, ] runs-on: ubuntu-latest steps: @@ -1291,15 +1292,24 @@ jobs: name: release_notes_bins path: release_notes_bins + - name: Generate App Token + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + - name: Execute Build Script (Unsigned) if: (!(github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && github.event.ref == 'refs/heads/master')) env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} RELEASE_NOTES_DLL_PATH: ${{ github.workspace }}/release_notes_bins/Tgstation.Server.ReleaseNotes.dll run: sudo -E build/package/deb/build_package.sh - name: Execute Build Script (Signed) if: (github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && github.event.ref == 'refs/heads/master') env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} RELEASE_NOTES_DLL_PATH: ${{ github.workspace }}/release_notes_bins/Tgstation.Server.ReleaseNotes.dll PACKAGING_KEYGRIP: ${{ vars.PACKAGING_KEYGRIP }} run: sudo -E build/package/deb/build_package.sh @@ -1538,7 +1548,16 @@ jobs: name: release_notes_bins path: release_notes_bins + - name: Generate App Token + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + - name: Run ReleaseNotes Check + env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --winget-template-check ${{ steps.get-sha.outputs.pr_template_sha }} ci-completion-gate: @@ -1609,22 +1628,23 @@ jobs: name: release_notes_bins path: release_notes_bins - - name: Generate Release Notes - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_API_VERSION }} --httpapi - - name: Generate App Token - shell: powershell - run: | - dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} - $installSecret = Get-Content ${{ runner.temp }}/installation_secret.txt - echo "INSTALLATION_TOKEN=$installSecret" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append - rm ${{ runner.temp }}/installation_secret.txt + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + + - name: Generate Release Notes + env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} + run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_API_VERSION }} --httpapi - name: Create GitHub Release uses: actions/create-release@v1 id: create_release env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: tag_name: api-v${{ env.TGS_API_VERSION }} release_name: tgstation-server API v${{ env.TGS_API_VERSION }} @@ -1634,7 +1654,7 @@ jobs: - name: Upload OpenApi Spec uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./swagger/tgs_api.json @@ -1680,22 +1700,23 @@ jobs: name: release_notes_bins path: release_notes_bins - - name: Generate Release Notes - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_DM_VERSION }} --dmapi - - name: Generate App Token - shell: powershell - run: | - dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} - $installSecret = Get-Content ${{ runner.temp }}/installation_secret.txt - echo "INSTALLATION_TOKEN=$installSecret" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append - rm ${{ runner.temp }}/installation_secret.txt + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + + - name: Generate Release Notes + env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} + run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_DM_VERSION }} --dmapi - name: Create GitHub Release uses: actions/create-release@v1 id: create_release env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: tag_name: dmapi-v${{ env.TGS_DM_VERSION }} release_name: tgstation-server DMAPI v${{ env.TGS_DM_VERSION }} @@ -1705,7 +1726,7 @@ jobs: - name: Upload DMAPI Artifact uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./DMAPI.zip @@ -1736,7 +1757,16 @@ jobs: name: release_notes_bins path: release_notes_bins + - name: Generate App Token + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + - name: Generate Release Notes + env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --nuget - name: Publish Tgstation.Server.Common to NuGet @@ -1781,7 +1811,16 @@ jobs: name: release_notes_bins path: release_notes_bins + - name: Generate App Token + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + - name: Run ReleaseNotes with --ensure-release + env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --ensure-release ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} deploy-tgs: @@ -1920,22 +1959,23 @@ jobs: name: release_notes_bins path: release_notes_bins - - name: Generate Release Notes - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_VERSION }} - - name: Generate App Token - shell: powershell - run: | - dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} - $installSecret = Get-Content ${{ runner.temp }}/installation_secret.txt - echo "INSTALLATION_TOKEN=$installSecret" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append - rm ${{ runner.temp }}/installation_secret.txt + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + + - name: Generate Release Notes + env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} + run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_VERSION }} - name: Create GitHub Release uses: actions/create-release@v1 id: create_release env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: tag_name: tgstation-server-v${{ env.TGS_VERSION }} release_name: tgstation-server-v${{ env.TGS_VERSION }} @@ -1945,7 +1985,7 @@ jobs: - name: Upload Server Console Artifact uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./ServerConsole.zip @@ -1955,7 +1995,7 @@ jobs: - name: Upload Server Service Artifact uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./ServerService.zip @@ -1965,7 +2005,7 @@ jobs: - name: Upload DMAPI Artifact uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./DMAPI.zip @@ -1975,7 +2015,7 @@ jobs: - name: Upload OpenApi Spec Artifact uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./swagger/tgs_api.json @@ -1985,7 +2025,7 @@ jobs: - name: Upload Server Update Package Artifact uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./ServerUpdatePackage.zip @@ -1995,7 +2035,7 @@ jobs: - name: Upload Debian Pacakaging Artifact uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./packaging-debian/tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz @@ -2005,7 +2045,7 @@ jobs: - name: Upload MariaDB .msi uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/mariadb.msi @@ -2015,7 +2055,7 @@ jobs: - name: Upload Installer .exe uses: actions/upload-release-asset@v1 env: - GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} with: upload_url: ${{ steps.create_release.outputs.upload_url }} asset_path: ./build/package/winget/tgstation-server-installer.exe @@ -2043,7 +2083,16 @@ jobs: name: release_notes_bins path: release_notes_bins + - name: Generate App Token + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + - name: Compile Changelog (Incremental) + env: + TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }} run: | mv $HOME/tgsdox/changelog.yml ./ 2>/dev/null dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --generate-full-notes @@ -2068,7 +2117,7 @@ jobs: echo "Committing..." git diff-index --quiet HEAD || git commit -m "Regenerate changelog post deploy for workflow run ${{ github.run_number }}" -m "Commit: ${{ github.event.head_commit.id }}" echo "Pushing..." - git push -f "https://tgstation-server-ci:${{ env.INSTALLATION_TOKEN }}@github.com/tgstation/tgstation-server" 2>&1 + git push -f "https://tgstation-server-ci:${{ steps.app-token-generation.outputs.token }}@github.com/tgstation/tgstation-server" 2>&1 deploy-docker: name: Deploy TGS (Docker) @@ -2162,6 +2211,8 @@ jobs: shell: powershell run: Sleep 600 - - name: Run ReleaseNotes with --link-winget + - name: Ensure Latest Release is TGS Release + env: + TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }} # Has to be a user here shell: powershell run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --link-winget ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} diff --git a/.github/workflows/ci-security.yml b/.github/workflows/ci-security.yml index 63b4cca6f0..d6ff073d62 100644 --- a/.github/workflows/ci-security.yml +++ b/.github/workflows/ci-security.yml @@ -23,36 +23,47 @@ jobs: permissions: pull-requests: write steps: + - name: Generate App Token + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + - name: Comment on new Fork PR if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared') && github.event.pull_request.user.id != 49699333 uses: thollander/actions-comment-pull-request@1d3973dc4b8e1399c0620d3f2b1aa5e795465308 with: message: Thank you for contributing to ${{ github.event.pull_request.base.repo.name }}! The workflow '${{ github.workflow }}' requires repository secrets and will not run without approval. Maintainers can add the `CI Cleared` label to allow it to run. Note that any changes to ci-security.yml and ci-pipeline.yml will not be reflected. + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} - name: Comment on dependabot PR if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared') && github.event.pull_request.user.id == 49699333 uses: thollander/actions-comment-pull-request@1d3973dc4b8e1399c0620d3f2b1aa5e795465308 with: message: Set the milestone to the next minor version, check for supply chain attacks, and then add the `CI Cleared` label to allow CI to run. + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} - name: "Remove Stale 'CI Cleared' Label" if: github.event.action == 'synchronize' || github.event.action == 'reopened' uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 with: labels: CI Cleared + github_token: ${{ steps.app-token-generation.outputs.token }} - name: "Remove 'CI Approval Required' Label" if: (github.event.action == 'synchronize' || github.event.action == 'reopened') || ((github.event.action == 'opened' || github.event.action == 'labeled') && contains(github.event.pull_request.labels.*.name, 'CI Cleared')) uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 with: labels: CI Approval Required + github_token: ${{ steps.app-token-generation.outputs.token }} - name: "Add 'CI Approval Required' Label" if: (github.event.action == 'synchronize' || github.event.action == 'reopened') || ((github.event.action == 'opened' || github.event.action == 'labeled') && !contains(github.event.pull_request.labels.*.name, 'CI Cleared')) uses: actions-ecosystem/action-add-labels@bd52874380e3909a1ac983768df6976535ece7f8 with: labels: CI Approval Required - github_token: ${{ github.token }} + github_token: ${{ steps.app-token-generation.outputs.token }} - name: Fail if PR has Unlabeled new Commits from User if: (github.event.action == 'synchronize' || github.event.action == 'reopened') || ((github.event.action == 'opened' || github.event.action == 'labeled') && !contains(github.event.pull_request.labels.*.name, 'CI Cleared')) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 8efb0f70f9..28cb384675 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -21,25 +21,14 @@ jobs: runs-on: ubuntu-latest if: github.event.pull_request.user.id == 49699333 steps: - - name: Setup dotnet - uses: actions/setup-dotnet@v4 - with: - dotnet-version: ${{ env.TGS_DOTNET_VERSION }}.0.x - dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} - - - name: Checkout - uses: actions/checkout@v4 - - - name: Build ReleaseNotes - run: dotnet publish -c Release -p:TGS_HOST_NO_WEBPANEL=true -o release_notes_bins tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj - - name: Generate App Token - run: | - dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} - echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV - rm ${{ runner.temp }}/installation_secret.txt + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} - name: Enable Automerge uses: daneden/enable-automerge-action@f8558b65c5b8d8bfb592c4e74e3d491624a38fbd #v1.0.2-ish with: - github-token: ${{ env.INSTALLATION_TOKEN }} + github-token: ${{ steps.app-token-generation.outputs.token }} diff --git a/.github/workflows/size-label.yml b/.github/workflows/size-label.yml index 0d0e503813..69b51c5e52 100644 --- a/.github/workflows/size-label.yml +++ b/.github/workflows/size-label.yml @@ -14,7 +14,14 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - name: size-label - uses: "pascalgn/size-label-action@bbbaa0d5ccce8e2e76254560df5c64b82dac2e12" # v0.5.2, consider upgrading after https://github.com/pascalgn/size-label-action/pull/54 is merged + - name: Generate App Token + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} + + - name: Run Labeller + uses: pascalgn/size-label-action@bbbaa0d5ccce8e2e76254560df5c64b82dac2e12 env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} diff --git a/.github/workflows/stable-merge.yml b/.github/workflows/stable-merge.yml index 44ab924be9..8c0cc72c2b 100644 --- a/.github/workflows/stable-merge.yml +++ b/.github/workflows/stable-merge.yml @@ -15,36 +15,18 @@ jobs: name: Master Merge runs-on: ubuntu-latest steps: - - name: Setup dotnet - uses: actions/setup-dotnet@v4 - with: - dotnet-version: ${{ env.TGS_DOTNET_VERSION }}.0.x - dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} - - - name: Build Checkout - uses: actions/checkout@v4 - with: - path: temp_workspace - - - name: Build ReleaseNotes - run: | - cd temp_workspace - dotnet build -c Release -p:TGS_HOST_NO_WEBPANEL=true tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj - - name: Generate App Token - run: | - cd temp_workspace - dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} - echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV - rm ${{ runner.temp }}/installation_secret.txt - env: - TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }} + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} - - name: Main Checkout + - name: Checkout uses: actions/checkout@v4 with: fetch-depth: 0 - token: ${{ env.INSTALLATION_TOKEN }} + token: ${{ steps.app-token-generation.outputs.token }} - name: Merge master into dev uses: robotology/gh-action-nightly-merge@14b4a4cf358f7479aa708bee05cf8a794d6a2516 #v1.5.0 @@ -57,4 +39,4 @@ jobs: user_email: 161980869+tgstation-server-ci[bot]@users.noreply.github.com push_token: INSTALLATION_TOKEN env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }} diff --git a/.github/workflows/update-ss13-org-mirror.yml b/.github/workflows/update-ss13-org-mirror.yml index 9059330071..eb97122843 100644 --- a/.github/workflows/update-ss13-org-mirror.yml +++ b/.github/workflows/update-ss13-org-mirror.yml @@ -21,37 +21,19 @@ jobs: name: Fork Sync runs-on: ubuntu-latest steps: - - name: Setup dotnet - uses: actions/setup-dotnet@v4 - with: - dotnet-version: ${{ env.TGS_DOTNET_VERSION }}.0.x - dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} - - - name: Build Checkout - uses: actions/checkout@v4 - with: - path: temp_workspace - - - name: Build ReleaseNotes - run: | - cd temp_workspace - dotnet build -c Release -p:TGS_HOST_NO_WEBPANEL=true tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj - - name: Generate App Token - run: | - cd temp_workspace - dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} --spacestation13 - echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV - rm ${{ runner.temp }}/installation_secret.txt - env: - TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }} + id: app-token-generation + uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc + with: + app_id: ${{ secrets.APP_ID }} + private_key: ${{ secrets.APP_PRIVATE_KEY }} - - name: Main Checkout + - name: Checkout uses: actions/checkout@v4 with: fetch-depth: 0 fetch-tags: true - token: ${{ env.INSTALLATION_TOKEN }} + token: ${{ steps.app-token-generation.outputs.token }} - name: Build ReleaseNotes run: dotnet build -c Release -p:TGS_HOST_NO_WEBPANEL=true tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj @@ -68,5 +50,5 @@ jobs: run: | git config user.name "tgstation-server-ci[bot]" git config user.email "161980869+tgstation-server-ci[bot]@users.noreply.github.com" - git push "https://tgstation-server-ci:${{ env.INSTALLATION_TOKEN }}@github.com/spacestation13/tgstation-server" - git push --tags "https://tgstation-server-ci:${{ env.INSTALLATION_TOKEN }}@github.com/spacestation13/tgstation-server" + git push "https://tgstation-server-ci:${{ steps.app-token-generation.outputs.token }}@github.com/spacestation13/tgstation-server" + git push --tags "https://tgstation-server-ci:${{ steps.app-token-generation.outputs.token }}@github.com/spacestation13/tgstation-server" diff --git a/tools/Tgstation.Server.ReleaseNotes/Program.cs b/tools/Tgstation.Server.ReleaseNotes/Program.cs index 46c887fd5f..5ab07e4906 100644 --- a/tools/Tgstation.Server.ReleaseNotes/Program.cs +++ b/tools/Tgstation.Server.ReleaseNotes/Program.cs @@ -59,15 +59,13 @@ namespace Tgstation.Server.ReleaseNotes var shaCheck = versionString.Equals("--winget-template-check", StringComparison.OrdinalIgnoreCase); var fullNotes = versionString.Equals("--generate-full-notes", StringComparison.OrdinalIgnoreCase); var nuget = versionString.Equals("--nuget", StringComparison.OrdinalIgnoreCase); - var genToken = versionString.Equals("--token-output-file", StringComparison.OrdinalIgnoreCase); if ((!Version.TryParse(versionString, out var version) || version.Revision != -1) && !ensureRelease && !linkWinget && !shaCheck && !fullNotes - && !nuget - && !genToken) + && !nuget) { Console.WriteLine("Invalid version: " + versionString); return 2; @@ -109,51 +107,23 @@ namespace Tgstation.Server.ReleaseNotes } var client = new GitHubClient(new Octokit.ProductHeaderValue("tgs_release_notes")); + const string ReleaseNotesEnvVar = "TGS_RELEASE_NOTES_TOKEN"; + var githubToken = Environment.GetEnvironmentVariable(ReleaseNotesEnvVar); + if (String.IsNullOrWhiteSpace(githubToken) && !doNotCloseMilestone && !ensureRelease) + { + Console.WriteLine("Missing " + ReleaseNotesEnvVar + " environment variable!"); + return 3; + } + + if (!String.IsNullOrWhiteSpace(githubToken)) + { + client.Credentials = new Credentials(githubToken); + } + try { if (ensureRelease) - { - if (args.Length < 2) - { - Console.WriteLine("Missing PEM Base64 for updating release!"); - return 454233; - } - - await GenerateAppCredentials(client, args[1], false); - return await EnsureRelease(client); - } - - if (genToken) - { - if (args.Length < 3) - { - Console.WriteLine("Missing output file path or PEM Base64 for app authentication!"); - return 33847; - } - - bool toSS13 = args.Length > 3 && args[3].Equals("--spacestation13", StringComparison.OrdinalIgnoreCase); - await GenerateAppCredentials(client, args[2], toSS13); - - var token = client.Credentials.GetToken(); - var destPath = args[1]; - Directory.CreateDirectory(Path.GetDirectoryName(destPath)); - await File.WriteAllTextAsync(destPath, token); - return 0; - } - - const string ReleaseNotesEnvVar = "TGS_RELEASE_NOTES_TOKEN"; - var githubToken = Environment.GetEnvironmentVariable(ReleaseNotesEnvVar); - if (String.IsNullOrWhiteSpace(githubToken) && !doNotCloseMilestone && !ensureRelease) - { - Console.WriteLine("Missing " + ReleaseNotesEnvVar + " environment variable!"); - return 3; - } - - if (!String.IsNullOrWhiteSpace(githubToken)) - { - client.Credentials = new Credentials(githubToken); - } if (linkWinget) { @@ -1627,41 +1597,6 @@ package (version) distribution(s); urgency=urgency return 0; } - static async ValueTask GenerateAppCredentials(GitHubClient gitHubClient, string pemBase64, bool toSS13) - { - var pemBytes = Convert.FromBase64String(pemBase64); - var pem = Encoding.UTF8.GetString(pemBytes); - - var rsa = RSA.Create(); - rsa.ImportFromPem(pem); - - var signingCredentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256); - var jwtSecurityTokenHandler = new JwtSecurityTokenHandler { SetDefaultTimesOnTokenCreation = false }; - - var now = DateTime.UtcNow; - - var jwt = jwtSecurityTokenHandler.CreateToken(new SecurityTokenDescriptor - { - Issuer = AppId.ToString(), - Expires = now.AddMinutes(10), - IssuedAt = now, - SigningCredentials = signingCredentials - }); - - var jwtStr = jwtSecurityTokenHandler.WriteToken(jwt); - - gitHubClient.Credentials = new Credentials(jwtStr, AuthenticationType.Bearer); - - var installation = await gitHubClient.GitHubApps.GetRepositoryInstallationForCurrent( - toSS13 - ? "spacestation13" - : RepoOwner, - RepoName); - var installToken = await gitHubClient.GitHubApps.CreateInstallationToken(installation.Id); - - gitHubClient.Credentials = new Credentials(installToken.Token); - } - static void DebugAssert(bool condition, string message = null) { // This exists because one of the fucking asserts evaluates an enumerable or something and it was getting optimized out in release