Merge remote-tracking branch 'origin/main' into gh-issue52238

.github/dependabot.yml

@@ -0,0 +1,10 @@
+# Copyright VMware, Inc.
+# SPDX-License-Identifier: APACHE-2.0
+
+version: 2
+# Check for updates to GitHub Actions every week
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/assign-asset-label.yml

@@ -1,3 +1,6 @@
+# Copyright VMware, Inc.
+# SPDX-License-Identifier: APACHE-2.0
+
 name: '[Support] Assign asset label'
 on:
   pull_request_target:
@@ -34,7 +37,7 @@ jobs:
             echo "name=${assets}" >> $GITHUB_OUTPUT
           fi
       - name: Show messages
-        uses: actions/github-script@v6
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         with:
           script: |
             if ("${{ steps.get-asset.outputs.result }}" != "ok" ) {
@@ -44,6 +47,6 @@ jobs:
             }
       - name: Labeling
         if: ${{ steps.get-asset.outputs.result == 'ok' }}
-        uses: fmulero/labeler@1.1.0
+        uses: fmulero/labeler@d3ef0aadb212cd1656bd6d5ce1e772787bf1682b
         with:
           add-labels: "${{ steps.get-asset.outputs.name }}"

.github/workflows/ci-pipeline.yml

@@ -8,57 +8,15 @@ on: # rebuild any PRs and main branch changes
       - main
       - bitnami:main
 permissions: {}
-env:
-  CSP_API_URL: https://console.cloud.vmware.com
-  CSP_API_TOKEN: ${{ secrets.CSP_API_TESTING_TOKEN }}
-  VIB_PUBLIC_URL: https://cp.bromelia.vmware.com
 # Avoid concurrency over the same PR
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
 jobs:
-  license-headers-linter:
-    runs-on: ubuntu-latest
-    name: License Headers Linter
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v3
-        name: Checkout Repository
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-      - id: get-modified-files
-        name: 'Get modified files'
-        env:
-          DIFF_URL: "${{github.event.pull_request.diff_url}}"
-          TEMP_FILE: "${{runner.temp}}/pr-${{github.event.number}}.diff"
-        run: |
-          # This request doesn't consume API calls.
-          curl -Lkso $TEMP_FILE $DIFF_URL
-          files_changed="$(sed -nr 's/[\-\+]{3} [ab]\/(.*)/\1/p' $TEMP_FILE | sort | uniq)"
-          dockerfiles=()
-          while read -r file_changed; do
-            # Avoid removed files
-            if [[ -f "${file_changed}" ]]; then
-              dockerfiles+=("${file_changed}")
-            fi
-          done <<< "$(echo "$files_changed" | grep -oE ".*/Dockerfile$" | sort | uniq || true)"
-          if [[ ${#dockerfiles[@]} -gt 0 ]]; then
-            # There are modifications on dockerfiles
-            export dockerfiles_json=$(printf "%s\n" "${dockerfiles[@]}" | jq -R . | jq -cs .)
-            # Overwrite configuration file to analyze only changed dockerfiles
-            yq -i '. | .header.paths=env(dockerfiles_json)' .licenserc.yaml
-            echo "result=success" >> $GITHUB_OUTPUT
-          else
-            echo "result=skip" >> $GITHUB_OUTPUT
-          fi
-      - name: Check license Headers
-        uses: apache/skywalking-eyes/header@v0.4.0
-        if: ${{ steps.get-modified-files.outputs.result == 'success' }}
   get-containers:
     runs-on: ubuntu-latest
     name: Get modified containers
+    permissions:
+      pull-requests: read
     if: |
       github.event.pull_request.state != 'closed' &&
       (
@@ -67,20 +25,20 @@ jobs:
     outputs:
       result: ${{ steps.get-containers.outputs.result }}
       containers: ${{ steps.get-containers.outputs.containers }}
+      dockerfiles: ${{ steps.get-containers.outputs.dockerfiles }}
     steps:
       - id: get-containers
         name: Get modified containers
         env:
-          DIFF_URL: "${{github.event.pull_request.diff_url}}"
-          TEMP_FILE: "${{runner.temp}}/pr-${{github.event.number}}.diff"
+          PULL_REQUEST_NUMBER: "${{ github.event.pull_request.number }}"
+          GITHUB_TOKEN: "${{ github.token }}"
         run: |
-          # This request doesn't consume API calls.
-          curl -Lkso $TEMP_FILE $DIFF_URL
-          files_changed="$(sed -nr 's/[\-\+]{3} [ab]\/(.*)/\1/p' $TEMP_FILE | sort | uniq)"
+          files_changed="$(gh api --paginate /repos/${GITHUB_REPOSITORY}/pulls/${PULL_REQUEST_NUMBER}/files | jq -r '.[] | .filename')"
           # Adding || true to avoid "Process exited with code 1" errors
           flavors=($(echo "$files_changed" | xargs dirname | grep -o "^bitnami/[^/]*/[^/]*/[^/]*" | sort | uniq || true))
           assets=($(echo "$files_changed" | xargs dirname | sed -nr "s|bitnami/([^/]*)/.*|\1|p" | sort | uniq || true))
           non_readme_files=$(echo "$files_changed" | grep -vc "\.md" || true)
+          dockerfiles=($(echo "$files_changed" | grep -oE ".*/Dockerfile$" | sort | uniq || true))
 
           if [[ "$non_readme_files" -le "0" ]]; then
             # The only changes are .md files -> SKIP
@@ -90,9 +48,39 @@ jobs:
             echo "result=skip" >> $GITHUB_OUTPUT
           else
             containers_json=$(printf "%s\n" "${flavors[@]}" | jq -R . | jq -cs .)
+            dockerfiles_json=$(printf "%s\n" "${dockerfiles[@]}" | jq -R . | jq -cs .)
             echo "result=ok" >> $GITHUB_OUTPUT
             echo "containers=${containers_json}" >> $GITHUB_OUTPUT
+            echo "dockerfiles=${dockerfiles_json}" >> $GITHUB_OUTPUT
           fi
+  license-headers-linter:
+    runs-on: ubuntu-latest
+    name: License Headers Linter
+    permissions:
+      contents: read
+      pull-requests: write
+    needs: get-containers
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+        name: Checkout Repository
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+      - id: get-modified-files
+        name: 'Get modified files'
+        env:
+          DOCKERFILES: "${{ needs.get-containers.outputs.dockerfiles }}"
+        run: |
+          if [[ -n "${DOCKERFILES}" ]]; then
+            # Overwrite configuration file to analyze only changed dockerfiles
+            yq -i '. | .header.paths=env(DOCKERFILES)' .licenserc.yaml
+            echo "result=success" >> $GITHUB_OUTPUT
+          else
+            echo "result=skip" >> $GITHUB_OUTPUT
+          fi
+      - name: Check license Headers
+        uses: apache/skywalking-eyes/header@6b2529214f6b1ccee3ec92bb0adfeabf6f66f538
+        if: ${{ steps.get-modified-files.outputs.result == 'success' }}
   vib-verify:
     runs-on: ubuntu-latest
     needs: get-containers
@@ -103,14 +91,18 @@ jobs:
     name: VIB Verify
     permissions: 
       contents: read
+    env:
+      CSP_API_URL: https://console.cloud.vmware.com
+      CSP_API_TOKEN: ${{ secrets.CSP_API_TESTING_TOKEN }}
+      VIB_PUBLIC_URL: https://cp.bromelia.vmware.com
     continue-on-error: false
     strategy:
       fail-fast: false
       max-parallel: 2
       matrix:
         container: ${{ fromJSON(needs.get-containers.outputs.containers) }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
         name: Checkout Repository
         with:
           # Full history is not required anymore
@@ -174,7 +166,7 @@ jobs:
     steps:
       - id: get-status
         name: Check Status
-        uses: actions/github-script@v6
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         with:
           result-encoding: string
           script: |
@@ -224,12 +216,20 @@ jobs:
       # Approve the CI's PR automatically, as it has been tested in our internal pipeline already
       # Approved by the 'github-actions' user; a PR can't be approved by its author
       - name: PR Approval
-        uses: hmarr/auto-approve-action@v3.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         with:
-          pull-request-number: ${{ github.event.number }}
+          result-encoding: string
+          retries: 3
+          script: |
+            github.rest.pulls.createReview({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+              event: 'APPROVE',
+            });
       - name: Merge
         id: merge
-        uses: actions/github-script@v6
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         with:
           result-encoding: string
           retries: 3
@@ -246,10 +246,18 @@ jobs:
       # post a comment on the PR and assign a maintainer agent to review it
       - name: Manual review required
         if: ${{ always() && steps.merge.outcome != 'success' }}
-        uses: peter-evans/create-or-update-comment@v3.0.0
-        with:
-          issue-number: ${{ github.event.number }}
-          # Necessary to trigger support workflows
-          token: ${{ secrets.BITNAMI_BOT_TOKEN }}
-          body: |
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
+        env:
+          BODY: |
             There has been an error during the automated release process. Manual revision is now required.
+            Please check the related [action_run#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more information.
+        with:
+          retries: 3
+          script: |
+            const {BODY} = process.env
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `${BODY}`
+            })

.github/workflows/clossing-issues.yml

@@ -1,5 +1,9 @@
+# Copyright VMware, Inc.
+# SPDX-License-Identifier: APACHE-2.0
+
 name: '[Support] Close Solved issues'
 on:
+  workflow_dispatch:
   schedule:
     # Hourly
     - cron: '0 * * * *'
@@ -9,7 +13,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v6.0.1
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e
         with:
           any-of-labels: 'solved'
           stale-issue-label: 'solved'

.github/workflows/comments.yml

@@ -1,54 +1,19 @@
+# Copyright VMware, Inc.
+# SPDX-License-Identifier: APACHE-2.0
+
 name: '[Support] Comments based card movements'
 on:
   issue_comment:
     types:
       - created
-# Remove all permissions by default
-permissions: {}
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
 # Avoid concurrency over the same issue
 concurrency:
   group: card-movement-${{ github.event.issue.number }}
 jobs:
-  comments_handler:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      repository-projects: write
-      issues: read
-      pull-requests: read
-    steps:
-      - name: Repo checkout
-        uses: actions/checkout@v3
-      - name: Load .env file
-        uses: xom9ikk/dotenv@v2
-        with:
-          path: .github/workflows/
-      - name: Move into Pending
-        uses: peter-evans/create-or-update-project-card@v2
-        if: |
-          (github.actor != 'bitnami-bot' || github.event.issue.user.login != 'bitnami-bot' || github.event.issue.pull_request == null) &&
-          contains(fromJson(env.BITNAMI_TEAM), github.actor) &&
-          (!contains(github.event.issue.labels.*.name, 'bitnami'))
-        with:
-          project-name: Support
-          column-name: Pending
-      - name: Move into In Progress
-        uses: peter-evans/create-or-update-project-card@v2
-        if: |
-          (github.actor != 'bitnami-bot' || github.event.issue.user.login != 'bitnami-bot' || github.event.issue.pull_request == null) &&
-          (!contains(fromJson(env.BITNAMI_TEAM), github.actor)) &&
-          contains(github.event.issue.labels.*.name, 'in-progress')
-        with:
-          project-name: Support
-          column-name: In progress
-      - name: Move into Triage
-        uses: peter-evans/create-or-update-project-card@v2
-        if: |
-          (github.actor != 'bitnami-bot' || github.event.issue.user.login != 'bitnami-bot' || github.event.issue.pull_request == null) &&
-          (!contains(fromJson(env.BITNAMI_TEAM), github.actor)) &&
-          (!contains(github.event.issue.labels.*.name, 'in-progress'))
-        with:
-          project-name: Support
-          column-name: Triage
-          # Needs reasignation of the task
-          token: "${{ secrets.BITNAMI_BOT_TOKEN }}"
+  call-comments-workflow:
+    uses: bitnami/support/.github/workflows/comment-created.yml@main
+    secrets: inherit