mirror of
https://github.com/gradle/actions.git
synced 2026-11-13 18:24:01 +00:00
Inaki Villar
8e84bbf095
The npm builds and the demo job summary used the long-lived DV_SOLUTIONS_ACCESS_KEY. They now mint a GitHub OIDC token for solutions.develocity.cloud. The npm agent reads DEVELOCITY_ACCESS_KEY directly, so for it the token is exchanged for a short-lived Develocity access token first. Signed-off-by: Inaki Villar <[email protected]>
102 lines
3.8 KiB
YAML
102 lines
3.8 KiB
YAML
name: CI-update-dist
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- 'main'
|
|
- 'prerelease/**'
|
|
- 'release/**'
|
|
paths-ignore:
|
|
- 'dist/**'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
update-dist:
|
|
# Only run for the Gradle repository; otherwise when users create pull requests from their `main` branch
|
|
# it would erroneously update `dist` on their branch (and the pull request)
|
|
if: github.repository == 'gradle/actions'
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
token: ${{ secrets.BOT_GITHUB_TOKEN }}
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 24
|
|
cache: npm
|
|
cache-dependency-path: sources/package-lock.json
|
|
|
|
- name: Install Develocity npm agent
|
|
run: |
|
|
npm exec -y -- pacote extract @gradle-tech/[email protected] ~/.node_libraries/@gradle-tech/develocity-agent
|
|
|
|
- name: Get GitHub OIDC token for Develocity
|
|
id: develocity-oidc
|
|
shell: bash
|
|
run: |
|
|
if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
|
|
echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
|
|
exit 0
|
|
fi
|
|
token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
|
|
--data-urlencode "audience=https://solutions.develocity.cloud" \
|
|
"$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
|
|
echo "::add-mask::$token"
|
|
# Exchange the OIDC token for a short-lived Develocity access token, for the Develocity npm agent that reads DEVELOCITY_ACCESS_KEY directly
|
|
access_token=$(curl -sSf --retry 3 -X POST -H "Authorization: Bearer $token" \
|
|
"https://solutions.develocity.cloud/api/auth/token?expiresInHours=2")
|
|
echo "::add-mask::$access_token"
|
|
echo "token-access-key=solutions.develocity.cloud=$access_token" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Install npm dependencies
|
|
run: |
|
|
npm clean-install
|
|
working-directory: sources
|
|
env:
|
|
NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
|
|
DEVELOCITY_ACCESS_KEY: '${{ steps.develocity-oidc.outputs.token-access-key }}'
|
|
|
|
- name: Build distribution
|
|
run: |
|
|
npm run check
|
|
npm run compile
|
|
working-directory: sources
|
|
env:
|
|
NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
|
|
DEVELOCITY_URL: 'https://solutions.develocity.cloud'
|
|
DEVELOCITY_ACCESS_KEY: '${{ steps.develocity-oidc.outputs.token-access-key }}'
|
|
|
|
- name: Copy the generated sources/dist directory to the top-level dist
|
|
run: |
|
|
cp -r sources/dist .
|
|
|
|
- name: Import GPG key to sign commits
|
|
uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
|
|
with:
|
|
gpg_private_key: ${{ secrets.GH_BOT_PGP_PRIVATE_KEY }}
|
|
passphrase: ${{ secrets.GH_BOT_PGP_PASSPHRASE }}
|
|
git_user_signingkey: true
|
|
git_commit_gpgsign: true
|
|
git_config_global: true
|
|
|
|
# Commit and push changes; has no effect if the files did not change
|
|
# Important: The push event will not trigger any other workflows, see
|
|
# https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#commits-made-by-this-action-do-not-trigger-new-workflow-runs
|
|
- name: Commit & push changes
|
|
uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
|
|
with:
|
|
commit_author: bot-githubaction <[email protected]>
|
|
commit_user_name: bot-githubaction
|
|
commit_user_email: [email protected]
|
|
commit_message: '[bot] Update dist directory'
|
|
file_pattern: dist
|