Skip to content

Commit 4b8d3b6

Browse files
galarghgalargh
committed
upgrade@5002898167
1 parent 2480589 commit 4b8d3b6

21 files changed

Lines changed: 371 additions & 49 deletions

‎.github/workflows/apply.yml‎

Lines changed: 7 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -27,34 +27,16 @@ jobs:
2727
- name: Discover workspaces
2828
id: workspaces
2929
run: echo "this=$(ls github | jq --raw-input '[.[0:-4]]' | jq -sc add)" >> $GITHUB_OUTPUT
30+
- run: npm ci && npm run build
31+
working-directory: scripts
3032
- name: Find sha for plan
3133
id: sha
3234
env:
33-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34-
QUERY: repository:${{ github.repository }} ${{ github.sha }}
35-
uses: actions/github-script@v6
36-
with:
37-
result-encoding: string
38-
script: |
39-
if (process.env.GITHUB_EVENT_NAME === 'push') {
40-
const { data: search } = await github.rest.search.issuesAndPullRequests({
41-
q: process.env.QUERY,
42-
per_page: 1
43-
});
44-
if (search.total_count !== 0) {
45-
const { data: pulls } = await github.rest.pulls.listCommits({
46-
owner: process.env.GITHUB_REPOSITORY_OWNER,
47-
repo: process.env.GITHUB_REPOSITORY.slice(process.env.GITHUB_REPOSITORY_OWNER.length + 1),
48-
pull_number: search.items[0].number,
49-
per_page: 100
50-
});
51-
return pulls.at(-1).sha;
52-
} else {
53-
return '';
54-
}
55-
} else {
56-
return process.env.GITHUB_SHA;
57-
}
35+
GITHUB_APP_ID: ${{ secrets.RW_GITHUB_APP_ID }}
36+
GITHUB_APP_INSTALLATION_ID: ${{ secrets[format('RW_GITHUB_APP_INSTALLATION_ID_{0}', matrix.workspace)] || secrets.RW_GITHUB_APP_INSTALLATION_ID }}
37+
GITHUB_APP_PEM_FILE: ${{ secrets.RW_GITHUB_APP_PEM_FILE }}
38+
run: node lib/actions/find-sha-for-plan.js
39+
working-directory: scripts
5840
apply:
5941
needs: [prepare]
6042
if: needs.prepare.outputs.sha != '' && needs.prepare.outputs.workspaces != ''

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1818
- shared config fix rule which adds missing default branch protections
1919
- shared action for adding a file to all repositories
2020
- shared action for adding a label to all repositories
21+
- issue_label support
22+
- new args for repositories and branch protection rules
2123

2224
### Changed
2325
- Synchronization script: to use GitHub API directly instead of relying on TF GH Provider's Data Sources
@@ -40,6 +42,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
4042
- workflows: not to use deprecated GitHub Actions runners anymore
4143
- workflows: not to use deprecated GitHub Actions expressions anymore
4244
- tf: to prevent destroy of membership and repository resources
45+
- apply: find sha for plan using proper credentials
4346

4447
### Fixed
4548
- links to supported resources in HOWTOs

‎docs/ABOUT.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ Running the `Sync` GitHub Action workflows refreshes the underlying terraform st
4747
- [github_team_repository](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_repository)
4848
- [github_team_membership](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_membership)
4949
- [github_repository_file](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file)
50+
- [github_issue_label](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/issue_label)
5051

5152
# Config Fix Rules
5253

‎docs/SETUP.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66

77
## GitHub Organization
88

9-
- [ ] [Set base permissions for the organization](https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/setting-base-permissions-for-an-organization) to `Read` or `None` not to make all organization members de-facto admins through GitHub Management - `gh -X PATCH /orgs/$GITHUB_ORGANIZATION -f default_repository_permission=read`
10-
- [ ] If you plan to keep the GitHub Management repository private, [allow forking of private repositories](https://docs.github.com/en/organizations/managing-organization-settings/managing-the-forking-policy-for-your-organization) and [enable workflows for private repository forks](https://docs.github.com/en/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks) - `gh -X PATCH /orgs/$GITHUB_ORGANIZATION -f members_can_fork_private_repositories=true` (enabling workflows for private repository forks is not possible through API)
9+
- [ ] [Set base permissions for the organization](https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/setting-base-permissions-for-an-organization) to `Read` or `None` not to make all organization members de-facto admins through GitHub Management - `gh api -X PATCH /orgs/$GITHUB_ORGANIZATION -f default_repository_permission=read`
10+
- [ ] If you plan to keep the GitHub Management repository private, [allow forking of private repositories](https://docs.github.com/en/organizations/managing-organization-settings/managing-the-forking-policy-for-your-organization) and [enable workflows for private repository forks](https://docs.github.com/en/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks) - `gh api -X PATCH /orgs/$GITHUB_ORGANIZATION -f members_can_fork_private_repositories=true` (enabling workflows for private repository forks is not possible through API)
1111

1212
## AWS
1313

‎scripts/__tests__/__resources__/github/default.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ members:
44
- laurentsenta
55
repositories:
66
github-action-releaser:
7+
advanced_security: false
78
allow_auto_merge: false
89
allow_merge_commit: true
910
allow_rebase_merge: true
@@ -18,12 +19,22 @@ repositories:
1819
has_projects: true
1920
has_wiki: true
2021
is_template: false
22+
labels:
23+
topic dx:
24+
color: '#57cc2c'
25+
description: Topic DX
26+
topic/ci:
27+
color: '#57cc2c'
28+
description: Topic CI
29+
secret_scanning_push_protection: false
30+
secret_scanning: false
2131
teams:
2232
maintain:
2333
- ipdx
2434
visibility: public
2535
vulnerability_alerts: false
2636
github-mgmt:
37+
advanced_security: false
2738
allow_auto_merge: false
2839
allow_merge_commit: true
2940
allow_rebase_merge: true
@@ -61,6 +72,8 @@ repositories:
6172
has_projects: false
6273
has_wiki: false
6374
is_template: false
75+
secret_scanning_push_protection: false
76+
secret_scanning: false
6477
teams:
6578
triage:
6679
- ipdx
@@ -70,6 +83,7 @@ repositories:
7083
visibility: public
7184
vulnerability_alerts: false
7285
ipdx:
86+
advanced_security: false
7387
allow_auto_merge: false
7488
allow_merge_commit: true
7589
allow_rebase_merge: true
@@ -83,12 +97,15 @@ repositories:
8397
has_projects: true
8498
has_wiki: true
8599
is_template: false
100+
secret_scanning_push_protection: false
101+
secret_scanning: false
86102
teams:
87103
admin:
88104
- ipdx
89105
visibility: public
90106
vulnerability_alerts: false
91107
projects-migration:
108+
advanced_security: false
92109
allow_auto_merge: false
93110
allow_merge_commit: true
94111
allow_rebase_merge: true
@@ -106,6 +123,8 @@ repositories:
106123
source:
107124
branch: main
108125
path: /docs
126+
secret_scanning_push_protection: false
127+
secret_scanning: false
109128
teams:
110129
maintain:
111130
- ipdx
@@ -115,6 +134,7 @@ repositories:
115134
visibility: public
116135
vulnerability_alerts: false
117136
projects-status-history:
137+
advanced_security: false
118138
allow_auto_merge: false
119139
allow_merge_commit: true
120140
allow_rebase_merge: true
@@ -128,12 +148,19 @@ repositories:
128148
has_projects: true
129149
has_wiki: true
130150
is_template: false
151+
labels:
152+
stale:
153+
color: '#57cc2c'
154+
description: Stale
155+
secret_scanning_push_protection: false
156+
secret_scanning: false
131157
teams:
132158
maintain:
133159
- ipdx
134160
visibility: public
135161
vulnerability_alerts: false
136162
rust-sccache-action:
163+
advanced_security: false
137164
allow_auto_merge: false
138165
allow_merge_commit: true
139166
allow_rebase_merge: true
@@ -147,12 +174,15 @@ repositories:
147174
has_projects: true
148175
has_wiki: true
149176
is_template: false
177+
secret_scanning_push_protection: false
178+
secret_scanning: false
150179
teams:
151180
maintain:
152181
- ipdx
153182
visibility: public
154183
vulnerability_alerts: true
155184
tf-aws-gh-runner:
185+
advanced_security: false
156186
allow_auto_merge: false
157187
allow_merge_commit: true
158188
allow_rebase_merge: true
@@ -166,6 +196,8 @@ repositories:
166196
has_projects: true
167197
has_wiki: true
168198
is_template: false
199+
secret_scanning_push_protection: false
200+
secret_scanning: false
169201
teams:
170202
maintain:
171203
- ipdx

‎scripts/__tests__/__resources__/terraform/locals_override.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ locals {
77
"github_team_repository",
88
"github_team",
99
"github_branch_protection",
10-
"github_repository_file"
10+
"github_repository_file",
11+
"github_issue_label"
1112
]
1213
}

‎scripts/__tests__/__resources__/terraform/resources.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,8 @@ resource "github_repository_file" "this" {
3838
ignore_changes = []
3939
}
4040
}
41+
resource "github_issue_label" "this" {
42+
lifecycle {
43+
ignore_changes = []
44+
}
45+
}

‎scripts/__tests__/__resources__/terraform/terraform.tfstate‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2053,6 +2053,66 @@
20532053
"github_repository.this",
20542054
"github_team.this"
20552055
]
2056+
},
2057+
{
2058+
"address": "github_issue_label.this[\"github-action-releaser:topic/ci\"]",
2059+
"mode": "managed",
2060+
"type": "github_issue_label",
2061+
"name": "this",
2062+
"index": "github-action-releaser:topic/ci",
2063+
"provider_name": "registry.terraform.io/integrations/github",
2064+
"schema_version": 0,
2065+
"values": {
2066+
"repository": "github-action-releaser",
2067+
"name": "topic/ci",
2068+
"color": "#57cc2c",
2069+
"description": "Topic CI",
2070+
"url": "https://github.com/pl-strflt/github-action-releaser/labels/topic%2Fci"
2071+
},
2072+
"sensitive_values": {},
2073+
"depends_on": [
2074+
"github_repository.this"
2075+
]
2076+
},
2077+
{
2078+
"address": "github_issue_label.this[\"github-action-releaser:topic dx\"]",
2079+
"mode": "managed",
2080+
"type": "github_issue_label",
2081+
"name": "this",
2082+
"index": "github-action-releaser:topic dx",
2083+
"provider_name": "registry.terraform.io/integrations/github",
2084+
"schema_version": 0,
2085+
"values": {
2086+
"repository": "github-action-releaser",
2087+
"name": "topic dx",
2088+
"color": "#57cc2c",
2089+
"description": "Topic DX",
2090+
"url": "https://github.com/pl-strflt/github-action-releaser/labels/topic%20dx"
2091+
},
2092+
"sensitive_values": {},
2093+
"depends_on": [
2094+
"github_repository.this"
2095+
]
2096+
},
2097+
{
2098+
"address": "github_issue_label.this[\"projects-status-history:stale\"]",
2099+
"mode": "managed",
2100+
"type": "github_issue_label",
2101+
"name": "this",
2102+
"index": "projects-status-history:stale",
2103+
"provider_name": "registry.terraform.io/integrations/github",
2104+
"schema_version": 0,
2105+
"values": {
2106+
"repository": "projects-status-history",
2107+
"name": "stale",
2108+
"color": "#57cc2c",
2109+
"description": "Stale",
2110+
"url": "https://github.com/pl-strflt/projects-status-history/labels/stale"
2111+
},
2112+
"sensitive_values": {},
2113+
"depends_on": [
2114+
"github_repository.this"
2115+
]
20562116
}
20572117
]
20582118
}

‎scripts/__tests__/yaml/config.test.ts‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -350,8 +350,10 @@ members:
350350
- paul
351351
- Peter
352352
repositories:
353-
a: {}
354-
b: {}
353+
a:
354+
{}
355+
b:
356+
{}
355357
C:
356358
description: "c"
357359
`.trim()

‎scripts/jest.setup.ts‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import {RepositoryBranchProtectionRule} from './src/resources/repository-branch-
77
import {RepositoryTeam} from './src/resources/repository-team'
88
import {TeamMember} from './src/resources/team-member'
99
import {RepositoryFile} from './src/resources/repository-file'
10+
import {RepositoryLabel} from './src/resources/repository-label'
1011
import {GitHub} from './src/github'
1112

1213
jest.mock('./src/env', () => ({
@@ -51,6 +52,9 @@ GitHub.github = {
5152
},
5253
listTeamInvitations: async () => {
5354
return [] as any // eslint-disable-line @typescript-eslint/no-explicit-any
55+
},
56+
listRepositoryLabels: async () => {
57+
return [] as any // eslint-disable-line @typescript-eslint/no-explicit-any
5458
}
5559
} as GitHub
5660

@@ -62,7 +66,8 @@ global.ResourceCounts = {
6266
[RepositoryBranchProtectionRule.name]: 1,
6367
[RepositoryTeam.name]: 7,
6468
[TeamMember.name]: 2,
65-
[RepositoryFile.name]: 1
69+
[RepositoryFile.name]: 1,
70+
[RepositoryLabel.name]: 3
6671
}
6772
global.ResourcesCount = Object.values(global.ResourceCounts).reduce(
6873
(a, b) => a + b,

0 commit comments

Comments
 (0)