Skip to content

github: use mimir-github-bot to auto-merge weekly helm releases #11013

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 23, 2025
Merged

github: use mimir-github-bot to auto-merge weekly helm releases #11013

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions .github/workflows/helm-weekly-release-pr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,15 @@ on:

workflow_dispatch: # for manual testing

# These permissions are needed to assume roles from Github's OIDC.
permissions:
contents: read
id-token: write
permissions: {}

jobs:
weekly-release-pr:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write

steps:
- uses: actions/checkout@v4
with:
Expand All @@ -23,13 +24,16 @@ jobs:
id: update
run: bash .github/workflows/scripts/helm-weekly-release.sh

# This job uses "mimir-vendoring bot" instead of "github-actions bot" (secrets.GITHUB_TOKEN)
# because any events triggered by the later don't spawn GitHub actions.
# Refer to https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow
- name: Retrieve GitHub App Credentials from Vault
id: get-secrets
uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760 # v1.1.0
uses: grafana/shared-workflows/actions/get-vault-secrets@5d7e361bc7e0a183cde8afe9899fb7b596d2659b # get-vault-secrets-v1.2.0
with:
repo_secrets: |
APP_ID=mimir-github-bot:app_id
PRIVATE_KEY=mimir-github-bot:private_key
APP_ID=mimir-vendoring:app-id
PRIVATE_KEY=mimir-vendoring:app-pem-key

- name: Generate GitHub App Token
id: app-token
Expand Down
28 changes: 22 additions & 6 deletions .github/workflows/helm-weekly-release-reviewer.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,23 +8,39 @@ on:
paths:
- operations/helm/charts/**

permissions:
pull-requests: write
contents: write
id-token: write
permissions: {}

jobs:
auto-reviewer:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write

if: ${{ ! github.event.pull_request.head.repo.fork && github.event.pull_request.user.login == 'mimir-github-bot[bot]' }}
if: ${{ ! github.event.pull_request.head.repo.fork && github.event.pull_request.user.login == 'mimir-vendoring[bot]' }}

steps:
- name: Checkout Repository
uses: actions/checkout@v4
with:
persist-credentials: false

- name: Retrieve GitHub App Credentials from Vault
id: get-secrets
uses: grafana/shared-workflows/actions/get-vault-secrets@5d7e361bc7e0a183cde8afe9899fb7b596d2659b # get-vault-secrets-v1.2.0
with:
repo_secrets: |
APP_ID=mimir-github-bot:app_id
PRIVATE_KEY=mimir-github-bot:private_key

- name: Generate GitHub App Token
id: app-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ env.APP_ID }}
private-key: ${{ env.PRIVATE_KEY }}
owner: ${{ github.repository_owner }}

- name: Approve and auto-merge
id: auto-merge
if: startsWith(github.event.pull_request.head.ref, 'helm-chart-weekly-')
Expand All @@ -34,7 +50,7 @@ jobs:
--approve -b "**I'm approving** this pull request, since it is a helm release."
env:
PR_URL: ${{github.event.pull_request.html_url}}
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

- name: Manual review is required
if: steps.auto-merge.conclusion != 'success'
Expand Down