Set id-token: write permissions and use the created token in the chec… #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Merge Upstream PR test | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 9 * * 1,4' | |
| push: | |
| branches: | |
| - test/merge-workflow | |
| jobs: | |
| create_upstream_pr: | |
| permissions: | |
| contents: write | |
| id-token: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| # TokenPolicy defined at https://github.com/elastic/catalog-info/tree/main/resources/github-token-policies/token-policy-opentelemetry-demo-merge-upstream.yaml | |
| - name: Get token | |
| id: get_token | |
| uses: elastic/oblt-actions/github/create-token@v1 | |
| with: | |
| token-policy: token-policy-3898141dfcd9 | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: main | |
| fetch-depth: 0 | |
| token: ${{ steps.get_token.outputs.token }} | |
| - name: Configure git user | |
| uses: elastic/oblt-actions/git/setup@v1 | |
| with: | |
| github-token: ${{ steps.get_token.outputs.token }} | |
| - name: Fetch upstream | |
| run: | | |
| git remote add upstream https://github.com/open-telemetry/opentelemetry-demo.git | |
| git fetch upstream main | |
| - name: Check for upstream changes | |
| id: check | |
| run: | | |
| COMMITS_BEHIND=$(git rev-list --count HEAD..upstream/main) | |
| echo "commits_behind=${COMMITS_BEHIND}" >> $GITHUB_OUTPUT | |
| - name: Create branch from upstream | |
| if: steps.check.outputs.commits_behind != '0' | |
| id: branch | |
| run: | | |
| BRANCH_NAME="auto-merge/upstream-$(date +%Y%m%d-%H%M%S)" | |
| echo "branch_name=${BRANCH_NAME}" >> $GITHUB_OUTPUT | |
| git checkout -b "${BRANCH_NAME}" upstream/main | |
| git push origin "${BRANCH_NAME}" | |
| - name: Create Pull Request | |
| if: steps.check.outputs.commits_behind != '0' | |
| id: create_pr | |
| env: | |
| GH_TOKEN: ${{ steps.get_token.outputs.token }} | |
| run: | | |
| PR_URL=$(gh pr create \ | |
| --title "chore: merge with upstream opentelemetry-demo" \ | |
| --body "## Automated upstream merge | |
| This PR merges with the upstream opentelemetry-demo repository. | |
| ### Changes from upstream | |
| - ${{ steps.check.outputs.commits_behind }} new commits | |
| ### If there are conflicts | |
| Check out this branch and resolve them: | |
| \`\`\`bash | |
| git fetch origin ${{ steps.branch.outputs.branch_name }} | |
| git checkout ${{ steps.branch.outputs.branch_name }} | |
| git merge main | |
| # resolve conflicts | |
| git push | |
| \`\`\` | |
| **Note:** If \`src/payment/package.json\` conflicts, take upstream version and add: | |
| \`\`\`json | |
| \"@elastic/opentelemetry-node\": \"1.5.0\" | |
| \`\`\` | |
| And update the start script to: | |
| \`\`\`json | |
| \"start\": \"OTEL_EXPORTER_OTLP_PROTOCOL=grpc node --require @elastic/opentelemetry-node index.js\" | |
| \`\`\` | |
| --- | |
| *This PR was automatically created.*" \ | |
| --base main \ | |
| --head ${{ steps.branch.outputs.branch_name }}) | |
| echo "pr_url=${PR_URL}" >> $GITHUB_OUTPUT | |
| PR_NUMBER=$(echo "$PR_URL" | grep -oE '[0-9]+$') | |
| echo "pr_number=${PR_NUMBER}" >> $GITHUB_OUTPUT | |
| # - name: Enable auto-merge | |
| # if: steps.create_pr.outputs.pr_number != '' | |
| # env: | |
| # GH_TOKEN: ${{ secrets.OTEL_DEMO_MERGE_SECRET }} | |
| # run: | | |
| # gh pr merge ${{ steps.create_pr.outputs.pr_number }} --auto --merge | |
| # notify-failure: | |
| # needs: [create_upstream_pr] | |
| # if: failure() | |
| # runs-on: ubuntu-latest | |
| # steps: | |
| # - name: Slack notification if any error | |
| # uses: elastic/oblt-actions/slack/send@v1 | |
| # with: | |
| # bot-token: ${{ secrets.SLACK_BOT_TOKEN }} | |
| # channel-id: "C0AA2B1949M" #otel-demo-ci | |
| # message: | | |
| # :warning: Upstream merge workflow failed for `${{ github.repository }}@${{ github.ref_name }}`. | |
| # Please check <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the workflow run>. |