Add workflow to sync contrib resource types and publish Bicep extensions#11916
Add workflow to sync contrib resource types and publish Bicep extensions#11916kachawla wants to merge 4 commits into
Conversation
Add contrib-update-resource-types.yaml workflow that receives repository_dispatch events from resource-types-contrib whenever its main branch updates. The workflow: 1. Validates the contrib_ref from the dispatch payload as a hex SHA 2. Installs yq (required by make update-resource-types) 3. Runs make update-resource-types to bump go.mod to the latest resource-types-contrib version and copy manifests into deploy/manifest/built-in-providers/ 4. If changes are detected (including new untracked files), opens or updates a PR on the bot/update-resource-types branch 5. Merging that PR triggers the existing build-and-push-bicep-types job in build.yaml, which dispatches to radius-publisher to republish radius:latest with the refreshed contrib types Uses GH_RAD_CI_BOT_PAT for checkout and PR creation so the resulting push triggers CI checks (the default GITHUB_TOKEN cannot trigger workflows on pushes it creates). Part of: unified Bicep extension publishing (PR 3/4) Signed-off-by: Karishma Chawla <kachawla@microsoft.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions workflow that listens for repository_dispatch events from radius-project/resource-types-contrib, runs make update-resource-types to refresh the manifest copies under deploy/manifest/built-in-providers/, and opens (or refreshes) a PR on bot/update-resource-types. Merging that PR triggers the existing build-and-push-bicep-types job to republish the unified Bicep extension.
Changes:
- New workflow
contrib-update-resource-types.yamlreacting toresource-types-contrib-updateddispatch events - Validates the optional
contrib_refpayload as a hex SHA, installs Go + yq, runsmake update-resource-types, and force-pushes tobot/update-resource-types - Uses
actions/github-scriptwithGH_RAD_CI_BOT_PATto create or update the PR idempotently
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #11916 +/- ##
==========================================
- Coverage 51.72% 51.69% -0.04%
==========================================
Files 726 724 -2
Lines 45608 45507 -101
==========================================
- Hits 23591 23524 -67
+ Misses 19793 19763 -30
+ Partials 2224 2220 -4 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Signed-off-by: Karishma Chawla <kachawla@microsoft.com>
| # The default GITHUB_TOKEN cannot trigger workflows on pushes it creates. | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| token: ${{ secrets.GH_RAD_CI_BOT_PAT }} |
There was a problem hiding this comment.
issue: related to radius-project/resource-types-contrib#160 (comment) we must eliminate PATs/fake accounts and use GH Apps
There was a problem hiding this comment.
We use this PAT in rest of the workflows in the repo as well. Given that we have to plan migrate all of the workflows to GH app in the near future, can we include this in the same effort instead of blocking this PR?
| # deploy/manifest/defaults.yaml. | ||
| run: | | ||
| mkdir -p "${RUNNER_TEMP}/bin" | ||
| GOBIN="${RUNNER_TEMP}/bin" go install github.com/mikefarah/yq/v4@v4.44.3 |
There was a problem hiding this comment.
suggestion: if the tool releases official binaries, then we should use them (with checksums validation if possible) instead of compiling the source on us.
There was a problem hiding this comment.
Good point, updated.
Also, broader question for you and @brooke-hamilton - do we have a convention for tool installation in workflows? Right now yq is installed separately in each workflow that needs it. Should we consolidate this into a composite action so the version/checksum management lives in one place, or is the preference to keep installing tools directly in each workflow?
| env: | ||
| CONTRIB_REF: ${{ steps.contrib.outputs.ref }} | ||
| with: | ||
| github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }} |
There was a problem hiding this comment.
issue: same here what I mentioned above - use GH Apps instead of PATs/fake accounts
Signed-off-by: Karishma Chawla <kachawla@microsoft.com>
kachawla
force-pushed
the
kachawla/contrib-sync-workflow
branch
from
827c35c to
ef7e043
Compare
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
Overview
Today the
radiusBicep extension is published tobiceptypes.azurecr.iovia the existingbuild-and-push-bicep-typesjob inbuild.yaml, which dispatches to theradius-publisherpipeline on every push tomainand on version tag pushes. With #11915 updatingmake generate-bicep-typesto include contrib types, the existing publish pipeline automatically produces the combined extension -- no new publish workflow is needed.However, there is no automation to pull updated resource type manifests from
resource-types-contribinto this repo. When someone merges a schema change or a new resource type in contrib, the manifest copies committed underdeploy/manifest/built-in-providers/must be refreshed manually viamake update-resource-typesbefore the next publish picks them up.This PR adds a workflow that closes that gap by automating the manifest sync.
How it works
What this PR adds
contrib-update-resource-types.yamlHandles
repository_dispatchevents (type:resource-types-contrib-updated) fromresource-types-contrib.Triggers:
repository_dispatch-- fired by the contrib repo'snotify-radius.yamlworkflow (PR 4)workflow_dispatch-- commented out for production, can be enabled during developmentSteps:
contrib_refas a hex commit SHA (informational only -- the actual version fetched is determined bymake update-resource-typeswhich runsgo get ...@latest)make update-resource-typesto parsedefaults.yaml)make update-resource-typesto bumpgo.modto latest contrib and copy manifestsgit status --porcelainto catch both modified and new untracked files), opens or updates a PR on thebot/update-resource-typesbranchradius:latestSecurity:
contrib_refis validated against^[a-f0-9]{7,40}$and passed via environment variables (not inline${{ }}interpolation) to prevent shell and script injectionGH_RAD_CI_BOT_PATfor checkout and PR creation so the resulting push triggers CI checks (the defaultGITHUB_TOKENcannot trigger workflows on pushes it creates)Note: This workflow depends on
make update-resource-typesfrom #11911. It includes a pre-flight check that fails fast with a descriptive error if the target is not yet available.Dependencies
make update-resource-types)GH_RAD_CI_BOT_PATChanges
.github/workflows/contrib-update-resource-types.yaml: New workflowPart of
Unified Bicep extension publishing (PR 3/4). See design doc.