Skip to content

Use commit-headless to create signed commits from GHA #9302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sarahchen6 wants to merge 13 commits into from
Closed

Use commit-headless to create signed commits from GHA #9302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
b448d6a
ci: use commit-headless to create signed commits from actions
avidal Aug 1, 2025
3215bed
Merge branch 'master' into sarahchen6/update-dd-octo-sts
sarahchen6 Aug 4, 2025
5d8d682
Merge branch 'master' into sarahchen6/update-dd-octo-sts
sarahchen6 Aug 5, 2025
17d121b
Add back create-commit id
sarahchen6 Aug 5, 2025
04ea047
Delete ghcommit download
sarahchen6 Aug 5, 2025
a9a1f75
Change cloudfoundry content permissions to read
sarahchen6 Aug 5, 2025
2a47f6a
Undo - Change cloudfoundry content permissions to read
sarahchen6 Aug 5, 2025
f8587d4
Clean docker build workflow
sarahchen6 Aug 5, 2025
3e3c04f
Clean jmxfetch submodule workflow
sarahchen6 Aug 5, 2025
7744e40
Clean gradle dependencies workflow
sarahchen6 Aug 5, 2025
80468c2
Address merge conflicts
sarahchen6 Sep 22, 2025
6452fc4
Add dd-octo-sts token to cloudfoundry workflow and clean up
sarahchen6 Sep 22, 2025
33b224e
Merge branch 'master' into sarahchen6/update-dd-octo-sts
sarahchen6 Oct 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 28 additions & 8 deletions .github/workflows/add-release-to-cloudfoundry.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,21 @@
name: Add release to Cloud Foundry
on:
on:
release:
types:
- released
jobs:
update-releases:
permissions:
contents: write # Required to commit and push changes to the repository
contents: read
id-token: write # Required for OIDC token federation
runs-on: ubuntu-latest
steps:
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
id: octo-sts
with:
scope: DataDog/dd-trace-java
policy: self.add-release-to-cloudfoundry

- name: Checkout "cloudfoundry" branch
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
with:
Expand Down Expand Up @@ -42,11 +49,24 @@ jobs:
- name: Append release to Cloud Foundry repository
run: |
echo "${{ steps.get-release-version.outputs.VERSION }}: ${{ steps.get-release-url.outputs.URL }}" >> index.yml
- name: Commit and push changes
uses: planetscale/ghcommit-action@f24050e41f8694750427d111b52f4ef9ca81a32d # v0.2.18
- name: Commit changes
id: create-commit
run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

if [[ -z "$(git status -s)" ]]; then
echo "No changes to commit, exiting."
exit 0;
fi

git commit -a -m "chore: Add version ${{ steps.get-release-version.outputs.VERSION }} to Cloud Foundry"
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
- name: Push changes
uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
if: ${{ steps.create-commit.outputs.commit != '' }}
with:
commit_message: "chore: Add version ${{ steps.get-release-version.outputs.VERSION }} to Cloud Foundry"
repo: ${{ github.repository }}
token: "${{ steps.octo-sts.outputs.token }}"
branch: cloudfoundry
env:
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
command: push
commits: "${{ steps.create-commit.outputs.commit }}"
28 changes: 18 additions & 10 deletions .github/workflows/update-docker-build-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:
update-docker-build-image:
runs-on: ubuntu-latest
permissions:
contents: write # Required to create and push branch
contents: read
Copy link
Contributor

@PerfectSlayer PerfectSlayer Aug 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❔ question: ‏If contents: write is no more needed, should we remove it to from add-release-to-clouldfoundry?

Copy link
Contributor Author

@sarahchen6 sarahchen6 Aug 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes it seems so! content permissions are specifically for GITHUB_TOKEN (ref), and add-release-to-cloudfoundry doesn't use this token to push anymore.

EDIT: just kidding - Since we're checking out the repo and committing without the dd-octo-sts token, the workflow is still using GITHUB_TOKEN and needs the write permissions to push 🤔

id-token: write # Required for OIDC token federation
steps:
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
Expand Down Expand Up @@ -58,11 +58,6 @@ jobs:
else
echo "commit_changes=true" >> "$GITHUB_OUTPUT"
fi
- name: Download ghcommit CLI
if: steps.check-changes.outputs.commit_changes == 'true'
run: |
curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L
chmod +x /usr/local/bin/ghcommit
- name: Pick a branch name
if: steps.check-changes.outputs.commit_changes == 'true'
id: define-branch
Expand All @@ -72,12 +67,25 @@ jobs:
run: |
git checkout -b ${{ steps.define-branch.outputs.branch }}
git push -u origin ${{ steps.define-branch.outputs.branch }} --force
- name: Commit and push changes
- name: Commit changes
if: steps.check-changes.outputs.commit_changes == 'true'
env:
GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
id: create-commit
run: |
ghcommit --repository ${{ github.repository }} --branch ${{ steps.define-branch.outputs.branch }} --add .gitlab-ci.yml --message "feat(ci): Update Docker build image"
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git commit --message "feat(ci): Update Docker build image" .gitlab-ci.yml
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
- name: Push changes
uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
if: ${{ steps.check-changes.outputs.commit_changes == 'true' && steps.create-commit.outputs.commit != '' }}
with:
token: "${{ steps.octo-sts.outputs.token }}"
branch: "${{ steps.define-branch.outputs.branch }}"
# for scheduled runs, sha is the tip of the default branch
# for dispatched runs, sha is the tip of the branch it was dispatched on
branch-from: "${{ github.sha }}"
command: push
commits: "${{ steps.create-commit.outputs.commit }}"
- name: Create pull request
if: steps.check-changes.outputs.commit_changes == 'true'
env:
Expand Down
76 changes: 35 additions & 41 deletions .github/workflows/update-gradle-dependencies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-latest
name: Update Gradle dependencies
permissions:
contents: write # Required to create new branch
contents: read
id-token: write # Required for OIDC token federation
steps:
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
Expand All @@ -22,16 +22,9 @@ jobs:
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
with:
submodules: "recursive"
- name: Download ghcommit CLI
run: |
curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L
chmod +x /usr/local/bin/ghcommit
- name: Pick a branch name
run: echo "BRANCH_NAME=ci/update-gradle-dependencies-$(date +'%Y%m%d')" >> $GITHUB_ENV
- name: Create branch
run: |
git checkout -b $BRANCH_NAME
git push -u origin $BRANCH_NAME --force
id: define-branch
run: echo "branch=ci/update-gradle-dependencies-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
- name: Update Gradle dependencies
env:
ORG_GRADLE_PROJECT_akkaRepositoryToken: ${{ secrets.AKKA_REPO_TOKEN }}
Expand All @@ -42,45 +35,46 @@ jobs:
JAVA_11_HOME=$JAVA_HOME_11_X64 \
JAVA_17_HOME=$JAVA_HOME_17_X64 \
JAVA_21_HOME=$JAVA_HOME_21_X64 \
JAVA_25_HOME=$JAVA_HOME_25_X64 \
./gradlew resolveAndLockAll --write-locks --parallel --stacktrace --no-daemon --max-workers=4
- name: Commit changes
env:
GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
- name: Check for changes
id: check-changes
run: |
GH_ADD_ARGS=""
COUNT=0
BRANCH_HEAD=$(git rev-parse HEAD)
for lockfile in $(git status --porcelain=v1 -- ':(glob)**/gradle.lockfile' | awk '{ print $NF }'); do
echo "Found lockfile: $lockfile"
GH_ADD_ARGS="$GH_ADD_ARGS --add $lockfile"
COUNT=$((COUNT+1))
if [ $COUNT -eq 10 ]; then
echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with $GH_ADD_ARGS"
OUTPUT=$(ghcommit --repository ${{ github.repository }} --branch $BRANCH_NAME --sha $BRANCH_HEAD $GH_ADD_ARGS --message "chore: Update Gradle dependencies" 2>&1)
echo $OUTPUT
if [[ $OUTPUT != *"Success. New commit"* ]]; then
exit 1
fi
BRANCH_HEAD=${OUTPUT##*/}
echo "ghcommit output: $OUTPUT"
GH_ADD_ARGS=""
COUNT=0
fi
done
# Check at uncommited files
echo "Checking uncommited files"
git status
# Create a PR from the created branch
if [ $COUNT -gt 0 ]; then
echo "Creating a commit to $BRANCH_NAME@$BRANCH_HEAD with $GH_ADD_ARGS"
ghcommit --repository ${{ github.repository }} --branch $BRANCH_NAME --sha $BRANCH_HEAD $GH_ADD_ARGS --message "chore: Update Gradle dependencies"
if [[ -z "$(git status -s)" ]]; then
echo "No changes to commit, exiting."
echo "commit_changes=false" >> "$GITHUB_OUTPUT"
exit 0
else
echo "commit_changes=true" >> "$GITHUB_OUTPUT"
fi
- name: Commit changes
if: steps.check-changes.outputs.commit_changes == 'true'
id: create-commit
run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git add .
git commit --no-verify --message="chore: Update Gradle dependencies"
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
- name: Push changes
uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
if: ${{ steps.check-changes.outputs.commit_changes == 'true' && steps.create-commit.outputs.commit != '' }}
with:
token: "${{ steps.octo-sts.outputs.token }}"
branch: "${{ steps.define-branch.outputs.branch }}"
# for scheduled runs, sha is the tip of the default branch
# for dispatched runs, sha is the tip of the branch it was dispatched on
branch-from: "${{ github.sha }}"
command: push
commits: "${{ steps.create-commit.outputs.commit }}"
- name: Create pull request
if: steps.check-changes.outputs.commit_changes == 'true'
env:
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
BRANCH_NAME: ${{ steps.define-branch.outputs.branch }}
run: |
# use echo to set a multiline body for the PR
echo -e "This PR updates the Gradle dependencies. ⚠️ Don't forget to squash commits before merging. ⚠️\n\n- [ ] Update PR title if a code change is needed to support one of those new dependencies" | \
echo -e "This PR updates the Gradle dependencies.\n\n- [ ] Update PR title if a code change is needed to support one of those new dependencies" | \
gh pr create --title "Update Gradle dependencies" \
--base master \
--head $BRANCH_NAME \
Expand Down
32 changes: 18 additions & 14 deletions .github/workflows/update-jmxfetch-submodule.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: write # Required to create and push branch
contents: read
id-token: write # Required for OIDC token federation
steps:
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
Expand Down Expand Up @@ -38,25 +38,29 @@ jobs:
if: steps.check-changes.outputs.commit_changes == 'true'
id: define-branch
run: echo "branch=ci/update-jmxfetch-submodule-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
- name: Create branch
- name: Commit changes
if: steps.check-changes.outputs.commit_changes == 'true'
run: |
git checkout -b ${{ steps.define-branch.outputs.branch }}
git push -u origin ${{ steps.define-branch.outputs.branch }} --force
- name: Commit and push changes
if: steps.check-changes.outputs.commit_changes == 'true'
env:
GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
id: create-commit
run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git add dd-java-agent/agent-jmxfetch/integrations-core
git commit -m "Update agent-jmxfetch submodule"
git push origin ${{ steps.define-branch.outputs.branch }}
git commit --message "feat(ci): Update agent-jmxfetch submodule" dd-java-agent/agent-jmxfetch/integrations-core
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
- name: Push changes
uses: DataDog/commit-headless@1186485b788f57eedaaadb19919781698b4d262f # action/v1.0.0
if: ${{ steps.check-changes.outputs.commit_changes == 'true' && steps.create-commit.outputs.commit != '' }}
with:
token: "${{ steps.octo-sts.outputs.token }}"
branch: "${{ steps.define-branch.outputs.branch }}"
# for scheduled runs, sha is the tip of the default branch
# for dispatched runs, sha is the tip of the branch it was dispatched on
branch-from: "${{ github.sha }}"
command: push
commits: "${{ steps.create-commit.outputs.commit }}"
- name: Create pull request
if: steps.check-changes.outputs.commit_changes == 'true'
if: ${{ steps.check-changes.outputs.commit_changes == 'true' && steps.create-commit.outputs.commit != '' }}
env:
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
GH_TOKEN: "${{ steps.octo-sts.outputs.token }}"
run: |
gh pr create --title "Update agent-jmxfetch submodule" \
--base master \
Expand Down
Loading