ci: improve token handling and workflow permissions

promhippie · Oct 31, 2023 · f4f52cc · f4f52cc
1 parent f513f66
commit f4f52cc
Show file tree

Hide file tree

Showing 7 changed files with 127 additions and 28 deletions.
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
@@ -0,0 +1,49 @@
+---
+name: automerge
+
+"on":
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - master
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+
+    steps:
+      - name: Generate token
+        id: token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ secrets.TOKEN_EXCHANGE_APP }}
+          installation_retrieval_mode: id
+          installation_retrieval_payload: ${{ secrets.TOKEN_EXCHANGE_INSTALL }}
+          private_key: ${{ secrets.TOKEN_EXCHANGE_KEY }}
+          permissions: >-
+            {"contents": "write", "pull_requests": "write", "issues": "write"}
+
+      - name: Fetch metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Approve request
+        id: approve
+        run: gh pr review --approve "${{github.event.pull_request.html_url}}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable automerge
+        id: automerge
+        run: gh pr merge --rebase --auto "${{github.event.pull_request.html_url}}"
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+
+...
diff --git a/.github/workflows/binaries.yml b/.github/workflows/binaries.yml
@@ -2,18 +2,27 @@
 name: binaries
 
 "on":
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - master
   push:
+    branches:
+      - master
     tags:
       - v*
 
+permissions:
+  contents: write
+
 jobs:
   binaries:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
 
       - name: Setup golang
         id: golang
@@ -31,6 +40,7 @@ jobs:
 
       - name: Sign release
         id: gpgsign
+        if: startsWith(github.ref, 'refs/tags/')
         uses: actionhippie/gpgsign@v1
         with:
           private_key: ${{ secrets.GNUPG_KEY }}
@@ -51,7 +61,6 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/')
         uses: ncipollo/release-action@v1
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
           body: ${{ steps.changelog.outputs.generated }}
           artifacts: dist/*
 

diff --git a/.github/workflows/changes.yml b/.github/workflows/changes.yml
@@ -2,18 +2,25 @@
 name: changes
 
 "on":
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - master
   push:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   changelog:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
 
@@ -29,6 +36,7 @@ jobs:
 
       - name: Commit changes
         id: commit
+        if: github.event_name != 'pull_request'
         uses: EndBug/add-and-commit@v9
         with:
           author_name: GitHub Actions
@@ -44,7 +52,7 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
 
@@ -60,6 +68,7 @@ jobs:
 
       - name: Commit changes
         id: commit
+        if: github.event_name != 'pull_request'
         uses: EndBug/add-and-commit@v9
         with:
           author_name: GitHub Actions
@@ -75,7 +84,7 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
 
@@ -91,6 +100,7 @@ jobs:
 
       - name: Commit changes
         id: commit
+        if: github.event_name != 'pull_request'
         uses: EndBug/add-and-commit@v9
         with:
           author_name: GitHub Actions

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -2,12 +2,20 @@
 name: docker
 
 "on":
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - master
   push:
     branches:
       - master
     tags:
       - v*
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   docker:
     runs-on: ubuntu-latest
@@ -18,21 +26,25 @@ jobs:
           - platform: linux/386
             goos: linux
             goarch: 386
+            tags: netgo
           - platform: linux/amd64
             goos: linux
             goarch: amd64
-          - platform: linux/arm64
-            goos: linux
-            goarch: arm64
+            tags: netgo
           - platform: linux/arm/6
             goos: linux
             goarch: arm
             goarm: 6
+            tags: netgo
+          - platform: linux/arm64
+            goos: linux
+            goarch: arm64
+            tags: netgo
 
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
 
       - name: Setup golang
         id: golang
@@ -46,6 +58,7 @@ jobs:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
           GOARM: ${{ matrix.goarm }}
+          TAGS: ${{ matrix.tags }}
         run: make generate
 
       - name: Run build
@@ -54,13 +67,13 @@ jobs:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
           GOARM: ${{ matrix.goarm }}
+          TAGS: ${{ matrix.tags }}
         run: make build
 
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v5
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           images: |
             promhippie/hetzner-exporter
             quay.io/promhippie/hetzner-exporter
@@ -109,7 +122,7 @@ jobs:
         if: github.event_name != 'pull_request'
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
+          username: bothippie
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build image
@@ -128,17 +141,17 @@ jobs:
   manifest:
     runs-on: ubuntu-latest
     needs: docker
+    if: github.event_name != 'pull_request'
 
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
 
       - name: Hub tags
         id: hubTags
         uses: docker/metadata-action@v5
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           images: promhippie/hetzner-exporter
           tags: |
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
@@ -161,7 +174,6 @@ jobs:
         id: quayTags
         uses: docker/metadata-action@v5
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           images: quay.io/promhippie/hetzner-exporter
           tags: |
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
@@ -171,6 +183,7 @@ jobs:
 
       - name: Quay manifest
         id: quay
+        if: github.event_name != 'pull_request'
         uses: actionhippie/manifest@v1
         with:
           username: ${{ secrets.QUAY_USERNAME }}
@@ -182,9 +195,9 @@ jobs:
 
       - name: Ghcr tags
         id: ghcrTags
+        if: github.event_name != 'pull_request'
         uses: docker/metadata-action@v5
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           images: ghcr.io/promhippie/hetzner-exporter
           tags: |
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
@@ -194,9 +207,10 @@ jobs:
 
       - name: Ghcr manifest
         id: ghcr
+        if: github.event_name != 'pull_request'
         uses: actionhippie/manifest@v1
         with:
-          username: ${{ github.actor }}
+          username: bothippie
           password: ${{ secrets.GITHUB_TOKEN }}
           platforms: linux/amd64,linux/386,linux/arm64,linux/arm/v6
           template: ghcr.io/promhippie/hetzner-exporter:VERSION-OS-ARCH
@@ -206,14 +220,16 @@ jobs:
   readme:
     runs-on: ubuntu-latest
     needs: docker
+    if: github.event_name != 'pull_request'
 
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
 
       - name: Hub readme
         id: hub
+        if: github.event_name != 'pull_request'
         uses: actionhippie/pushrm@v1
         with:
           provider: dockerhub
@@ -225,6 +241,7 @@ jobs:
 
       - name: Quay readme
         id: quay
+        if: github.event_name != 'pull_request'
         uses: actionhippie/pushrm@v1
         with:
           provider: quay

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -2,18 +2,25 @@
 name: docs
 
 "on":
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - master
   push:
     branches:
       - master
 
+permissions:
+  contents: write
+
 jobs:
   docs:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
 
       - name: Setup hugo
         id: hugo
@@ -28,6 +35,7 @@ jobs:
 
       - name: Deploy pages
         id: deploy
+        if: github.event_name != 'pull_request'
         uses: peaceiris/actions-gh-pages@v3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}