Skip to content

Commit 1824f24

Browse files
Merge remote-tracking branch 'upstream/main' into feature/pr_tperms
2 parents ead3235 + cc95c72 commit 1824f24

50 files changed

Lines changed: 3303 additions & 1298 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/workflows/build.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040
# Cache packages per python version, and reuse until lockfile changes
4141
- name: Cache python packages
4242
id: cache
43-
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
43+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
4444
with:
4545
path: .venv
4646
key: venv-${{ matrix.python-version }}-${{ hashFiles('poetry.lock') }}
@@ -71,14 +71,14 @@ jobs:
7171
# Cache packages per python version, and reuse until lockfile changes
7272
- name: Cache python packages
7373
id: cache
74-
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
74+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
7575
with:
7676
path: .venv
7777
key: venv-${{ env.pythonLocation }}-${{ hashFiles('poetry.lock') }}
7878
- name: Install dependencies
7979
run: poetry install -v --without=docs
8080
- name: Cache prek data
81-
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
81+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
8282
with:
8383
path: ~/.cache/prek
8484
key: prek-3|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}

.github/workflows/generate-sbom.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ jobs:
5353
- name: Generate sbom
5454
run: cyclonedx-py requirements -o otterdog-bom.json
5555
- name: Upload sbom
56-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
56+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
5757
with:
5858
name: sbom
5959
path: otterdog-bom.json

.github/workflows/publish.yml

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -76,15 +76,15 @@ jobs:
7676
ref: ${{ needs.release.outputs.release-tag }}
7777

7878
- name: "Log in to the Container registry"
79-
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
79+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
8080
with:
8181
registry: ${{ env.REGISTRY }}
8282
username: ${{ github.actor }}
8383
password: ${{ secrets.GITHUB_TOKEN }}
8484

8585
- name: "Extract metadata (tags, labels) for Docker"
8686
id: meta
87-
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
87+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
8888
with:
8989
tags: |
9090
${{ needs.prepare.outputs.release-version }}
@@ -93,7 +93,7 @@ jobs:
9393
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
9494

9595
- name: "Build and push Docker image"
96-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
96+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
9797
with:
9898
context: .
9999
file: docker/Dockerfile
@@ -136,7 +136,7 @@ jobs:
136136
cd dist && echo "hashes=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
137137
138138
- name: "Upload dist"
139-
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
139+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
140140
with:
141141
name: "dist"
142142
path: "dist/"
@@ -166,19 +166,19 @@ jobs:
166166
persist-credentials: false
167167

168168
- name: "Download dists"
169-
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
169+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
170170
with:
171171
name: "dist"
172172
path: "dist/"
173173

174174
- name: "Extract release notes"
175175
id: extract-release-notes
176-
uses: ffurrer2/extract-release-notes@202313ec7461b6b9e401996714484690ab1ae105 # v3.0.0
176+
uses: ffurrer2/extract-release-notes@273da39a24fb7db106a35526c8162815faffd31d # v3.1.0
177177
with:
178178
release_notes_file: RELEASE_NOTES.md
179179

180180
- name: "Create GitHub release"
181-
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
181+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
182182
with:
183183
name: "Otterdog ${{ needs.prepare.outputs.release-tag }}"
184184
tag_name: "${{ needs.prepare.outputs.release-tag }}"
@@ -201,13 +201,13 @@ jobs:
201201
id-token: write
202202
steps:
203203
- name: "Download dists"
204-
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
204+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
205205
with:
206206
name: "dist"
207207
path: "dist/"
208208

209209
- name: "Publish dists to PyPI"
210-
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
210+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
211211
with:
212212
attestations: true
213213

@@ -222,13 +222,13 @@ jobs:
222222
id-token: write
223223
steps:
224224
- name: "Download dists"
225-
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
225+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
226226
with:
227227
name: "dist"
228228
path: "dist/"
229229

230230
- name: "Publish dists to Test PyPI"
231-
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
231+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
232232
with:
233233
repository-url: https://test.pypi.org/legacy/
234234
attestations: true

CHANGELOG.md

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,30 @@
11
# Change Log
22

3-
## [1.2.1] - unreleased
3+
## [1.3.1] - unreleased
4+
5+
### Added
6+
7+
- Add tests for workflow validation settings ([#633](https://github.com/eclipse-csi/otterdog/pull/633))
8+
- Add support for `OTTERDOG_CONFIG_ROOT` environment variable ([#632](https://github.com/eclipse-csi/otterdog/pull/632))
9+
10+
## [1.3.0] - 30/03/2026
11+
12+
### Added
13+
14+
- Environment-based credential provider ([#593](https://github.com/eclipse-csi/otterdog/pull/593))
15+
- Auto-Comment on auto-merge problems ([#603](https://github.com/eclipse-csi/otterdog/pull/603))
16+
- Support for workflow setting `fork_pr_approval_policy` ([#576](https://github.com/eclipse-csi/otterdog/pull/576))
17+
- Added HashiCorp Vault credential provider support with hvac library integration ([#540](https://github.com/eclipse-csi/otterdog/pull/540))
18+
- Added flag `--only-secrets` to only process secret changes
419

520
### Changed
621

722
- Fix web-login ([#597](https://github.com/eclipse-csi/otterdog/pull/597))
823

24+
### Fixed
25+
26+
- Fix printing of changes for nested dicts
27+
928
## [1.2.0] - 12/02/2026
1029

1130
### Added

Makefile

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,21 @@ VERSION := $(shell poetry version -s)
1010
all: help
1111

1212
init: ## Initialize the development environment
13-
ifndef PIPX
14-
$(error "Please install pipx first, e.g. using 'apt install pipx' or 'brew install pipx")
15-
endif
16-
1713
ifndef POETRY
14+
ifndef PIPX
15+
$(error Poetry not found, and pipx is also not installed. \
16+
\
17+
To install Poetry, you can either: \
18+
\
19+
1. Install pipx first: \
20+
- On Debian/Ubuntu: apt install pipx \
21+
- On macOS: brew install pipx \
22+
Then run 'make init' again, which will use pipx to install Poetry. \
23+
\
24+
2. Install Poetry directly: \
25+
curl -sSL https://install.python-poetry.org | python3 -)
26+
endif
27+
1828
pipx install "poetry>=2.0.1"
1929
endif
2030

README.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,26 @@ However, when named `otterdog.jsonnet` or `otterdog.json`, the cli tool will aut
115115
> In this example the `plain` provider is being used to access credentials to avoid setting up a `real` credential provider (see below) for a quick setup.
116116
> However, the `plain` provider should *NOT* be used for anything else to avoid leakage of data in case the `otterdog.json` file is shared with other users.
117117
118+
### Environment Variables
119+
120+
#### OTTERDOG_CONFIG_ROOT
121+
122+
The `OTTERDOG_CONFIG_ROOT` environment variable allows you to specify a custom root directory for Otterdog configuration files and organization data. E.g: https://github.com/EclipseFdn/otterdog-configs
123+
124+
When set, Otterdog will:
125+
- Search for configuration files (`otterdog.jsonnet` or `otterdog.json`) in this directory
126+
- Use this directory as the base path for the `config_dir` (default: `orgs/`) containing organization configurations
127+
128+
**Usage:**
129+
130+
```bash
131+
# Set the configuration root directory
132+
export OTTERDOG_CONFIG_ROOT=/path/to/config
133+
134+
# Run otterdog commands - will automatically use the specified directory
135+
otterdog fetch-config eclipse-csi
136+
otterdog apply eclipse-csi
137+
```
118138
### Credentials
119139

120140
Otterdog needs certain credentials to access information from an organization and its repositories on GitHub:

docs/operating_otterdog/setup.md

Lines changed: 57 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
# Quick Setup
1+
# Setup Otterdog
2+
3+
*After completing the [installation of Otterdog](install.md), you need to perform some additional steps to configure otterdog.*
24

35
To start using the cli part of `otterdog` right away on a specific organization you have to set up the following:
46

@@ -65,7 +67,7 @@ The GitHub api token needs to have the following scopes enabled:
6567
* admin:org_hook
6668
* delete_repo
6769

68-
The credentials can be stored in different providers (bitwarden, pass).
70+
The credentials can be stored in different providers (bitwarden, pass, env).
6971

7072
#### Bitwarden
7173

@@ -159,3 +161,56 @@ As the `password_store_dir` might be different on different machines, you can al
159161
}
160162
}
161163
```
164+
165+
#### Environment based credentials
166+
167+
When using environment variables to store the credentials, you need to set the following environment variables:
168+
169+
```json
170+
{
171+
"organizations": [
172+
{
173+
"name": "<org name>",
174+
"github_id": "<github org id>",
175+
"credentials": {
176+
"provider": "env",
177+
"api_token": "<env_var_which_contains_api_token>",
178+
"username": "<env_var_which_contains_username>",
179+
"password": "<env_var_which_contains_password>",
180+
"twofa_seed": "<env_var_which_contains_2fa_seed>"
181+
}
182+
}
183+
]
184+
}
185+
```
186+
187+
The environment variables need to be set in the system where otterdog is executed.
188+
They can also be set in a `.env` file in the current working directory, which will be automatically loaded by otterdog.
189+
190+
If you want to keep the same environment variable pattern across organizations, you can set defaults and use placeholders in the `defaults.env` section. The env provider normalizes placeholder values by converting them to uppercase and replacing spaces and hyphens with underscores. You can use `{org_name}` and `{github_id}`.
191+
192+
```json
193+
{
194+
"defaults": {
195+
"credentials": {
196+
"provider": "env"
197+
},
198+
"env": {
199+
"api_token": "OTTER_{org_name}_API_TOKEN",
200+
"username": "OTTER_{org_name}_USERNAME",
201+
"password": "OTTER_{github_id}_PASSWORD",
202+
"twofa_seed": "OTTER_{github_id}_TOTP_SEED"
203+
}
204+
}
205+
}
206+
```
207+
208+
Hint: You can combine this provider with GitHub Actions secrets to securely store the credentials in a GitHub repository and use them in a GitHub action that runs otterdog:
209+
210+
```yaml
211+
env:
212+
OTTER_USERNAME: ${{ vars.OTTER_USERNAME }}
213+
OTTER_PASSWORD: ${{ secrets.OTTER_PASSWORD }}
214+
OTTER_TOTP_SEED: ${{ secrets.OTTER_TOTP_SEED }}
215+
OTTER_API_TOKEN: ${{ secrets.OTTER_API_TOKEN }}
216+
```

docs/reference/organization/repository/index.md

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -58,15 +58,17 @@ Definition of a Repository for a GitHub organization, the following properties a
5858

5959
### Workflow Settings
6060

61-
| Key | Value | Description | Notes |
62-
|--------------------------------------------|--------------|----------------------------------------------------------------|---------------------------------------------------------------------|
63-
| _enabled_ | boolean | If GitHub actions are enabled for this repository | |
64-
| _allowed_actions_ | string | Defines which type of GitHub Actions are permitted to run | `all`, `local_only` or `selected` |
65-
| _allow_github_owned_actions_ | boolean | If GitHub owned actions are permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
66-
| _allow_verified_creator_actions_ | boolean | If GitHub Actions from verified creators are permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
67-
| _allow_action_patterns_ | list[string] | A list of action patterns permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
68-
| _default_workflow_permissions_ | string | The default workflow permissions granted to the GITHUB_TOKEN | `read` or `write` |
69-
| _actions_can_approve_pull_request_reviews_ | boolean | If actions can approve and merge pull requests | |
61+
| Key | Value | Description | Notes |
62+
|--------------------------------------------|--------------|--------------------------------------------------------------------|---------------------------------------------------------------------------------------------------|
63+
| _enabled_ | boolean | If GitHub actions are enabled for this repository | |
64+
| _allowed_actions_ | string | Defines which type of GitHub Actions are permitted to run | `all`, `local_only` or `selected` |
65+
| _allow_github_owned_actions_ | boolean | If GitHub owned actions are permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
66+
| _allow_verified_creator_actions_ | boolean | If GitHub Actions from verified creators are permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
67+
| _allow_action_patterns_ | list[string] | A list of action patterns permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
68+
| _default_workflow_permissions_ | string | The default workflow permissions granted to the GITHUB_TOKEN | `read` or `write` |
69+
| _actions_can_approve_pull_request_reviews_ | boolean | If actions can approve and merge pull requests | |
70+
| _fork_pr_approval_policy_ | string | Controls when fork PR workflows require approval from a maintainer | `first_time_contributors_new_to_github`, `first_time_contributors` or `all_external_contributors` |
71+
7072

7173
## Jsonnet Function
7274

docs/reference/organization/settings.md

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,16 +41,17 @@ The following table captures all supported settings on organization level:
4141

4242
### Workflow Settings
4343

44-
| Key | Value | Description | Notes |
45-
|--------------------------------------------|--------------|-------------------------------------------------------------------|--------------------------------------------------------------------------|
46-
| _enabled_repositories_ | string | Defines which repositories are permitted to use GitHub Actions | `all`, `none` or `selected` |
47-
| _selected_repositories_ | list[string] | The list of repositories that are permitted to use GitHub Actions | Only taken into account when `enabled_repositories` is set to `selected` |
48-
| _allowed_actions_ | string | Defines which type of GitHub Actions are permitted to run | `all`, `local_only` or `selected` |
49-
| _allow_github_owned_actions_ | boolean | If GitHub owned actions are permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
50-
| _allow_verified_creator_actions_ | boolean | If GitHub Actions from verified creators are permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
51-
| _allow_action_patterns_ | list[string] | A list of action patterns permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
52-
| _default_workflow_permissions_ | string | The default workflow permissions granted to the GITHUB_TOKEN | `read` or `write` |
53-
| _actions_can_approve_pull_request_reviews_ | boolean | If actions can approve and merge pull requests | |
44+
| Key | Value | Description | Notes |
45+
|--------------------------------------------|--------------|--------------------------------------------------------------------|---------------------------------------------------------------------------------------------------|
46+
| _enabled_repositories_ | string | Defines which repositories are permitted to use GitHub Actions | `all`, `none` or `selected` |
47+
| _selected_repositories_ | list[string] | The list of repositories that are permitted to use GitHub Actions | Only taken into account when `enabled_repositories` is set to `selected` |
48+
| _allowed_actions_ | string | Defines which type of GitHub Actions are permitted to run | `all`, `local_only` or `selected` |
49+
| _allow_github_owned_actions_ | boolean | If GitHub owned actions are permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
50+
| _allow_verified_creator_actions_ | boolean | If GitHub Actions from verified creators are permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
51+
| _allow_action_patterns_ | list[string] | A list of action patterns permitted to run | Only taken into account when `allowed_actions` is set to `selected` |
52+
| _default_workflow_permissions_ | string | The default workflow permissions granted to the GITHUB_TOKEN | `read` or `write` |
53+
| _actions_can_approve_pull_request_reviews_ | boolean | If actions can approve and merge pull requests | |
54+
| _fork_pr_approval_policy_ | string | Controls when fork PR workflows require approval from a maintainer | `first_time_contributors_new_to_github`, `first_time_contributors` or `all_external_contributors` |
5455

5556
## Validation rules
5657

0 commit comments

Comments
 (0)