Sync Calico API #1911
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Sync API files from tigera/calico-private into this repo. | |
| # Creates or updates a PR if anything changed. | |
| --- | |
| name: Sync Calico API | |
| on: # yamllint disable-line rule:truthy | |
| schedule: | |
| - cron: '0 * * * *' # every hour | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| discover-branches: | |
| if: github.repository == 'tigera/api' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| branches: ${{ steps.branches.outputs.branches }} | |
| steps: | |
| - name: Discover branches | |
| id: branches | |
| run: | | |
| # Get master + the two most recent release branches (by semver). | |
| branches=$(gh api repos/${{ github.repository }}/branches --paginate --jq ' | |
| [.[] | select(.name | test("^release-calient-v[0-9]+\\.[0-9]+$")) | .name] | |
| | sort_by(ltrimstr("release-calient-v") | split(".") | map(tonumber)) | |
| | .[-2:] | |
| | ["master"] + . | |
| ') | |
| echo "branches=${branches}" >> "$GITHUB_OUTPUT" | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| sync: | |
| needs: discover-branches | |
| runs-on: ubuntu-latest | |
| concurrency: | |
| group: sync-calico-api-${{ matrix.branch }} | |
| cancel-in-progress: true | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| branch: ${{ fromJson(needs.discover-branches.outputs.branches) }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ matrix.branch }} | |
| persist-credentials: false | |
| - name: Configure git auth | |
| run: | | |
| git config --global credential.helper store | |
| echo "https://marvin-tigera:${GITHUB_TOKEN}@github.com" > ~/.git-credentials | |
| git config --global url."https://github.com/".insteadOf "git@github.com:" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.MARVIN_PAT }} | |
| - name: Sync API from calico-private | |
| run: make -f Makefile.local update | |
| - name: Regenerate clientset and fix formatting | |
| run: make gen-files | |
| - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0 | |
| id: cpr | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| commit-message: "Automatic API update from tigera/calico-private ${{ matrix.branch }}" | |
| branch: auto-api-update-${{ matrix.branch }} | |
| base: ${{ matrix.branch }} | |
| title: "Auto: sync API from tigera/calico-private [${{ matrix.branch }}]" | |
| body: | | |
| Automated sync of API files from `tigera/calico-private` `${{ matrix.branch }}` | |
| branch into this repo via `make -f Makefile.local update`. | |
| Triggered by scheduled workflow. | |
| labels: docs-not-required,release-note-not-required,merge-when-ready,delete-branch | |
| delete-branch: true | |
| # The PR author is github-actions[bot] (the GITHUB_TOKEN identity above), so | |
| # it can't approve its own PR, and the Actions token can't approve PRs anyway. | |
| # Approve as marvin-tigera (MARVIN_PAT) so Marvin merges it once CI is green. | |
| # branch protection has dismiss_stale_reviews off, so a single approval persists | |
| # across the hourly content updates -- the reviewDecision guard keeps reruns quiet. | |
| - name: Auto-approve so Marvin merges once CI passes | |
| if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated' | |
| env: | |
| GH_TOKEN: ${{ secrets.MARVIN_PAT }} | |
| PR: ${{ steps.cpr.outputs.pull-request-number }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| if [ "$(gh pr view "$PR" -R "$REPO" --json reviewDecision -q .reviewDecision)" = "APPROVED" ]; then | |
| echo "PR #$PR already approved; nothing to do." | |
| exit 0 | |
| fi | |
| gh pr review "$PR" -R "$REPO" --approve |