feat: signed commit when renaming upstream module #61
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ARR4N
requested review from
a team,
ceyonur,
darioush and
michaelkaplan13
and removed request for
a team
3 tasks
darioush
approved these changes
Oct 16, 2024
| if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' | ||
| uses: devops-infra/action-pull-request@v0.5.5 | ||
| - name: Commit to new branch | ||
| uses: planetscale/ghcommit-action@d4176bfacef926cc2db351eab20398dfc2f593b5 # v0.2.0 |
There was a problem hiding this comment.
It's possible to change a version tag to a different commit so this just reduces the attack surface.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why this should be merged
Signs commits for auto-renaming the Go module, originally introduced in #51 with unsigned commits that can't be merged to
main.How this works
Changes the commit action to use
ghcommit, which was made specifically to allow for keyless signing (GitHub signs the commit). The workflow no longer opens a PR to therenamed-go-modulebranch as it's redundant and the generated branch can be used directly.The commit message includes the
workflow_dispatchtrigger branch as well as a hash of the workflow file for a complete audit trail.I removed the commented-out PR trigger as it's unnecessary. In development we can now just trigger the workflow on the dev branch.
How this was tested
Inspecting the commit generated by a workflow run. It is identical in modifications to the one reviewed in #59.