From 4866d4957f15f9e3f6bcca44bba5033167f8ec4d Mon Sep 17 00:00:00 2001 From: Franco Date: Thu, 23 Jul 2026 11:55:59 -0300 Subject: [PATCH 1/2] fix: bump sync-from-upstream tools and change base branch behavior --- .github/workflows/sync-from-upstream.yaml | 21 +++++++++++---------- CHANGELOG.md | 7 +++++++ 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/.github/workflows/sync-from-upstream.yaml b/.github/workflows/sync-from-upstream.yaml index 65568bb..796af52 100644 --- a/.github/workflows/sync-from-upstream.yaml +++ b/.github/workflows/sync-from-upstream.yaml @@ -41,17 +41,18 @@ jobs: git config user.name "github-actions[bot]" git fetch origin - # Use the existing remote branch if present; otherwise create from main + # Base the update branch on the whole upstream (renovate) branch, not just + # vendir.yml. Reuse the existing update branch if present so we don't discard + # changes already pushed to it; otherwise create it from the renovate branch. if git ls-remote --exit-code --heads origin "${{ inputs.update_branch }}" > /dev/null 2>&1; then git checkout --track "origin/${{ inputs.update_branch }}" + # Merge the whole renovate branch in. On conflict prefer the upstream side + # (only vendir.yml realistically conflicts; our derived files do not). + git merge --no-edit -X theirs "origin/${{ github.ref_name }}" else - git checkout main - git checkout -b "${{ inputs.update_branch }}" + git checkout -b "${{ inputs.update_branch }}" "origin/${{ github.ref_name }}" fi - git checkout "origin/${{ github.ref_name }}" -- vendir.yml - git add vendir.yml - git diff --cached --quiet || git commit -m "chore: update vendir.yml from upstream" git push origin "${{ inputs.update_branch }}" call-update-chart: @@ -110,7 +111,7 @@ jobs: -e GIT_CONFIG_COUNT=1 \ -e GIT_CONFIG_KEY_0=safe.directory \ -e GIT_CONFIG_VALUE_0=/github/workspace \ - gsoci.azurecr.io/giantswarm/shield-values-sync:0.0.5 \ + gsoci.azurecr.io/giantswarm/shield-values-sync:0.0.6 \ --show-git-diff \ --diff-base origin/main \ --chart-dir /github/workspace/${{ steps.chart.outputs.chart_dir }} \ @@ -132,11 +133,11 @@ jobs: fi docker run --rm \ -v ${{ github.workspace }}:/github/workspace \ - gsoci.azurecr.io/giantswarm/shield-values-sync:0.0.5 \ + gsoci.azurecr.io/giantswarm/shield-values-sync:0.0.6 \ --chart-dir /github/workspace/${{ steps.chart.outputs.chart_dir }} \ "${config_args[@]}" - name: Run schema-gen - uses: docker://gsoci.azurecr.io/giantswarm/shield-schema-gen:0.0.5 + uses: docker://gsoci.azurecr.io/giantswarm/shield-schema-gen:0.0.6 with: args: --chart-dir /github/workspace/${{ steps.chart.outputs.chart_dir }} - name: Detect dependency version changes @@ -226,7 +227,7 @@ jobs: if [[ ${#args[@]} -gt 0 ]]; then docker run --rm \ -v ${{ github.workspace }}:/workspace \ - gsoci.azurecr.io/giantswarm/shield-changelogger:0.0.5 \ + gsoci.azurecr.io/giantswarm/shield-changelogger:0.0.6 \ --changelog-path /workspace/CHANGELOG.md \ "${args[@]}" fi diff --git a/CHANGELOG.md b/CHANGELOG.md index acb291d..4d83a5d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), however this project does not use Semantic Versioning and there are no releases. Instead this file uses a date-based structure. +## 2026-07-23 + +### Changed + +- `sync-from-upstream.yaml` — bumped the `shield-values-sync`, `shield-schema-gen`, and `shield-changelogger` tool images to `0.0.6`. +- `sync-from-upstream.yaml` — the update branch is now based on the *entire* upstream (Renovate) branch instead of cherry-picking only `vendir.yml`. `prepare-update-branch` merges the whole renovate branch into `update_branch` (preferring the upstream side on conflict), so non-`vendir.yml` changes made on that branch are carried into the sync PR while changes already on `update_branch` are preserved. + ## 2026-07-22 ### Fixed From b4006b6f7eec9defc12e4f9c193bc9ab90bb5ca4 Mon Sep 17 00:00:00 2001 From: Franco Date: Thu, 23 Jul 2026 12:01:54 -0300 Subject: [PATCH 2/2] fix(sync-from-upstream): pass branch names via env to avoid template injection --- .github/workflows/sync-from-upstream.yaml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/sync-from-upstream.yaml b/.github/workflows/sync-from-upstream.yaml index 796af52..1a8a28b 100644 --- a/.github/workflows/sync-from-upstream.yaml +++ b/.github/workflows/sync-from-upstream.yaml @@ -36,6 +36,9 @@ jobs: with: fetch-depth: 0 - name: Prepare update branch + env: + UPDATE_BRANCH: ${{ inputs.update_branch }} + UPSTREAM_BRANCH: ${{ github.ref_name }} run: | git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git config user.name "github-actions[bot]" @@ -44,16 +47,16 @@ jobs: # Base the update branch on the whole upstream (renovate) branch, not just # vendir.yml. Reuse the existing update branch if present so we don't discard # changes already pushed to it; otherwise create it from the renovate branch. - if git ls-remote --exit-code --heads origin "${{ inputs.update_branch }}" > /dev/null 2>&1; then - git checkout --track "origin/${{ inputs.update_branch }}" + if git ls-remote --exit-code --heads origin "${UPDATE_BRANCH}" > /dev/null 2>&1; then + git checkout --track "origin/${UPDATE_BRANCH}" # Merge the whole renovate branch in. On conflict prefer the upstream side # (only vendir.yml realistically conflicts; our derived files do not). - git merge --no-edit -X theirs "origin/${{ github.ref_name }}" + git merge --no-edit -X theirs "origin/${UPSTREAM_BRANCH}" else - git checkout -b "${{ inputs.update_branch }}" "origin/${{ github.ref_name }}" + git checkout -b "${UPDATE_BRANCH}" "origin/${UPSTREAM_BRANCH}" fi - git push origin "${{ inputs.update_branch }}" + git push origin "${UPDATE_BRANCH}" call-update-chart: needs: prepare-update-branch