fix: update CI/CD process to use composite actions and auto-release workflow #361

bryantbiggs · 2021-10-26T16:27:26Z

Description

update CI workflow to use composite actions
update pre-commit versions to latest
update terraform-docs to latest version v0.16.0
add new argument to terraform_docs hook which avoids pinning to exact version due to conflict of .terraform.lock.hcl file (Ignore extracting versions from terraform.lock.hcl terraform-docs/terraform-docs#527)
add new hooks to pre-commit for whitespace and eof lines
add new release.yml workflow. this workflow will automatically:
- create and push new tag for next semver based on conventional-commits
- create GitHub release with notes
- update Changelog with release notes
- this workflow will also automatically notify PRs that are included in the release, mimicking the manual behavior but now its automated https://github.com/clowdhaus/terraform-aws-rds/pull/1#issuecomment-952097291
remove old chglog configs and Makefile

This takes what was completed for the Aurora module, and adds in one additional piece now which is the release workflow. I will open a PR on that module to add in these additional changes as well once we've proven they work as intended in this org

⚠️ Note - I don't know if the repos have master as a protected branch. If so, then we'll have to generate a GitHub PAT to use in the workflow in place of ${{ secrets.GITHUB_TOKEN }}. The default token provided by GitHub should work as intended if the branches are not protected

Motivation and Context

consolidates CI actions and updates terraform-docs to latest
automate release process in a standardized manner

Breaking Changes

No

How Has This Been Tested?

I have tested and validated these changes - see the fork I created to test and validate https://github.com/clowdhaus/terraform-aws-rds
- Release created https://github.com/clowdhaus/terraform-aws-rds/releases/tag/v3.4.1
- Changelog updated https://github.com/clowdhaus/terraform-aws-rds/blob/master/CHANGELOG.md
- The changes in this PR are the same that were used on the fork to validate

…orkflow

.pre-commit-config.yaml

.releaserc.json

bryantbiggs · 2021-10-26T16:29:41Z

CHANGELOG.md

@@ -1,12 +1,3 @@
-# Change Log


These are removed since they will be managed by the semantic-release plugin going forward. They will get added back in when the first release kicks off, just like it did here following this same process https://github.com/clowdhaus/terraform-aws-rds/blob/master/CHANGELOG.md#changelog

modules/db_option_group/main.tf

antonbabenko

Few clarifications and questions mostly to become familiar with Semantic Release workflow.

.pre-commit-config.yaml

.github/workflows/release.yml

antonbabenko · 2021-10-26T16:54:17Z

.github/workflows/release.yml

+      - master
+    paths:
+      - '*.tf'
+      - 'modules/**/*.tf'


Few questions:

Does it mean that any change in these masks will trigger a release?

Can modules/**/*.tf be generalize to be **/*.tf to include changes in examples/*, too?

Is it right, that this GH Action will decide on the scope based on the commit message type (feat => major, fix: => minor, chore => patch). If so, do you know where the mapping is described? I can't find it on the GH Action homepage. Found answer on https://github.com/semantic-release/commit-analyzer

Is there any stop word to have in git commit message which will not trigger the release even if valid paths were changed? (e.g. [ci skip])

Correct - any PRs that match these path patterns will trigger a release and we can tailor the paths/pattern to whatever we choose

Yes - I believe the pattern **/*.tf means any *.tf file anywhere in the repo. However, if someone makes only a change to an example, I don't think that would be something "release worthy" since there are no source changes

👍🏽

Yes - there are a few patterns which do not trigger releases. I generally use commit messages like chore: <something> and this pattern does not trigger a release (skips it)

If anyone changes tf files in examples and the git commit message starts with fix:, we should still release a patch version. To prevent this we can set the message to start with chore:.

updated in 588f70e and added '**/*.py' since that will come up in a few repos and this keeps the file uniform across the repos

also, I tried to update to pre-commit 1.54 but it seems to be broken on terraform-docs now

Thanks for the report on broken terraform_docs.

Fixed. Please use v1.55.0.

looks good, updated to v1.55.0 🎉

antonbabenko · 2021-10-26T17:03:20Z

.github/workflows/release.yml

+            @semantic-release/changelog@6.0.0
+            @semantic-release/git@10.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Another "strange questions" from me :)

Will this token be available for others to read? (eg. by adding another GH action YAML config and outputting ${{ secrets.GITHUB_TOKEN }} there?)

What is the minimum scope of the token should we have? Reading this IMPORTANT note and I am not sure I understand if Personal Access Token should be used (we have master as a protected branch).

This token is already there by default https://docs.github.com/en/actions/security-guides/automatic-token-authentication

Let me get back to you on that, I'll have to create a token and do a bunch of test runs to see what permissions are required

ok so it looks like we only need a token with public_repo scope for this to work

I would store this as an org secret under the name SEMANTIC_RELEASE_TOKEN. You can elect to select repos one by one as we add the workflow or allow all repos - up to you (will come up when you create the org secret as an option)

Also, I would make sure that the actions are locked down as well on the org. Here is what I have on my org - you can check by going to settings -> actions.

antonbabenko · 2021-10-26T17:04:11Z

.github/workflows/release.yml

+        with:
+          extra_plugins: |
+            @semantic-release/changelog@6.0.0
+            @semantic-release/git@10.0.0


persist-credentials: false should be used somewhere in the config, too, right?

If we use a personal access token then yes, we don't want to persist creds because they will conflict with the default token

Makefile

.chglog/CHANGELOG.tpl.md

Co-authored-by: Anton Babenko <anton@antonbabenko.com>

antonbabenko · 2021-11-02T12:13:37Z

Sorry for the delay with this final review/check. I try to make it happen this week.

bryantbiggs · 2021-11-03T02:05:00Z

No worries at all! I think I've got a solution for PR updates, stay tuned

antonbabenko · 2021-11-07T18:53:45Z

Ok, I have added PAT token with the correct name. Let me merge this one and see how it works before copying it to any other repositories.

## [3.4.1](v3.4.0...v3.4.1) (2021-11-07) ### Bug Fixes * update CI/CD process to use composite actions and auto-release workflow ([#361](#361)) ([123ea2a](123ea2a))

antonbabenko · 2021-11-07T18:54:54Z

🎉 This PR is included in version 3.4.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

antonbabenko · 2021-11-07T19:01:55Z

Looks good! Let me know if/when you have some news regarding pre-commit auto-fixes on behalf of users.

bryantbiggs · 2021-11-07T19:04:30Z

I think I have the solution - started working on it and need to finish it up, maybe this week or next

github-actions · 2022-11-13T02:34:53Z

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

bryantbiggs added 4 commits October 26, 2021 12:00

fix: update CI/CD process to use composite actions and auto-release w…

05ef0a3

…orkflow

chore: need to have both current and future branch names

f86d659

chore: add a change to ensure release workflow is run

9afa01b

chore: remove comment added to trigger worfklow

304e5df

bryantbiggs commented Oct 26, 2021

View reviewed changes

.pre-commit-config.yaml Outdated Show resolved Hide resolved

bryantbiggs commented Oct 26, 2021

View reviewed changes

.releaserc.json Outdated Show resolved Hide resolved

bryantbiggs commented Oct 26, 2021

View reviewed changes

modules/db_option_group/main.tf Show resolved Hide resolved

bryantbiggs requested a review from antonbabenko October 26, 2021 16:31

antonbabenko reviewed Oct 26, 2021

View reviewed changes

bryantbiggs and others added 6 commits October 26, 2021 13:13

Update .pre-commit-config.yaml

df10f44

Co-authored-by: Anton Babenko <anton@antonbabenko.com>

chore: update to remove redundant hook and set semantic-release version

48c770a

chore: update release workflow to use PAT

6dbc2fe

chore: trigger release workflow on any terraform or python file changes

588f70e

chore: bump pre-commit to latest

7c362ad

chore: update changelog header

4acaf8f

Update .pre-commit-config.yaml

94abe7f

antonbabenko merged commit 123ea2a into terraform-aws-modules:master Nov 7, 2021

antonbabenko pushed a commit that referenced this pull request Nov 7, 2021

chore(release): version 3.4.1 [skip ci]

976e5c4

## [3.4.1](v3.4.0...v3.4.1) (2021-11-07) ### Bug Fixes * update CI/CD process to use composite actions and auto-release workflow ([#361](#361)) ([123ea2a](123ea2a))

antonbabenko added the released label Nov 7, 2021

bryantbiggs deleted the chore/update-cicd branch November 7, 2021 18:58

This was referenced Nov 7, 2021

fix: update CI/CD process to enable auto-release workflow terraform-aws-modules/terraform-aws-rds-aurora#250

Merged

fix: update CI/CD process to enable auto-release workflow terraform-aws-modules/terraform-aws-s3-bucket#116

Merged

bryantbiggs mentioned this pull request Nov 15, 2021

fix: update CI/CD process to enable auto-release workflow terraform-aws-modules/terraform-aws-autoscaling#168

Merged

1 task

github-actions bot locked as resolved and limited conversation to collaborators Nov 13, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: update CI/CD process to use composite actions and auto-release workflow #361

fix: update CI/CD process to use composite actions and auto-release workflow #361

bryantbiggs commented Oct 26, 2021 •

edited

bryantbiggs Oct 26, 2021

antonbabenko left a comment

antonbabenko Oct 26, 2021

bryantbiggs Oct 26, 2021

antonbabenko Oct 27, 2021

bryantbiggs Oct 27, 2021

antonbabenko Oct 27, 2021

antonbabenko Oct 27, 2021

bryantbiggs Oct 27, 2021

antonbabenko Oct 26, 2021

bryantbiggs Oct 26, 2021

bryantbiggs Oct 26, 2021

bryantbiggs Oct 26, 2021

antonbabenko Oct 26, 2021

bryantbiggs Oct 26, 2021

antonbabenko commented Nov 2, 2021

bryantbiggs commented Nov 3, 2021

antonbabenko commented Nov 7, 2021

antonbabenko commented Nov 7, 2021

antonbabenko commented Nov 7, 2021

bryantbiggs commented Nov 7, 2021

github-actions bot commented Nov 13, 2022

fix: update CI/CD process to use composite actions and auto-release workflow #361

fix: update CI/CD process to use composite actions and auto-release workflow #361

Conversation

bryantbiggs commented Oct 26, 2021 • edited

Description

Motivation and Context

Breaking Changes

How Has This Been Tested?

Choose a reason for hiding this comment

antonbabenko left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

antonbabenko commented Nov 2, 2021

bryantbiggs commented Nov 3, 2021

antonbabenko commented Nov 7, 2021

antonbabenko commented Nov 7, 2021

antonbabenko commented Nov 7, 2021

bryantbiggs commented Nov 7, 2021

github-actions bot commented Nov 13, 2022

bryantbiggs commented Oct 26, 2021 •

edited