diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b556d3a..93b62b6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,31 +38,19 @@ jobs: CHROME_REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }} steps: - - name: Verify release identities + - name: Verify release bot identity env: - HOANGSVIT_TOKEN: ${{ secrets.HOANGSVIT_TOKEN }} EPLUS_BOT_TOKEN: ${{ secrets.EPLUS_BOT_TOKEN }} run: | set -euo pipefail - if [ -z "${HOANGSVIT_TOKEN:-}" ]; then - echo "::error::HOANGSVIT_TOKEN is empty." - exit 1 - fi - if [ -z "${EPLUS_BOT_TOKEN:-}" ]; then echo "::error::EPLUS_BOT_TOKEN is empty." exit 1 fi - HOANG_LOGIN="$(GH_TOKEN="$HOANGSVIT_TOKEN" gh api user --jq .login)" BOT_LOGIN="$(GH_TOKEN="$EPLUS_BOT_TOKEN" gh api user --jq .login)" - if [ "$HOANG_LOGIN" != "hoangsvit" ]; then - echo "::error::HOANGSVIT_TOKEN belongs to '$HOANG_LOGIN', expected 'hoangsvit'." - exit 1 - fi - if [ "$BOT_LOGIN" != "eplus-bot" ]; then echo "::error::EPLUS_BOT_TOKEN belongs to '$BOT_LOGIN', expected 'eplus-bot'." exit 1 @@ -73,7 +61,7 @@ jobs: with: ref: ${{ env.RELEASE_TAG }} fetch-depth: 0 - token: ${{ secrets.HOANGSVIT_TOKEN }} + token: ${{ secrets.EPLUS_BOT_TOKEN }} - name: Validate release tag run: | @@ -129,10 +117,10 @@ jobs: tag: ${{ env.RELEASE_TAG }} writeToFile: true - - name: Create changelog pull request as hoangsvit + - name: Create changelog pull request as eplus-bot id: changelog_pr env: - GH_TOKEN: ${{ secrets.HOANGSVIT_TOKEN }} + GH_TOKEN: ${{ secrets.EPLUS_BOT_TOKEN }} run: | set -euo pipefail @@ -142,10 +130,10 @@ jobs: exit 0 fi - BRANCH="chore/changelog-$RELEASE_TAG-hoangsvit" + BRANCH="chore/changelog-$RELEASE_TAG" - git config user.name "hoangsvit" - git config user.email "11882322+hoangsvit@users.noreply.github.com" + git config user.name "eplus-bot" + git config user.email "157664013+eplus-bot@users.noreply.github.com" git checkout -B "$BRANCH" git add CHANGELOG.md git commit -m "docs: update CHANGELOG.md for $RELEASE_TAG" @@ -164,44 +152,28 @@ jobs: --base main \ --head "$BRANCH" \ --title "docs: update changelog for $RELEASE_TAG" \ - --body "Automated CHANGELOG.md update generated from release tag \`$RELEASE_TAG\`.\n\nCreated by @hoangsvit. The @eplus-bot account will approve it after all required checks pass, then @hoangsvit will merge it automatically.")" + --body "Automated CHANGELOG.md update generated from release tag \`$RELEASE_TAG\`.\n\nCreated and merged by @eplus-bot after approval from github-actions[bot] and all required checks pass.")" PR_NUMBER="${PR_URL##*/}" fi PR_AUTHOR="$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json author --jq .author.login)" - if [ "$PR_AUTHOR" != "hoangsvit" ]; then - echo "::error::Changelog PR #$PR_NUMBER was created by '$PR_AUTHOR', expected 'hoangsvit'." + if [ "$PR_AUTHOR" != "eplus-bot" ]; then + echo "::error::Changelog PR #$PR_NUMBER was created by '$PR_AUTHOR', expected 'eplus-bot'." exit 1 fi echo "changed=true" >> "$GITHUB_OUTPUT" - echo "branch=$BRANCH" >> "$GITHUB_OUTPUT" echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT" - echo "Created changelog PR #$PR_NUMBER as @hoangsvit." - - name: Wait for checks and eplus-bot approval + - name: Wait for pull request checks if: ${{ steps.changelog_pr.outputs.changed == 'true' }} env: - GH_TOKEN: ${{ secrets.HOANGSVIT_TOKEN }} + GH_TOKEN: ${{ secrets.EPLUS_BOT_TOKEN }} PR_NUMBER: ${{ steps.changelog_pr.outputs.number }} run: | set -euo pipefail - ready_to_merge=false - for attempt in {1..90}; do - PR_JSON="$(gh pr view "$PR_NUMBER" \ - --repo "$GITHUB_REPOSITORY" \ - --json state,mergedAt,headRefOid)" - - PR_STATE="$(jq -r 'if .mergedAt then "merged" else (.state | ascii_downcase) end' <<<"$PR_JSON")" - HEAD_SHA="$(jq -r '.headRefOid' <<<"$PR_JSON")" - - if [ "$PR_STATE" = "merged" ]; then - echo "Changelog PR #$PR_NUMBER was already merged." - exit 0 - fi - CHECKS="$(gh pr checks "$PR_NUMBER" \ --repo "$GITHUB_REPOSITORY" \ --json bucket,name,workflow 2>/dev/null || echo '[]')" @@ -209,43 +181,42 @@ jobs: CI_COUNT="$(jq '[.[] | select(.name == "Compile, Test, Build")] | length' <<<"$CHECKS")" FAILING_COUNT="$(jq '[.[] | select(.bucket == "fail" or .bucket == "cancel")] | length' <<<"$CHECKS")" PENDING_COUNT="$(jq '[.[] | select(.bucket == "pending")] | length' <<<"$CHECKS")" - APPROVAL_COUNT="$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/reviews" \ - --paginate \ - --jq "[.[] | select(.user.login == \"eplus-bot\" and .state == \"APPROVED\" and .commit_id == \"$HEAD_SHA\")] | length")" if [ "$FAILING_COUNT" -gt 0 ]; then jq -r '.[] | select(.bucket == "fail" or .bucket == "cancel") | "::error::\(.workflow): \(.name) failed"' <<<"$CHECKS" exit 1 fi - if [ "$CI_COUNT" -gt 0 ] && [ "$PENDING_COUNT" -eq 0 ] && [ "$APPROVAL_COUNT" -gt 0 ]; then - ready_to_merge=true - break + if [ "$CI_COUNT" -gt 0 ] && [ "$PENDING_COUNT" -eq 0 ]; then + exit 0 fi - echo "Waiting for changelog PR (attempt $attempt/90, CI found: $CI_COUNT, pending: $PENDING_COUNT, eplus-bot approvals: $APPROVAL_COUNT)." + echo "Waiting for changelog PR checks (attempt $attempt/90, CI found: $CI_COUNT, pending: $PENDING_COUNT)." sleep 10 done - if [ "$ready_to_merge" != "true" ]; then - echo "::error::Timed out waiting for changelog checks and eplus-bot approval." - exit 1 - fi + echo "::error::Timed out waiting for changelog checks." + exit 1 - - name: Merge changelog pull request as hoangsvit + - name: Approve changelog pull request as github-actions[bot] if: ${{ steps.changelog_pr.outputs.changed == 'true' }} env: - GH_TOKEN: ${{ secrets.HOANGSVIT_TOKEN }} + GH_TOKEN: ${{ github.token }} PR_NUMBER: ${{ steps.changelog_pr.outputs.number }} run: | set -euo pipefail + gh pr review "$PR_NUMBER" \ + --repo "$GITHUB_REPOSITORY" \ + --approve \ + --body "Automated approval after all required checks passed." - MERGER_LOGIN="$(gh api user --jq .login)" - if [ "$MERGER_LOGIN" != "hoangsvit" ]; then - echo "::error::Merge token belongs to '$MERGER_LOGIN', expected 'hoangsvit'." - exit 1 - fi - + - name: Merge changelog pull request as eplus-bot + if: ${{ steps.changelog_pr.outputs.changed == 'true' }} + env: + GH_TOKEN: ${{ secrets.EPLUS_BOT_TOKEN }} + PR_NUMBER: ${{ steps.changelog_pr.outputs.number }} + run: | + set -euo pipefail gh pr merge "$PR_NUMBER" \ --repo "$GITHUB_REPOSITORY" \ --squash \