mirror of
https://github.com/peass-ng/PEASS-ng.git
synced 2026-07-28 14:47:18 -07:00
ci: build, wait and merge windows definition PRs inline (no workflow_run/PAT-dispatch)
CODEX_FIXER_TOKEN is a fine-grained PAT with Contents/Pull-requests write but NOT Actions:write, so it cannot create a workflow_dispatch event; and a github.token -dispatched run never emits a workflow_run event to drive the triage merge job. So neither half of the old cross-workflow design could work. Instead, update_windows_version_definitions.yml now dispatches PR-tests with github.token (this workflow already has actions:write), polls that run directly, and on success squash-merges the PR with the CODEX_FIXER_TOKEN PAT so the push to master triggers CI-master_test -> Publish_release. Remove the now-dead auto_merge_windows_definition_bot_pr job from chack-agent-pr-triage.yml and the temporary token probe. Bump the job timeout to 90m to cover the inline wait. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Carlos Polop
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
e193030157
commit
f4c29dbb03
@@ -6,134 +6,11 @@ on:
|
||||
types: [completed]
|
||||
|
||||
jobs:
|
||||
auto_merge_windows_definition_bot_pr:
|
||||
if: ${{ github.event.workflow_run.conclusion == 'success' }}
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
actions: write
|
||||
contents: write
|
||||
pull-requests: write
|
||||
|
||||
steps:
|
||||
- name: Resolve and verify bot PR
|
||||
id: bot_pr
|
||||
env:
|
||||
PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
|
||||
HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
|
||||
GH_REPO: ${{ github.repository }}
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
run: |
|
||||
title="chore(winpeas): update windows version vulnerability definitions"
|
||||
branch="bot/update-windows-version-definitions"
|
||||
expected_file="build_lists/windows_version_exploits.json"
|
||||
|
||||
pr_number="${PR_NUMBER}"
|
||||
if [ -z "$pr_number" ] && [ -n "$HEAD_BRANCH" ]; then
|
||||
pr_number="$(gh pr list --state open --head "$HEAD_BRANCH" --base master --json number --jq '.[0].number')"
|
||||
fi
|
||||
if [ -z "$pr_number" ]; then
|
||||
echo "No pull request found for this workflow_run; skipping."
|
||||
echo "should_merge=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
pr_json="$(gh pr view "$pr_number" --json title,baseRefName,headRefName,author,isCrossRepository,files,mergeStateStatus)"
|
||||
pr_title="$(jq -r .title <<<"$pr_json")"
|
||||
base_ref="$(jq -r .baseRefName <<<"$pr_json")"
|
||||
head_ref="$(jq -r .headRefName <<<"$pr_json")"
|
||||
author="$(jq -r .author.login <<<"$pr_json")"
|
||||
is_cross_repository="$(jq -r .isCrossRepository <<<"$pr_json")"
|
||||
merge_state="$(jq -r .mergeStateStatus <<<"$pr_json")"
|
||||
files="$(jq -r '.files[].path' <<<"$pr_json")"
|
||||
file_count="$(jq -r '.files | length' <<<"$pr_json")"
|
||||
|
||||
if [ "$pr_title" != "$title" ] ||
|
||||
[ "$base_ref" != "master" ] ||
|
||||
[ "$head_ref" != "$branch" ] ||
|
||||
[ "$is_cross_repository" != "false" ] ||
|
||||
[ "$file_count" != "1" ] ||
|
||||
[ "$files" != "$expected_file" ]; then
|
||||
echo "PR #$pr_number is not the trusted windows definitions bot PR; skipping."
|
||||
echo "should_merge=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ "$author" != "app/github-actions" ] &&
|
||||
[ "$author" != "github-actions" ] &&
|
||||
[ "$author" != "github-actions[bot]" ]; then
|
||||
echo "PR #$pr_number is from unexpected author $author; skipping."
|
||||
echo "should_merge=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Accept UNSTABLE in addition to CLEAN/HAS_HOOKS. When the bot opens the PR, GitHub
|
||||
# also queues a `pull_request` PR-tests run that sits in `action_required` (it needs
|
||||
# manual approval and never runs), which keeps the PR permanently UNSTABLE. The
|
||||
# meaningful tests already passed: this job only runs when the dispatched PR-tests
|
||||
# workflow_run concluded `success`, and the PR identity is strictly validated above.
|
||||
# We still wait out the transient UNKNOWN state and refuse hard blockers
|
||||
# (DIRTY/BLOCKED/BEHIND/DRAFT).
|
||||
for attempt in {1..12}; do
|
||||
case "$merge_state" in
|
||||
CLEAN|HAS_HOOKS|UNSTABLE)
|
||||
break
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "PR #$pr_number mergeStateStatus=$merge_state; waiting for GitHub to finish evaluating mergeability ($attempt/12)."
|
||||
sleep 10
|
||||
merge_state="$(gh pr view "$pr_number" --json mergeStateStatus --jq .mergeStateStatus)"
|
||||
done
|
||||
|
||||
case "$merge_state" in
|
||||
CLEAN|HAS_HOOKS|UNSTABLE)
|
||||
;;
|
||||
*)
|
||||
echo "Refusing to merge PR #$pr_number because mergeStateStatus=$merge_state"
|
||||
echo "should_merge=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "should_merge=true" >> "$GITHUB_OUTPUT"
|
||||
echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
|
||||
echo "title=$title" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Merge trusted bot PR
|
||||
if: ${{ steps.bot_pr.outputs.should_merge == 'true' }}
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }}
|
||||
PR_NUMBER: ${{ steps.bot_pr.outputs.pr_number }}
|
||||
COMMIT_TITLE: ${{ steps.bot_pr.outputs.title }}
|
||||
run: |
|
||||
if [ -z "$GH_TOKEN" ]; then
|
||||
echo "CODEX_FIXER_TOKEN is required to merge this PR and dispatch the release workflow."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for attempt in {1..6}; do
|
||||
if response="$(gh api \
|
||||
-X PUT \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
"/repos/${{ github.repository }}/pulls/${PR_NUMBER}/merge" \
|
||||
-f merge_method=squash \
|
||||
-f commit_title="$COMMIT_TITLE")"; then
|
||||
merge_sha="$(jq -r '.sha // empty' <<<"$response")"
|
||||
echo "Merged trusted windows definitions bot PR #$PR_NUMBER as $merge_sha."
|
||||
# The squash-merge is performed with CODEX_FIXER_TOKEN (a PAT, not
|
||||
# GITHUB_TOKEN), so the resulting push to master triggers CI-master_test via its
|
||||
# `push` trigger, which builds and publishes the PEASS release. We intentionally
|
||||
# do NOT also dispatch CI-master_test here, to avoid publishing two releases for
|
||||
# the same merge.
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Merge attempt $attempt failed for PR #$PR_NUMBER; retrying."
|
||||
sleep 10
|
||||
done
|
||||
|
||||
echo "Failed to merge trusted windows definitions bot PR #$PR_NUMBER after retries."
|
||||
exit 1
|
||||
# NOTE: The windows-definitions bot PR is built, waited on and merged inline by
|
||||
# update_windows_version_definitions.yml (it dispatches PR-tests with github.token, polls
|
||||
# that run, then squash-merges with the CODEX_FIXER_TOKEN PAT so the push to master triggers
|
||||
# the release). It is intentionally NOT handled here: a github.token-dispatched run does not
|
||||
# emit a `workflow_run` event, so a job here could never reliably fire for it.
|
||||
|
||||
chack_agent_triage:
|
||||
if: ${{ github.event.workflow_run.conclusion == 'success' }}
|
||||
|
||||
@@ -13,7 +13,7 @@ permissions:
|
||||
jobs:
|
||||
update-definitions:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 60
|
||||
timeout-minutes: 90
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
@@ -39,7 +39,7 @@ jobs:
|
||||
- name: Create validated update pull request
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
PR_TESTS_DISPATCH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }}
|
||||
MERGE_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }}
|
||||
run: |
|
||||
title="chore(winpeas): update windows version vulnerability definitions"
|
||||
branch="bot/update-windows-version-definitions"
|
||||
@@ -75,15 +75,74 @@ jobs:
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Dispatch PR-tests with a PAT instead of github.token. A workflow run that is
|
||||
# owned by GITHUB_TOKEN does NOT emit a downstream `workflow_run` event, so a
|
||||
# github.token-dispatched run never triggered the chack-agent-pr-triage auto-merge
|
||||
# job. Dispatching with a PAT makes the run user-owned, so `workflow_run` fires and
|
||||
# the trusted merge job runs once PR-tests pass.
|
||||
if [ -z "$PR_TESTS_DISPATCH_TOKEN" ]; then
|
||||
echo "CODEX_FIXER_TOKEN is required to dispatch PR-tests so the auto-merge workflow_run event fires."
|
||||
# Run the winPEAS PR-tests build for the bot branch, wait for it, and merge on
|
||||
# success. We dispatch with github.token (this workflow has `actions: write`) and
|
||||
# then poll the dispatched run directly, instead of relying on a cross-workflow
|
||||
# `workflow_run` trigger: runs owned by GITHUB_TOKEN do not emit `workflow_run`
|
||||
# events, and the auto-created `pull_request` PR-tests run for a bot-authored PR is
|
||||
# held in `action_required`. The merge itself is done with a PAT (see below).
|
||||
if [ -z "$MERGE_TOKEN" ]; then
|
||||
echo "CODEX_FIXER_TOKEN (MERGE_TOKEN) is required to merge the validated bot PR."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
GH_TOKEN="$PR_TESTS_DISPATCH_TOKEN" gh workflow run PR-tests.yml --ref "$branch"
|
||||
echo "PR-tests dispatched (via PAT) for PR #$pr_number. The trusted workflow_run merge job will merge it after tests pass."
|
||||
dispatch_ts="$(date -u +%s)"
|
||||
gh workflow run PR-tests.yml --ref "$branch"
|
||||
echo "Dispatched PR-tests for $branch (PR #$pr_number); locating the run..."
|
||||
|
||||
run_id=""
|
||||
for attempt in $(seq 1 18); do
|
||||
row="$(gh run list --workflow=PR-tests.yml --branch "$branch" --event workflow_dispatch \
|
||||
--limit 1 --json databaseId,createdAt --jq '.[0] | [.databaseId, .createdAt] | @tsv')"
|
||||
cid="$(printf '%s' "$row" | cut -f1)"
|
||||
cts_iso="$(printf '%s' "$row" | cut -f2)"
|
||||
if [ -n "$cid" ]; then
|
||||
cts="$(date -u -d "$cts_iso" +%s 2>/dev/null || echo 0)"
|
||||
if [ "$cts" -ge "$((dispatch_ts - 60))" ]; then
|
||||
run_id="$cid"
|
||||
break
|
||||
fi
|
||||
fi
|
||||
sleep 10
|
||||
done
|
||||
|
||||
if [ -z "$run_id" ]; then
|
||||
echo "Could not locate the dispatched PR-tests run."
|
||||
exit 1
|
||||
fi
|
||||
echo "Watching PR-tests run $run_id until it completes..."
|
||||
|
||||
status=""
|
||||
conclusion=""
|
||||
for attempt in $(seq 1 70); do
|
||||
status="$(gh run view "$run_id" --json status --jq .status)"
|
||||
if [ "$status" = "completed" ]; then
|
||||
conclusion="$(gh run view "$run_id" --json conclusion --jq .conclusion)"
|
||||
break
|
||||
fi
|
||||
sleep 30
|
||||
done
|
||||
|
||||
if [ "$conclusion" != "success" ]; then
|
||||
echo "PR-tests run $run_id did not pass (status=$status conclusion=$conclusion); not merging PR #$pr_number."
|
||||
exit 1
|
||||
fi
|
||||
echo "PR-tests passed. Squash-merging PR #$pr_number..."
|
||||
|
||||
# Merge with the PAT (not github.token) so the resulting push to master triggers
|
||||
# CI-master_test -> Publish_release. A github.token-authored merge would not.
|
||||
for attempt in $(seq 1 6); do
|
||||
if GH_TOKEN="$MERGE_TOKEN" gh api -X PUT \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
"/repos/${{ github.repository }}/pulls/${pr_number}/merge" \
|
||||
-f merge_method=squash \
|
||||
-f commit_title="$title"; then
|
||||
echo "Merged windows definitions PR #$pr_number. CI-master_test will build and publish the release."
|
||||
exit 0
|
||||
fi
|
||||
echo "Merge attempt $attempt failed for PR #$pr_number; retrying."
|
||||
sleep 10
|
||||
done
|
||||
|
||||
echo "Failed to merge PR #$pr_number after retries."
|
||||
exit 1
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
name: zz-token-probe
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
probe:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Probe CODEX_FIXER_TOKEN contents/PR write
|
||||
env:
|
||||
TOK: ${{ secrets.CODEX_FIXER_TOKEN }}
|
||||
REPO: ${{ github.repository }}
|
||||
run: |
|
||||
api() { curl -sS -o /tmp/out.json -w "%{http_code}" "$@"; }
|
||||
master_sha="$(curl -sS -H "Authorization: token $TOK" "https://api.github.com/repos/$REPO/git/ref/heads/master" | jq -r .object.sha)"
|
||||
echo "master sha: $master_sha"
|
||||
|
||||
echo "--- Contents:write test (create ref) ---"
|
||||
code="$(api -X POST -H "Authorization: token $TOK" \
|
||||
"https://api.github.com/repos/$REPO/git/refs" \
|
||||
-d "{\"ref\":\"refs/heads/zz-codex-write-test\",\"sha\":\"$master_sha\"}")"
|
||||
echo "create ref HTTP: $code"; cat /tmp/out.json | jq -r '.message // empty'
|
||||
|
||||
if [ "$code" = "201" ]; then
|
||||
code="$(api -X DELETE -H "Authorization: token $TOK" \
|
||||
"https://api.github.com/repos/$REPO/git/refs/heads/zz-codex-write-test")"
|
||||
echo "delete ref HTTP: $code"
|
||||
fi
|
||||
|
||||
echo "--- Pull requests:write test (no-op edit of PR #652 base->base) ---"
|
||||
code="$(api -X PATCH -H "Authorization: token $TOK" \
|
||||
"https://api.github.com/repos/$REPO/pulls/652" \
|
||||
-d "{\"body\":\"Automated update of build_lists/windows_version_exploits.json (auto-merge pipeline test).\"}")"
|
||||
echo "patch PR HTTP: $code"; cat /tmp/out.json | jq -r '.message // empty'
|
||||
Reference in New Issue
Block a user