Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MINOR: Create GitHub action to update NOTICE file automatically every year #18380

Open
wants to merge 22 commits into
base: trunk
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
88 changes: 88 additions & 0 deletions .github/workflows/cron-update-new-year-copyright.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,88 @@
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
#
name: Update Copyright Year
description: Update the year on copyright notice with a scheduled run on Jan 1st every year

on:
schedule:
- cron: "0 0 1 1 *" # Run once a year on January 1st
workflow_dispatch:


permissions:
contents: write
pull-requests: write
Comment on lines +28 to +29
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

note for reviewers

context: write is required to push commit to the new branch created below
pull-requests: write is required to create a pull request


jobs:
update-year:
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v4
with:
persist-credentials: false

- name: Get the current year
id: get-year
run: |
CURRENT_YEAR=$(date +%Y)
echo "year=$CURRENT_YEAR" >> $GITHUB_OUTPUT

- name: Switch to trunk branch and create new branch
run: |
TIMESTAMP=$(date +%Y%m%d%H%M%S)
BRANCH_NAME="trunk-copyright-year-${{ steps.get-year.outputs.year }}-${TIMESTAMP}"

git checkout trunk
divijvaidya marked this conversation as resolved.
Show resolved Hide resolved
git checkout -b "$BRANCH_NAME"
echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV

- name: Update year in NOTICE file
run: |
echo "Updating NOTICE file using sed..."
sed -i -E "s/(Copyright )([0-9]{4})( The Apache Software Foundation\.)/\1${{ steps.get-year.outputs.year }}\3/" NOTICE

- name: Push changes
run: |
TIMESTAMP=$(date +%s)
# Git user.name and user.email come from https://github.com/actions/checkout?tab=readme-ov-file#push-a-commit-using-the-built-in-token
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository_owner }}/${{ github.event.repository.name }}.git
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need this. Check how we're updating the test-catalog branch here https://github.com/apache/kafka/blob/trunk/.github/workflows/build.yml#L269-L284

Also see the "magic" user.email in that code. I think this is still needed for commit to be correctly associated with the github actions bot.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The link you provided uses persist-credentials: true which is not recommended by apache as per https://cwiki.apache.org/confluence/display/BUILDS/GitHub+Actions+Security

if using the 'checkout' action, always enable persist-credentials: false

Since, we use persist-credentials: false, we need a way to provide credential during git push for this action. That is why I used this alternative approach of setting origin with credentials.

I will change the user.email and user.name to the "magic" user mentioned at https://github.com/actions/checkout?tab=readme-ov-file#push-a-commit-using-the-built-in-token

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think setting the origin URL like this is essentially the same as persisting the credentials. However, I think either this approach or persist-credentials: true is fine for this workflow since it's not running any user code (like a PR).

git add NOTICE
git commit \
-m "Update NOTICE file to year ${{ steps.get-year.outputs.year }}" \
-m "GitHub Run: https://github.com/${{ github.repository_owner }}/${{ github.event.repository.name }}/actions/runs/${{ github.run_id }}"
git push origin "$BRANCH_NAME"

- name: Create pull request
uses: actions/github-script@v7
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const branchName = process.env.BRANCH_NAME;
core.info("Creating Pull Request from branch: ${branchName}");
let response = await github.rest.pulls.create({
owner: context.repo.owner,
repo: context.repo.repo,
title: "MINOR: Update NOTICE file to year ${{ steps.get-year.outputs.year }}",
head: branchName,
base: "trunk",
body: "This PR is auto-generated to update the NOTICE file on Jan 1st every year."
});
core.info("Pull Request created: #${response.data.number}");
Loading