Skip to content

Commit 7000fbf

Browse files
MarenzMarenz
committed
Add migration steps for Dependabot auto-merge and CODEOWNERS
- Add create_dependabot_auto_merge_workflow() to create .github/workflows/auto-dependabot.yaml - Add disable_codeowners_review_requirement() to update GitHub ruleset via API - Add auto-dependabot.yaml workflow template to cookiecutter - Regenerate golden test files with UPDATE_GOLDEN=1 Signed-off-by: Mathias L. Baumann <[email protected]>
1 parent f5740e8 commit 7000fbf

File tree

8 files changed

+1907
-0
lines changed

8 files changed

+1907
-0
lines changed

‎cookiecutter/migrate.py‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,156 @@ def main() -> None:
3232
"""Run the migration steps."""
3333
# Add a separation line like this one after each migration step.
3434
print("=" * 72)
35+
print("Creating Dependabot auto-merge workflow...")
36+
create_dependabot_auto_merge_workflow()
37+
print("=" * 72)
38+
print("Disabling CODEOWNERS review requirement in GitHub ruleset...")
39+
disable_codeowners_review_requirement()
40+
print("=" * 72)
3541
print("Migration script finished. Remember to follow any manual instructions.")
3642
print("=" * 72)
3743

3844

45+
def create_dependabot_auto_merge_workflow() -> None:
46+
"""Create the Dependabot auto-merge workflow file."""
47+
workflow_dir = Path(".github") / "workflows"
48+
workflow_dir.mkdir(parents=True, exist_ok=True)
49+
50+
workflow_content = """name: Auto-merge Dependabot PRs
51+
52+
on:
53+
pull_request:
54+
55+
permissions:
56+
contents: write
57+
pull-requests: write
58+
59+
jobs:
60+
auto-merge:
61+
if: github.actor == 'dependabot[bot]'
62+
runs-on: ubuntu-latest
63+
steps:
64+
- name: Auto-merge Dependabot PR
65+
uses: frequenz-floss/dependabot-auto-approve@3cad5f42e79296505473325ac6636be897c8b8a1 # v1.3.2 # noqa: E501
66+
with:
67+
github-token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
68+
merge-method: 'merge'
69+
"""
70+
71+
workflow_file = workflow_dir / "auto-dependabot.yaml"
72+
if workflow_file.exists():
73+
print(f"Workflow file {workflow_file} already exists, skipping creation.")
74+
return
75+
76+
workflow_file.write_text(workflow_content, encoding="utf-8")
77+
print(f"Created Dependabot auto-merge workflow at {workflow_file}")
78+
79+
80+
def disable_codeowners_review_requirement() -> None: # noqa: C901
81+
"""Disable CODEOWNERS review requirement in GitHub repository ruleset."""
82+
import json # pylint: disable=import-outside-toplevel
83+
84+
try:
85+
result = subprocess.run(
86+
["gh", "api", "repos/:owner/:repo", "--jq", ".default_branch"],
87+
capture_output=True,
88+
text=True,
89+
check=True,
90+
)
91+
default_branch = result.stdout.strip()
92+
print(f"Default branch: {default_branch}")
93+
except subprocess.CalledProcessError as e:
94+
print(f"Failed to get default branch: {e}")
95+
print("Skipping CODEOWNERS review requirement update.")
96+
print("You may need to manually disable the CODEOWNERS review requirement.")
97+
return
98+
99+
try:
100+
result = subprocess.run(
101+
["gh", "api", "repos/:owner/:repo/rulesets"],
102+
capture_output=True,
103+
text=True,
104+
check=True,
105+
)
106+
107+
rulesets = json.loads(result.stdout)
108+
109+
version_branch_ruleset = None
110+
for ruleset in rulesets:
111+
if ruleset.get("name") == "Protect version branches":
112+
version_branch_ruleset = ruleset
113+
break
114+
115+
if not version_branch_ruleset:
116+
print("Protect version branches ruleset not found, skipping update.")
117+
print("You may need to manually disable the CODEOWNERS review requirement.")
118+
return
119+
120+
ruleset_id = version_branch_ruleset["id"]
121+
print(f"Found ruleset ID: {ruleset_id}")
122+
123+
result = subprocess.run(
124+
["gh", "api", f"repos/:owner/:repo/rulesets/{ruleset_id}"],
125+
capture_output=True,
126+
text=True,
127+
check=True,
128+
)
129+
ruleset_config = json.loads(result.stdout)
130+
131+
updated = False
132+
for rule in ruleset_config.get("rules", []):
133+
if rule.get("type") == "pull_request":
134+
if rule.get("parameters", {}).get("require_code_owner_review"):
135+
rule["parameters"]["require_code_owner_review"] = False
136+
updated = True
137+
break
138+
139+
if not updated:
140+
print("CODEOWNERS review requirement already disabled.")
141+
return
142+
143+
update_payload = {
144+
"name": ruleset_config["name"],
145+
"target": ruleset_config["target"],
146+
"enforcement": ruleset_config["enforcement"],
147+
"conditions": ruleset_config["conditions"],
148+
"rules": ruleset_config["rules"],
149+
"bypass_actors": ruleset_config["bypass_actors"],
150+
}
151+
152+
with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False) as f:
153+
json.dump(update_payload, f, indent=2)
154+
temp_file = f.name
155+
156+
try:
157+
subprocess.run(
158+
[
159+
"gh",
160+
"api",
161+
"-X",
162+
"PUT",
163+
f"repos/:owner/:repo/rulesets/{ruleset_id}",
164+
"--input",
165+
temp_file,
166+
],
167+
capture_output=True,
168+
check=True,
169+
)
170+
print(
171+
"Successfully disabled CODEOWNERS review requirement in "
172+
"GitHub ruleset."
173+
)
174+
finally:
175+
os.unlink(temp_file)
176+
177+
except subprocess.CalledProcessError as e:
178+
print(f"Failed to update GitHub ruleset: {e}")
179+
print("You may need to manually disable the CODEOWNERS review requirement.")
180+
except Exception as e: # pylint: disable=broad-exception-caught
181+
print(f"Error updating ruleset: {e}")
182+
print("You may need to manually disable the CODEOWNERS review requirement.")
183+
184+
39185
def apply_patch(patch_content: str) -> None:
40186
"""Apply a patch using the patch utility."""
41187
subprocess.run(["patch", "-p1"], input=patch_content.encode(), check=True)

‎cookiecutter/{{cookiecutter.github_repo_name}}/.github/workflows/auto-dependabot.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Auto-merge Dependabot PRs
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
10+
jobs:
11+
auto-merge:
12+
if: github.actor == 'dependabot[bot]'
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Auto-merge Dependabot PR
16+
uses: frequenz-floss/dependabot-auto-approve@3cad5f42e79296505473325ac6636be897c8b8a1 # v1.3.2
17+
with:
18+
github-token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
19+
merge-method: 'merge'

‎tests_golden/integration/test_cookiecutter_generation/actor/frequenz-actor-test/.github/workflows/auto-dependabot.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Auto-merge Dependabot PRs
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
10+
jobs:
11+
auto-merge:
12+
if: github.actor == 'dependabot[bot]'
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Auto-merge Dependabot PR
16+
uses: frequenz-floss/dependabot-auto-approve@3cad5f42e79296505473325ac6636be897c8b8a1 # v1.3.2
17+
with:
18+
github-token: ${{ secrets.GITHUB_TOKEN }}
19+
merge-method: 'merge'

‎tests_golden/integration/test_cookiecutter_generation/api/frequenz-api-test/.github/workflows/auto-dependabot.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Auto-merge Dependabot PRs
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
10+
jobs:
11+
auto-merge:
12+
if: github.actor == 'dependabot[bot]'
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Auto-merge Dependabot PR
16+
uses: frequenz-floss/dependabot-auto-approve@3cad5f42e79296505473325ac6636be897c8b8a1 # v1.3.2
17+
with:
18+
github-token: ${{ secrets.GITHUB_TOKEN }}
19+
merge-method: 'merge'

‎tests_golden/integration/test_cookiecutter_generation/app/frequenz-app-test/.github/workflows/auto-dependabot.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Auto-merge Dependabot PRs
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
10+
jobs:
11+
auto-merge:
12+
if: github.actor == 'dependabot[bot]'
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Auto-merge Dependabot PR
16+
uses: frequenz-floss/dependabot-auto-approve@3cad5f42e79296505473325ac6636be897c8b8a1 # v1.3.2
17+
with:
18+
github-token: ${{ secrets.GITHUB_TOKEN }}
19+
merge-method: 'merge'

‎tests_golden/integration/test_cookiecutter_generation/lib/frequenz-test-python/.github/workflows/auto-dependabot.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Auto-merge Dependabot PRs
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
10+
jobs:
11+
auto-merge:
12+
if: github.actor == 'dependabot[bot]'
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Auto-merge Dependabot PR
16+
uses: frequenz-floss/dependabot-auto-approve@3cad5f42e79296505473325ac6636be897c8b8a1 # v1.3.2
17+
with:
18+
github-token: ${{ secrets.GITHUB_TOKEN }}
19+
merge-method: 'merge'

‎tests_golden/integration/test_cookiecutter_generation/model/frequenz-model-test/.github/workflows/auto-dependabot.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Auto-merge Dependabot PRs
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
10+
jobs:
11+
auto-merge:
12+
if: github.actor == 'dependabot[bot]'
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Auto-merge Dependabot PR
16+
uses: frequenz-floss/dependabot-auto-approve@3cad5f42e79296505473325ac6636be897c8b8a1 # v1.3.2
17+
with:
18+
github-token: ${{ secrets.GITHUB_TOKEN }}
19+
merge-method: 'merge'

0 commit comments

Comments
 (0)