search

spiffe / helm-charts

Helm charts for SPIRE and other SPIFFE components.
Apache License 2.0
20 stars 22 forks source link

Use deploy key in actions that create PRs #477

Closed faisal-memon closed 1 year ago

faisal-memon commented 1 year ago

Following steps in this medium article to hopefully fix issue where tests don't run for auto created PRs. Alternative approach is to create a bot account and use a PAT from that.

fixes #334 (hopefully)

marcofranssen commented 1 year ago

Why are we doing this? This is an anti pattern as it circumvents the permissions system in GH workflows.

Normally you just need to do following:

permissions:
  contents: write

This will allow the workflow to make a commit so we don't have to manage our own keys.

kfox1111 commented 1 year ago

Why are we doing this? This is an anti pattern as it circumvents the permissions system in GH workflows.

Normally you just need to do following:

permissions:
  contents: write

This will allow the workflow to make a commit so we don't have to manage our own keys.

Because the github workflows are broken with regard to submitting pr's that actually have their tests run automatically. :/

marcofranssen commented 1 year ago

Did some additional research.

https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#triggering-further-workflow-runs

  1. Seems if we want to do with deploy keys all workflows need to have the push event added as well in this PR. That also means it is a different workflow run and therefore also a different mandatory check, which complicates what we are doing.

  2. Another good option to me is the GitHub app option which also works on the pull_request event, so we don't have to change the workflow triggers and the mandotory checks in branch protection.

  3. As a workaround to trigger the workflow they also suggest to close and reopen the PR which also triggers the workflows, which is 2 manual clicks on these PRs. This would also allow us to stick with current merge checks as we don't have to change workflow triggers and such.

faisal-memon commented 1 year ago

Thanks @marcofranssen for doing the research. Seems like this option won't work. Will look into the github app option.