Skip to content

Commit 3272eae

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-0000] - use actions for sync copilot (#122)
## Summary - Routine Change ### Details - use action for sync copilot
1 parent 68c2dea commit 3272eae

6 files changed

Lines changed: 50 additions & 231 deletions

File tree

‎.devcontainer/devcontainer.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
},
1313
"updateRemoteUserUID": false
1414
},
15-
"postAttachCommand": "git-secrets --register-aws; git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt",
1615
"mounts": [
1716
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
1817
"source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind",

‎.github/dependabot.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ updates:
1313
commit-message:
1414
prefix: "Upgrade: [dependabot] - "
1515
cooldown:
16-
default-days: 3
16+
default-days: 7
1717

1818
###################################
1919
# Poetry #########################
@@ -29,7 +29,7 @@ updates:
2929
commit-message:
3030
prefix: "Upgrade: [dependabot] - "
3131
cooldown:
32-
default-days: 3
32+
default-days: 7
3333

3434
###################################
3535
# NPM workspace ##################
@@ -45,4 +45,4 @@ updates:
4545
commit-message:
4646
prefix: "Upgrade: [dependabot] - "
4747
cooldown:
48-
default-days: 3
48+
default-days: 7

‎.github/workflows/schedule_dev_container_update.yml‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎.github/workflows/sync_copilot.yml‎

Lines changed: 12 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,78 +1,22 @@
1-
name: Sync copilot instructions
1+
name: Sync Copilot Instructions
22

33
on:
4-
workflow_call:
5-
inputs:
6-
common_workflows_ref:
7-
description: "The ref to sync from the central repository"
8-
required: false
9-
default: "main"
10-
type: string
11-
calling_repo_base_branch:
12-
description: "The base branch from the calling repository that should be merged into"
13-
required: false
14-
type: string
15-
default: main
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 6 * * 1"
167

178
jobs:
18-
sync:
9+
sync-copilot-instructions:
1910
runs-on: ubuntu-22.04
20-
environment: "create_pull_request"
11+
environment: create_pull_request
2112
permissions:
2213
contents: read
23-
pull-requests: write
2414

2515
steps:
26-
- name: Checkout calling repo code
27-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
16+
- name: Sync shared instructions
17+
uses: NHSDigital/eps-copilot-instructions@a7849a16aabd5c1edef13e29467a480fa08555f8
2818
with:
29-
ref: ${{ inputs.calling_repo_base_branch }}
30-
fetch-depth: 0
31-
32-
- name: Checkout central repo code
33-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
34-
with:
35-
ref: ${{ inputs.common_workflows_ref }}
36-
fetch-depth: 0
37-
path: eps-common-workflows
38-
repository: NHSDigital/eps-common-workflows
39-
sparse-checkout: |
40-
.github/instructions/general
41-
.github/instructions/languages
42-
.github/copilot-instructions.md
43-
.github/prompts
44-
45-
- name: Copy central instructions
46-
run: |
47-
rm -rf .github/instructions/general
48-
rm -rf .github/instructions/languages
49-
rm -rf .github/copilot-instructions.md
50-
rm -rf .github/prompts
51-
mkdir -p .github/instructions/
52-
cp -R eps-common-workflows/.github/instructions/general .github/instructions/general
53-
cp -R eps-common-workflows/.github/instructions/languages .github/instructions/languages
54-
cp eps-common-workflows/.github/copilot-instructions.md .github/copilot-instructions.md
55-
cp -R eps-common-workflows/.github/prompts .github/prompts
56-
rm -rf eps-common-workflows
57-
58-
- name: Create GitHub App Token
59-
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
60-
id: generate-token
61-
with:
62-
app-id: "${{ secrets.CREATE_PULL_REQUEST_APP_ID }}"
63-
private-key: "${{ secrets.CREATE_PULL_REQUEST_PEM }}"
64-
65-
- name: Create Pull Request
66-
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
67-
with:
68-
token: "${{ steps.generate-token.outputs.token }}"
69-
commit-message: "Upgrade: [dependabot] - sync Copilot instructions"
70-
title: "Upgrade: [dependabot] - sync Copilot instructions"
71-
body: |
72-
Syncing Copilot instructions from central repo.
73-
Ref: `${{ inputs.common_workflows_ref }}`
74-
branch: copilot-instructions-sync
75-
base: ${{ inputs.calling_repo_base_branch }}
76-
branch-suffix: random
77-
sign-commits: true
78-
delete-branch: true
19+
copilot_instructions_ref: main
20+
calling_repo_base_branch: main
21+
CREATE_PULL_REQUEST_APP_ID: ${{ secrets.CREATE_PULL_REQUEST_APP_ID }}
22+
CREATE_PULL_REQUEST_PEM: ${{ secrets.CREATE_PULL_REQUEST_PEM }}

‎.github/workflows/update-dev-container-version.yml‎

Lines changed: 15 additions & 140 deletions
Original file line numberDiff line numberDiff line change
@@ -1,148 +1,23 @@
1-
name: Update Dev Container Image version
1+
name: Update devcontainer version
2+
23
on:
3-
workflow_call:
4-
inputs:
5-
base_branch:
6-
required: false
7-
type: string
8-
default: main
9-
secrets:
10-
CREATE_PULL_REQUEST_APP_ID:
11-
required: true
12-
CREATE_PULL_REQUEST_PEM:
13-
required: true
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 6 * * 4"
7+
permissions: {}
8+
149
jobs:
15-
update_devcontainer_version:
10+
update-devcontainer-version:
1611
runs-on: ubuntu-22.04
12+
environment: create_pull_request
1713
permissions:
1814
contents: read
1915
packages: read
20-
pull-requests: write
21-
steps:
22-
- name: Checkout code
23-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
24-
with:
25-
fetch-depth: 0
26-
- name: Load config value
27-
id: load-config
28-
run: |
29-
set -euo pipefail
30-
DEVCONTAINER_IMAGE=$(jq -r '.build.args.IMAGE_NAME' .devcontainer/devcontainer.json)
31-
32-
DEVCONTAINER_VERSION=$(jq -r '.build.args.IMAGE_VERSION' .devcontainer/devcontainer.json)
33-
34-
{
35-
echo "DEVCONTAINER_IMAGE=$DEVCONTAINER_IMAGE"
36-
echo "DEVCONTAINER_VERSION=$DEVCONTAINER_VERSION"
37-
} >> "$GITHUB_ENV"
38-
- name: Resolve latest devcontainer image version from GHCR
39-
id: resolve-version
40-
env:
41-
GH_TOKEN: "${{ github.token }}"
42-
run: |
43-
set -euo pipefail
44-
45-
46-
PACKAGE_NAME="eps-devcontainers/${DEVCONTAINER_IMAGE}"
47-
48-
ENCODED_PACKAGE_NAME=$(python3 -c 'import sys, urllib.parse;
49-
print(urllib.parse.quote(sys.argv[1], safe=""))' "$PACKAGE_NAME")
50-
51-
52-
VERSIONS_JSON=$(gh api \
53-
-H "Accept: application/vnd.github+json" \
54-
"/orgs/NHSDigital/packages/container/${ENCODED_PACKAGE_NAME}/versions?per_page=100")
55-
56-
LATEST_VIA_LATEST_TAG=$(jq -r '
57-
[ .[]
58-
| select((.metadata.container.tags // []) | index("latest"))
59-
]
60-
| sort_by(.created_at)
61-
| reverse
62-
| .[0].metadata.container.tags // []
63-
| map(select(test("^v")))
64-
| .[0] // empty
65-
' <<< "$VERSIONS_JSON")
66-
67-
68-
LATEST_V_TAG=$(jq -r '
69-
[ .[]
70-
| {created_at, tags: (.metadata.container.tags // [])}
71-
]
72-
| sort_by(.created_at)
73-
| reverse
74-
| map(.tags[]? | select(test("^v")))
75-
| .[0] // empty
76-
' <<< "$VERSIONS_JSON")
77-
78-
79-
RESOLVED_VERSION="$LATEST_VIA_LATEST_TAG"
80-
81-
if [[ -z "$RESOLVED_VERSION" ]]; then
82-
RESOLVED_VERSION="$LATEST_V_TAG"
83-
fi
84-
85-
86-
if [[ -z "$RESOLVED_VERSION" ]]; then
87-
echo "No version tag matching ^v found for package ${PACKAGE_NAME}" >&2
88-
exit 1
89-
fi
90-
9116

92-
echo "Resolved latest version: ${RESOLVED_VERSION}"
93-
94-
echo "LATEST_DEVCONTAINER_VERSION=${RESOLVED_VERSION}" >> "$GITHUB_ENV"
95-
96-
echo "latest_version=${RESOLVED_VERSION}" >> "$GITHUB_OUTPUT"
97-
- name: Update devcontainer version in config
98-
run: |
99-
set -euo pipefail
100-
101-
102-
TARGET_VERSION='${{ steps.resolve-version.outputs.latest_version }}'
103-
104-
if [[ "$TARGET_VERSION" == "$DEVCONTAINER_VERSION" ]]; then
105-
echo "IMAGE_VERSION is already up to date (${DEVCONTAINER_VERSION})"
106-
exit 0
107-
fi
108-
109-
110-
python3 - <<'PY'
111-
112-
import json
113-
114-
from pathlib import Path
115-
116-
117-
config_file = Path('.devcontainer/devcontainer.json')
118-
119-
config = json.loads(config_file.read_text())
120-
121-
config['build']['args']['IMAGE_VERSION'] = '${{
122-
steps.resolve-version.outputs.latest_version }}'
123-
124-
config_file.write_text(json.dumps(config, indent=2) + '\n')
125-
126-
PY
127-
128-
129-
echo "Updated IMAGE_VERSION from ${DEVCONTAINER_VERSION} to
130-
${LATEST_DEVCONTAINER_VERSION}"
131-
- name: Create GitHub App Token
132-
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
133-
id: generate-token
134-
with:
135-
app-id: "${{ secrets.CREATE_PULL_REQUEST_APP_ID }}"
136-
private-key: "${{ secrets.CREATE_PULL_REQUEST_PEM }}"
137-
- name: Create Pull Request
138-
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
17+
steps:
18+
- name: Update devcontainer version
19+
uses: NHSDigital/eps-update-devcontainer@dc3a8c5f11e7226ee4f5f2bb35bd0d1265092306
13920
with:
140-
token: "${{ steps.generate-token.outputs.token }}"
141-
commit-message: Update devcontainer image version to ${{ steps.resolve-version.outputs.latest_version }}
142-
title: "Upgrade: [dependabot] - Update devcontainer image version to ${{ steps.resolve-version.outputs.latest_version }}"
143-
body: "This PR updates the devcontainer image version to ${{ steps.resolve-version.outputs.latest_version }}."
144-
add-paths: .devcontainer/devcontainer.json
145-
sign-commits: true
146-
base: "${{ inputs.base_branch }}"
147-
delete-branch: true
148-
branch: update-devcontainer-version
21+
calling_repo_base_branch: main
22+
CREATE_PULL_REQUEST_APP_ID: ${{ secrets.CREATE_PULL_REQUEST_APP_ID }}
23+
CREATE_PULL_REQUEST_PEM: ${{ secrets.CREATE_PULL_REQUEST_PEM }}

‎.pre-commit-config.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,26 @@ repos:
1717
files: ^(.github)
1818
- repo: local
1919
hooks:
20+
- id: check-commit-signing
21+
name: Check commit signing
22+
description: Ensures that commits are GPG signed
23+
entry: bash
24+
args:
25+
- -c
26+
- |
27+
if ! git config --get commit.gpgsign | grep -q "true" > /dev/null 2>&1; then
28+
echo "Error: Commit signing is not enabled."
29+
echo "Please enable commit signing with:"
30+
echo " git config commit.gpgsign true"
31+
echo ""
32+
echo "For more information, see: https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
33+
exit 1
34+
fi
35+
echo "Commit signing is properly configured."
36+
language: system
37+
pass_filenames: false
38+
always_run: true
39+
2040
- id: git-secrets
2141
name: Git Secrets
2242
description: git-secrets scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.

0 commit comments

Comments
 (0)