Skip to content

Commit 00a41c5

Browse files
watsonwatson
authored
fix(ci): add missing octo-sts policy for license check (#7664)
The update-3rdparty-licenses workflow has been failing on every bot PR since the octo-sts step was introduced (4afd74a) because the corresponding chainguard policy was never created. Split the workflow into two jobs for privilege separation: the license check runs with read-only permissions, while the auto-commit job (id-token: write) only runs for bot PRs and never processes untrusted code.
1 parent 1cdd51b commit 00a41c5

File tree

2 files changed

+113
-62
lines changed

2 files changed

+113
-62
lines changed

‎.github/chainguard/update-3rdparty-licenses.sts.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
issuer: https://token.actions.githubusercontent.com
2+
3+
subject: repo:DataDog/dd-trace-js:pull_request
4+
5+
claim_pattern:
6+
actor: (dependabot\[bot\]|dd-octo-sts\[bot\])
7+
event_name: pull_request
8+
ref: refs/pull/[0-9]+/merge
9+
job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/update-3rdparty-licenses\.yml@refs/pull/[0-9]+/merge
10+
11+
permissions:
12+
contents: write

‎.github/workflows/update-3rdparty-licenses.yml‎

Lines changed: 101 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -6,22 +6,17 @@ on:
66
- "yarn.lock"
77

88
jobs:
9-
update-3rdparty-licenses:
9+
check-licenses:
1010
runs-on: ubuntu-latest
1111
permissions:
1212
contents: read
13-
id-token: write
13+
outputs:
14+
needs_update: ${{ steps.check.outputs.needs_update }}
15+
is_bot_same_repo: ${{ steps.check.outputs.is_bot_same_repo }}
16+
head_oid: ${{ steps.check.outputs.head_oid }}
1417
env:
1518
REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }}
1619
steps:
17-
- name: Mint GitHub App token (octo-sts) for bot PR updates
18-
if: github.event.pull_request.user.type == 'Bot' && github.event_name == 'pull_request'
19-
uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
20-
id: octo-sts
21-
with:
22-
scope: DataDog/dd-trace-js
23-
policy: update-3rdparty-licenses
24-
2520
- name: Check out PR branch
2621
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2722

@@ -74,68 +69,112 @@ jobs:
7469
run: |
7570
cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv
7671
77-
- name: Run LICENSE-3rdparty.csv update check
72+
- name: Check for LICENSE-3rdparty.csv changes
73+
id: check
7874
env:
7975
PR_USER_TYPE: ${{ github.event.pull_request.user.type }}
80-
GITHUB_EVENT_NAME: ${{ github.event_name }}
81-
GITHUB_HEAD_REF: ${{ github.head_ref }}
8276
PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
8377
BASE_REPO: ${{ github.repository }}
84-
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
8578
run: |
8679
set -e
8780
81+
echo "head_oid=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
82+
8883
if git diff --ignore-space-at-eol --exit-code LICENSE-3rdparty.csv; then
8984
echo "✅ LICENSE-3rdparty.csv is already up to date"
85+
echo "needs_update=false" >> $GITHUB_OUTPUT
9086
else
9187
echo "📝 LICENSE-3rdparty.csv was modified by license attribution command"
88+
echo "needs_update=true" >> $GITHUB_OUTPUT
89+
fi
9290
93-
if [[ "$PR_USER_TYPE" == "Bot" ]] && [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]] && [[ "$PR_HEAD_REPO" == "$BASE_REPO" ]]; then
94-
echo "🤖 Bot-created PR detected. Auto-committing LICENSE-3rdparty.csv changes..."
95-
96-
expected_head_oid="$(git rev-parse HEAD)"
97-
contents="$(base64 -w 0 LICENSE-3rdparty.csv)"
98-
99-
variables="$(jq -c \
100-
--arg repo "$GITHUB_REPOSITORY" \
101-
--arg branch "$GITHUB_HEAD_REF" \
102-
--arg msg "Update LICENSE-3rdparty.csv" \
103-
--arg expected "$expected_head_oid" \
104-
--arg path "LICENSE-3rdparty.csv" \
105-
--arg contents "$contents" \
106-
'{
107-
input: {
108-
branch: { repositoryNameWithOwner: $repo, branchName: $branch },
109-
message: { headline: $msg },
110-
expectedHeadOid: $expected,
111-
fileChanges: { additions: [{ path: $path, contents: $contents }] }
112-
}
113-
}'
114-
)"
115-
116-
query='mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid url } } }'
117-
gh api graphql -f query="$query" -f variables="$variables" -q '.data.createCommitOnBranch.commit.url' >/dev/null
118-
119-
echo "✅ Successfully committed and pushed LICENSE-3rdparty.csv updates"
120-
else
121-
echo "❌ The LICENSE-3rdparty.csv file needs to be updated!"
122-
echo ""
123-
echo "The license attribution command has modified LICENSE-3rdparty.csv."
124-
echo ""
125-
echo "To fix this issue:"
126-
echo "1. Set up dd-license-attribution locally by following the installation instructions in:"
127-
echo " https://github.com/DataDog/dd-license-attribution"
128-
echo "2. Run the license CSV generation command locally:"
129-
echo " dd-license-attribution generate-sbom-csv \\"
130-
echo " --no-scancode-strategy \\"
131-
echo " --no-github-sbom-strategy \\"
132-
echo " https://github.com/datadog/dd-trace-js > LICENSE-3rdparty.csv"
133-
echo "3. Append vendored dependencies:"
134-
echo " cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv"
135-
echo "4. Commit the updated LICENSE-3rdparty.csv file"
136-
echo "5. Push your changes"
137-
echo ""
138-
echo "This helps keep the 3rd-party license information accurate."
139-
exit 1
140-
fi
91+
if [[ "$PR_USER_TYPE" == "Bot" ]] && [[ "$PR_HEAD_REPO" == "$BASE_REPO" ]]; then
92+
echo "is_bot_same_repo=true" >> $GITHUB_OUTPUT
93+
else
94+
echo "is_bot_same_repo=false" >> $GITHUB_OUTPUT
14195
fi
96+
97+
- name: Upload updated LICENSE-3rdparty.csv
98+
if: steps.check.outputs.needs_update == 'true' && steps.check.outputs.is_bot_same_repo == 'true'
99+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
100+
with:
101+
name: license-csv
102+
path: LICENSE-3rdparty.csv
103+
if-no-files-found: error
104+
105+
- name: Fail for PRs with outdated licenses
106+
if: steps.check.outputs.needs_update == 'true' && steps.check.outputs.is_bot_same_repo != 'true'
107+
run: |
108+
echo "❌ The LICENSE-3rdparty.csv file needs to be updated!"
109+
echo ""
110+
echo "The license attribution command has modified LICENSE-3rdparty.csv."
111+
echo ""
112+
echo "To fix this issue:"
113+
echo "1. Set up dd-license-attribution locally by following the installation instructions in:"
114+
echo " https://github.com/DataDog/dd-license-attribution"
115+
echo "2. Run the license CSV generation command locally:"
116+
echo " dd-license-attribution generate-sbom-csv \\"
117+
echo " --no-scancode-strategy \\"
118+
echo " --no-github-sbom-strategy \\"
119+
echo " https://github.com/datadog/dd-trace-js > LICENSE-3rdparty.csv"
120+
echo "3. Append vendored dependencies:"
121+
echo " cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv"
122+
echo "4. Commit the updated LICENSE-3rdparty.csv file"
123+
echo "5. Push your changes"
124+
echo ""
125+
echo "This helps keep the 3rd-party license information accurate."
126+
exit 1
127+
128+
auto-commit-licenses:
129+
needs: check-licenses
130+
if: needs.check-licenses.outputs.needs_update == 'true' && needs.check-licenses.outputs.is_bot_same_repo == 'true'
131+
runs-on: ubuntu-latest
132+
permissions:
133+
contents: read
134+
id-token: write
135+
steps:
136+
- name: Mint GitHub App token (octo-sts)
137+
uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
138+
id: octo-sts
139+
with:
140+
scope: DataDog/dd-trace-js
141+
policy: update-3rdparty-licenses
142+
143+
- name: Download updated LICENSE-3rdparty.csv
144+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
145+
with:
146+
name: license-csv
147+
148+
- name: Commit LICENSE-3rdparty.csv via GitHub API
149+
env:
150+
GITHUB_HEAD_REF: ${{ github.head_ref }}
151+
EXPECTED_HEAD_OID: ${{ needs.check-licenses.outputs.head_oid }}
152+
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
153+
run: |
154+
set -e
155+
156+
echo "🤖 Bot-created PR detected. Auto-committing LICENSE-3rdparty.csv changes..."
157+
158+
contents="$(base64 -w 0 LICENSE-3rdparty.csv)"
159+
160+
variables="$(jq -c \
161+
--arg repo "$GITHUB_REPOSITORY" \
162+
--arg branch "$GITHUB_HEAD_REF" \
163+
--arg msg "Update LICENSE-3rdparty.csv" \
164+
--arg expected "$EXPECTED_HEAD_OID" \
165+
--arg path "LICENSE-3rdparty.csv" \
166+
--arg contents "$contents" \
167+
'{
168+
input: {
169+
branch: { repositoryNameWithOwner: $repo, branchName: $branch },
170+
message: { headline: $msg },
171+
expectedHeadOid: $expected,
172+
fileChanges: { additions: [{ path: $path, contents: $contents }] }
173+
}
174+
}'
175+
)"
176+
177+
query='mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid url } } }'
178+
gh api graphql -f query="$query" -f variables="$variables" -q '.data.createCommitOnBranch.commit.url' >/dev/null
179+
180+
echo "✅ Successfully committed and pushed LICENSE-3rdparty.csv updates"

0 commit comments

Comments
 (0)