33A binary tool and GitHub Action for creating signed commits from headless workflows
44
55For the Action, please see [ the action branch] [ action-branch ] and the associated ` action/ `
6- release tags.
6+ release tags. For example usage, see [ Examples ] ( #examples ) .
77
8- ` commit-headless ` is focused on turning local commits (or dirty files) into signed commits on the
9- remote. It does this via the GitHub GraphQL API, more specifically the [ createCommitOnBranch] [ mutation ]
10- mutation.
8+ ` commit-headless ` is focused on turning local commits into signed commits on the remote. It does
9+ this using the GitHub API, more specifically the [ createCommitOnBranch] [ mutation ] mutation. When
10+ commits are created using the API (instead of via ` git push ` ), the commits will be signed and
11+ verified by GitHub on behalf of the owner of the credentials used to access the API.
1112
12- When this API is used with a GitHub App token, the resulting commit will be signed and verified by
13- GitHub on behalf of the application.
1413
1514* NOTE:* One limitation of creating commits using the GraphQL API is that it does not expose any
1615mechanism to set or change file modes. It merely takes the file contents, base64 encoded. This means
@@ -71,7 +70,7 @@ commit changes to, and those files will either be updated/added or deleted in a
7170
7271Note that you cannot delete a file without also adding ` --force ` for safety reasons.
7372
74- Examples :
73+ Usage example :
7574
7675 # Commit changes to these two files
7776 commit-headless commit [flags...] -- README.md .gitlab-ci.yml
@@ -86,47 +85,44 @@ Examples:
8685
8786## Try it!
8887
89- You can try ` commit-headless ` locally. The resulting commits will be authored and committed by you.
90- The commits on ` bot-branch-remote ` in this repository were entirely created via this tool based on
91- local commits created like so:
92-
93- git commit --no-gpg-sign --author='Bot <bot@mailinator.com>'
94-
95- ## Example output
96-
97- The below output was generated from ` commit-headless ` running on some local commits to the
98- ` bot-branch-remote ` branch.
99-
100- All output other than the final commit hash printed at the end is written to stderr, and can be
101- redirected to a file.
102-
103- ``` sh
104- Owner: datadog
105- Repository: commit-headless
106- Branch: bot-branch-remote
107- Commits: 7e94985, 89c7296, b89e749, 9a1a616
108- Current head commit: 84485a25ea7cac03d42eb1571d4d46974ade837b
109- Commit 7e94985979a76a9ef72248007c118dc565bc5715
110- Headline: bot: update README.md
111- Changed files: 1
112- - MODIFY: README.md
113- Commit 89c7296eafeefb6165edf0b27e8b287f4695724e
114- Headline: bot: add botfile.txt
115- Changed files: 1
116- - MODIFY: botfile.txt
117- Commit b89e7494601c5f001bf923386edc4e9cf7d8ec76
118- Headline: bot: remove botfile.txt
119- Changed files: 1
120- - DELETE: botfile.txt
121- Commit 9a1a616c80c44b228e2890b811490a40beb198b9
122- Headline: bot: rename README.md -> README.markdown
123- Changed files: 2
124- - DELETE: README.md
125- - MODIFY: README.markdown
126- Pushed 4 commits.
127- Branch URL: https://github.com/datadog/commit-headless/commits/bot-branch-remote
128- 281ff0fa1204e93c8931a774c6ebe2c69e66eddd
88+ You can easily try ` commit-headless ` locally. Create a commit with a different author (to
89+ demonstrate how commit-headless attributes changes to the original author), and run it with a GitHub
90+ token.
91+
92+ For example, create a commit locally and push it to a new branch using the current branch as the
93+ branch point:
94+
12995```
96+ cd ~/Code/repo
97+ echo "bot commit here" >> README.md
98+ git add README.md
99+ git commit --author='A U Thor <author@example.com>' --message="test bot commit"
100+ HEADLESS_TOKEN=$(ddtool auth github token) commit-headless push \
101+ --target=owner/repo \
102+ --branch=bot-branch \
103+ --branch-from="$(git rev-parse HEAD^)" \ # use the previous commit as our branch point
104+ "$(git rev-parse HEAD)" # push the commit we just created
105+ ```
106+
107+ ## Examples
108+
109+ - This repository uses the action to [ release itself] [ usage-action ] .
110+ - DataDog/service-discovery-platform uses it to [ update bazel dependencies] [ usage-service-disco ] .
111+ - DataDog/web-ui, DataDog/profiling-backend, and DataDog/dogweb all use it [ for the weekly staging reset] [ usage-staging-reset ] .
112+ - DataDog/web-ui uses it for the [ Automated packages lint fix] [ usage-web-ui-lint ] PR commits.
113+ - DataDog/cloud-tf-ci uses it for [ updating the terraform CI image] [ usage-cloud-tf-ci ] .
114+ - DataDog/k8s-platform-resources uses it [ to bump Chart versions] [ usage-k8s-p-r ] .
115+ - DataDog/datadog-vscode uses the action to [ replicate README changes into the public repository] [ usage-vscode ] .
116+ - DataDog/websites-astro uses the action to [ update some site content] [ usage-websites-astro ] .
117+
118+ [ usage-action ] : /.github/workflows/release.yml
119+ [ usage-service-disco ] : https://github.com/DataDog/service-discovery-platform/pull/10615
120+ [ usage-staging-reset ] : https://github.com/DataDog/dogweb/pull/145992
121+ [ usage-web-ui-lint ] : https://github.com/DataDog/web-ui/pull/219111
122+ [ usage-cloud-tf-ci ] : https://github.com/DataDog/cloud-tf-ci/pull/556
123+ [ usage-k8s-p-r ] : https://github.com/DataDog/k8s-platform-resources/pull/16307
124+ [ usage-vscode ] : https://github.com/DataDog/datadog-vscode/blob/main/.github/actions/readme/action.yaml
125+ [ usage-websites-astro ] : https://github.com/DataDog/websites-astro/blob/main/.github/workflows/update-content.yml
130126
131127## Releasing
132128
@@ -148,3 +144,14 @@ $ crane ls registry.ddbuild.io/commit-headless-ci-image
148144
149145Note that the final publish job will fail unless there was also a change to ` version.go ` to avoid
150146overwriting existing releases.
147+
148+ ## Releasing the Action
149+
150+ The action release is simlar to the above process, although driven by a GitHub Workflow (see
151+ ` .github/workflows/release.yml ` ). When a change is made to the default branch, the contents of
152+ ` action-template/ ` are used to create a new commit on the ` action ` branch.
153+
154+ Because the workflow uses the rendered action (and the built binary) to create the commit to the
155+ action branch we are fairly safe from releasing a broken version of the action.
156+
157+ Assuming the previous step works, the workflow will then create a tag of the form ` action/vVERSION ` .
0 commit comments