Replace dotnet/actions-create-pull-request with local composite action#15964
Merged
Replace dotnet/actions-create-pull-request with local composite action#15964
Conversation
…out step and create-pull-request action.
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 15964Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 15964" |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR replaces the repository’s dependency on the external dotnet/actions-create-pull-request action with a local composite action that uses git + gh CLI, then updates the scheduled/dispatch workflows and docs to use the new local action.
Changes:
- Added a new composite action at
.github/actions/create-pull-request/action.ymlto create/update PRs viagh. - Updated 8 workflows (9 call sites) to use the local composite action instead of the external pinned action SHA.
- Updated release process documentation to reference the local action.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
.github/actions/create-pull-request/action.yml |
New composite action implementing commit/push and PR creation via git/gh. |
.github/workflows/generate-api-diffs.yml |
Switched PR creation step to use the local action. |
.github/workflows/generate-ats-diffs.yml |
Switched PR creation step to use the local action. |
.github/workflows/refresh-manifests.yml |
Switched PR creation step to use the local action. |
.github/workflows/refresh-typescript-sdks.yml |
Switched PR creation step to use the local action. |
.github/workflows/update-ai-foundry-models.yml |
Switched PR creation step to use the local action. |
.github/workflows/update-dependencies.yml |
Switched PR creation step to use the local action. |
.github/workflows/update-github-models.yml |
Switched PR creation step to use the local action. |
.github/workflows/release-github-tasks.yml |
Switched PR creation to local action and added branch-already-exists for pre-pushed branches. |
docs/release-process.md |
Updated “approved actions” list to reference the local action. |
Comment on lines
+84
to
+88
| EXISTING_PR=$(gh pr list --head "$BRANCH" --base "$BASE" --json number,url --jq '.[0] // empty') | ||
|
|
||
| if [ -n "$EXISTING_PR" ]; then | ||
| PR_NUMBER=$(echo "$EXISTING_PR" | jq -r '.number') | ||
| PR_URL=$(echo "$EXISTING_PR" | jq -r '.url') |
There was a problem hiding this comment.
This step parses EXISTING_PR with jq, which adds an extra tool dependency. Since gh already supports --jq, you can avoid relying on jq being installed (especially on non-standard/self-hosted runners) by extracting number/url directly in the gh pr list call(s).
Suggested change
| EXISTING_PR=$(gh pr list --head "$BRANCH" --base "$BASE" --json number,url --jq '.[0] // empty') | |
| if [ -n "$EXISTING_PR" ]; then | |
| PR_NUMBER=$(echo "$EXISTING_PR" | jq -r '.number') | |
| PR_URL=$(echo "$EXISTING_PR" | jq -r '.url') | |
| PR_NUMBER=$(gh pr list --head "$BRANCH" --base "$BASE" --json number --jq '.[0].number // empty') | |
| if [ -n "$PR_NUMBER" ]; then | |
| PR_URL=$(gh pr list --head "$BRANCH" --base "$BASE" --json url --jq '.[0].url // empty') |
Member
Author
There was a problem hiding this comment.
Won't fix. jq is pre-installed on all GitHub-hosted runners (ubuntu-latest, windows-latest, macos-latest) and is already used extensively in other steps of release-github-tasks.yml. The extra gh pr list call suggested would double the API requests for the existing-PR path. Not worth the churn for a non-issue.
…, body writing, docs prefix
Contributor
|
Re-running the failed jobs in the CI workflow for this pull request because 3 jobs were identified as retry-safe transient failures in the CI run attempt.
|
Contributor
|
🎬 CLI E2E Test Recordings — 56 recordings uploaded (commit View recordings
📹 Recordings uploaded automatically from CI run #24152394246 |
Member
Author
|
Merging to unblock other workflows. Will address feedback in a follow up. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Replace the external
dotnet/actions-create-pull-requestGitHub Action with a local composite action at.github/actions/create-pull-request/action.yml.Motivation
The
dotnet/actions-create-pull-requestfork is 482 commits behind upstreampeter-evans/create-pull-request, still declaresnode16in itsaction.yml, and has not incorporated the fix foractions/checkout@v6compatibility (peter-evans#4230). This causes all workflows using it to fail withThe process '/usr/bin/git' failed with exit code 128due to duplicate Authorization headers.Changes
.github/actions/create-pull-request/action.yml— a composite action usinggitandghCLI (pre-installed on all runners). No external dependencies, no Node.js version concerns../.github/actions/create-pull-requestinstead ofdotnet/actions-create-pull-request@e8d799aa1f8b17f324f9513832811b0a62f1e0b1:generate-api-diffs.ymlgenerate-ats-diffs.ymlrefresh-manifests.ymlrefresh-typescript-sdks.ymlupdate-ai-foundry-models.ymlupdate-dependencies.ymlupdate-github-models.ymlrelease-github-tasks.yml(2 usages, usingbranch-already-exists: 'true')docs/release-process.mdto reflect the new action reference.Security
A threat model was performed on the composite action:
env:variables (never${{ }}interpolation inrun:blocks) to prevent expression injectioneval— label arguments use bash arrays, PR body uses--body-filewith a temp fileGH_TOKENenv var, never on command linesscheduleorworkflow_dispatch(requires repo write access)Checklist