From fbfa10733558f342c8dfb2f08dae9b0163108b1c Mon Sep 17 00:00:00 2001 From: Oliver Lipkau Date: Tue, 15 Sep 2026 07:28:49 +0200 Subject: [PATCH] fix: converge website module updates Reuse one update branch per module while rejecting stale releases. Pin external actions, narrow Pages permissions, and align Configuration with v0.2.10. Refs AtlassianPS/AtlassianPS#13 --- .github/scripts/check-module-submodules.sh | 4 +- .github/workflows/pages.yml | 21 +++++---- .github/workflows/update-submodule.yml | 54 +++++++++++++++++++--- docs/Contributing/module-documentation.md | 2 + modules/AtlassianPS.Configuration | 2 +- 5 files changed, 62 insertions(+), 21 deletions(-) diff --git a/.github/scripts/check-module-submodules.sh b/.github/scripts/check-module-submodules.sh index f5da3ee..b2a051d 100644 --- a/.github/scripts/check-module-submodules.sh +++ b/.github/scripts/check-module-submodules.sh @@ -14,9 +14,7 @@ no_tag_baselines=( ) # Keep docs-only exceptions narrow and remove them after the next module release. -docs_only_exceptions=( - "AtlassianPS.Configuration:555e8a3300a12e03b1d9c494a874fe21fe9bbccf" -) +docs_only_exceptions=() has_no_tag_baseline() { local module="$1" diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 9306a3f..6fa1ec9 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -7,32 +7,30 @@ on: branches: [master] workflow_dispatch: -permissions: - contents: read - pages: write - id-token: write - concurrency: group: pages-${{ github.ref }} cancel-in-progress: true jobs: build: + permissions: + contents: read + pages: read runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: submodules: recursive - name: Setup Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1 with: ruby-version: "3.3" bundler-cache: true - name: Setup Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6 - name: Check module submodules run: bash .github/scripts/check-module-submodules.sh @@ -44,10 +42,13 @@ jobs: - name: Upload artifact if: github.ref == 'refs/heads/master' - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5 deploy: if: github.ref == 'refs/heads/master' + permissions: + pages: write + id-token: write environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }} @@ -56,4 +57,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5 diff --git a/.github/workflows/update-submodule.yml b/.github/workflows/update-submodule.yml index 4ddfece..adf9a47 100644 --- a/.github/workflows/update-submodule.yml +++ b/.github/workflows/update-submodule.yml @@ -14,12 +14,19 @@ on: required: true type: string +permissions: + contents: read + +concurrency: + group: update-submodule-${{ github.event.client_payload.module || inputs.module }} + cancel-in-progress: true + jobs: update: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: submodules: recursive token: ${{ secrets.PAT_TOKEN }} @@ -31,30 +38,63 @@ jobs: - name: Update submodule id: update + env: + MODULE: ${{ github.event.client_payload.module || inputs.module }} + VERSION: ${{ github.event.client_payload.version || inputs.version }} run: | - MODULE="${{ github.event.client_payload.module || inputs.module }}" - VERSION="${{ github.event.client_payload.version || inputs.version }}" + case "$MODULE" in + AtlassianPS.Configuration|ConfluencePS|JiraAgilePS|JiraPS) ;; + *) + echo "::error::Unsupported module: $MODULE" + exit 1 + ;; + esac + echo "module=$MODULE" >> "$GITHUB_OUTPUT" echo "version=$VERSION" >> "$GITHUB_OUTPUT" - + + current_commits=("$(git rev-parse "HEAD:modules/$MODULE")") + rolling_branch="update-$MODULE" + rolling_ref="refs/remotes/origin/$rolling_branch" + + if git ls-remote --exit-code --heads origin "$rolling_branch" >/dev/null; then + git fetch --no-tags origin "refs/heads/$rolling_branch:$rolling_ref" + current_commits+=("$(git rev-parse "$rolling_ref:modules/$MODULE")") + fi + cd "modules/$MODULE" git fetch origin --tags + tag_ref="refs/tags/$VERSION" + if ! git show-ref --verify --quiet "$tag_ref"; then + echo "::error::Release tag $VERSION does not exist for $MODULE." + exit 1 + fi + target_commit=$(git rev-parse --verify "$tag_ref^{commit}") + + for current_commit in "${current_commits[@]}"; do + if ! git merge-base --is-ancestor "$current_commit" "$target_commit"; then + echo "::error::Refusing to replace a current $MODULE release with older or unrelated tag $VERSION." + exit 1 + fi + done + # The runner checkout may normalize tracked files differently from the # submodule commit. The worktree is disposable; always select the # released tag instead of treating those generated changes as user work. - git checkout --force "$VERSION" + git checkout --force "$target_commit" cd ../.. git add "modules/$MODULE" - name: Create Pull Request - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8 with: token: ${{ secrets.PAT_TOKEN }} + add-paths: "modules/${{ steps.update.outputs.module }}" commit-message: "Update ${{ steps.update.outputs.module }} to ${{ steps.update.outputs.version }}" title: "Update ${{ steps.update.outputs.module }} to ${{ steps.update.outputs.version }}" body: | Automated update of ${{ steps.update.outputs.module }} submodule to ${{ steps.update.outputs.version }}. Triggered by: ${{ github.event_name }} - branch: "update-${{ steps.update.outputs.module }}-${{ steps.update.outputs.version }}" + branch: "update-${{ steps.update.outputs.module }}" delete-branch: true diff --git a/docs/Contributing/module-documentation.md b/docs/Contributing/module-documentation.md index 88b1c43..4954667 100644 --- a/docs/Contributing/module-documentation.md +++ b/docs/Contributing/module-documentation.md @@ -9,6 +9,8 @@ The public documentation under `/docs//` should describe the module vers The website consumes module documentation through Git submodules in `modules/`. For normal updates, each module submodule should point at the latest released module tag. +Automated releases reuse one `update-` branch and pull request per module. +A later release refreshes that pull request instead of opening a version-specific stack. This keeps cmdlet documentation, examples, parameters, and behavior notes aligned with the package users get from `Install-Module`. The website must not publish documentation from a module branch that contains unreleased or breaking changes as the main module documentation. diff --git a/modules/AtlassianPS.Configuration b/modules/AtlassianPS.Configuration index 5002485..4e39338 160000 --- a/modules/AtlassianPS.Configuration +++ b/modules/AtlassianPS.Configuration @@ -1 +1 @@ -Subproject commit 5002485e8fb893bd853f705dceefc69a50d5411d +Subproject commit 4e393385a40702d1c825b16f0e917cbb26a6e6f9