chore(ci): add condition for "auto-releasing"

Signed-off-by: John Cowen <[email protected]>

.github/workflows/codeql.yml

@@ -8,8 +8,8 @@ concurrency:
 on:
   push:
     branches: [master, 'release-[0-9]+.[0-9]+']
-  pull_request:
-    branches: [master, 'release-[0-9]+.[0-9]+']
+  # pull_request:
+  #   branches: [master, 'release-[0-9]+.[0-9]+']
   schedule:
     - cron: '31 11 * * 4'
 

.github/workflows/main.yml

@@ -9,8 +9,8 @@ concurrency:
 on:
   push:
     branches: [master, 'release-[0-9]+.[0-9]+']
-  pull_request:
-    types: [opened, reopened, synchronize]
+  # pull_request:
+  #   types: [opened, reopened, synchronize]
 
 permissions:
   contents: read # for checking out the repository (e.g. actions/checkout)

.github/workflows/release.yml

@@ -0,0 +1,169 @@
+name: 'Build and release to kumahq/kuma'
+run-name: 'Build and release to kumahq/kuma (branch: ${{ github.event.workflow_run.head_branch || inputs.branch }})'
+
+# **Note 1**: You can merge a pull request into a release branch of the form
+# “release-$MAJOR.$MINOR” (e.g. “release-2.1”) in order to create the GUI
+# update PR in the matching release branch of the host repository. For this to
+# work, the name of this repository’s release branch must match that of the
+# host repository exactly.
+
+# **Note 2**: Since this workflow can be triggered using the `workflow_run`
+# event type, one needs to pay special attention to the context in which runs
+# will be executed based on this workflow. Most importantly, runs will be using
+# the workflow file found **in the project’s default branch**. This means that
+# context variables like `github.ref` and `github.ref_name` will refer to the
+# default branch **and not the branch that caused the workflow_run event to
+# trigger**. Also, it likely means that to change the behavior of the workflow
+# in a release branch, one will actually have to update the workflow file in
+# the default branch, too.
+
+on:
+  # Allows running the workflow manually.
+  workflow_dispatch:
+    inputs:
+      branch:
+        required: true
+        type: string
+        description: The base branch for which to create a GUI PR (default or release branch)
+      sha:
+        required: true
+        type: string
+        description: The commit hash for which to create a GUI PR
+  workflow_run:
+    workflows: ['Tests']
+    types: [completed]
+    # See “Filter pattern cheat sheet”
+    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
+    branches:
+      - master
+      - release-[0-9]+.[0-9]+
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read # for checking out the repository (e.g. actions/checkout)
+
+# Ensures that we only run one workflow per branch at a time.
+# Already running workflows will be cancelled.
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || inputs.branch }}
+
+jobs:
+  repository:
+    runs-on: ubuntu-latest
+    outputs:
+      token: ${{ steps.topics.outputs.token }}
+      topics: ${{ steps.topics.outputs.topics }}
+    steps:
+      - id: token
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+      - id: topics
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          echo "topics=$(\
+            gh repo view kumahq/kuma-gui \
+              --json repositoryTopics \
+              --jq '.repositoryTopics | map(.name) | join(",")'\
+          )" >> $GITHUB_OUTPUT
+  ##
+  # Creates a pull request in the main application to update its GUI.
+  create-gui-pr:
+    name: Create GUI update PR
+    needs:
+      - repository
+    if: ${{ contains(needs.repository.outputs.topics, 'auto-release') &&
+            (github.event_name == 'workflow_dispatch' ||
+              (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
+            )
+        }}
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    env:
+      SHA: ${{ github.event.workflow_run.head_sha || inputs.sha }}
+      BRANCH: ${{ github.event.workflow_run.head_branch || inputs.branch }}
+    # steps:
+    #   - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+    #     with:
+    #       ref: ${{ env.BRANCH }}
+    #
+    #   - uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
+    #     with:
+    #       node-version-file: '.nvmrc'
+    #
+    #   - run: |
+    #       make install/sync
+    #
+    #   - uses: Kong/public-shared-actions/security-actions/sca@28d20a1f492927f35b00b317acd78f669c45f88b
+    #     id: sbom
+    #     with:
+    #       asset_prefix: kuma-gui
+    #       dir: '.'
+    #       config: .syft.yaml
+    #       fail_build: 'true' # Fail job if critical vulnerabilities are detected
+    #
+    #   - run: |
+    #       make build/sync
+    #
+    #   - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+    #     id: github-app-token
+    #     with:
+    #       app-id: ${{ secrets.APP_ID }}
+    #       private-key: ${{ secrets.APP_PRIVATE_KEY }}
+    #       # Access to kuma needs to be explicitly included here so that a pull request can be opened in that repository.
+    #       owner: ${{ github.repository_owner }}
+    #       repositories: "kuma-gui,kuma"
+    #
+    #   - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+    #     with:
+    #       # This needs to be a token that grants read access to `HOST_REPOSITORY`. If that repository is private, it needs general access to the `repo` scope which grants access to read private repositories. Otherwise, you will run into an error telling you that the checkout actions can’t determine the repository’s default branch. This is on account of a lack of access not because it can’t determine the default branch.
+    #       token: ${{ steps.github-app-token.outputs.token }}
+    #       repository: ${{ vars.HOST_REPOSITORY }}
+    #       ref: ${{ env.BRANCH }}
+    #       path: main-application
+    #
+    #   - run: |
+    #       cd main-application
+    #
+    #       echo 'Copying Grype and SBOM reports ...'
+    #       mkdir -p ${{ vars.HOST_REPORTS_DIRECTORY }}
+    #       rm -f ${{ vars.HOST_REPORTS_DIRECTORY }}/{${{ steps.sbom.outputs.grype-json-report }},${{ steps.sbom.outputs.grype-sarif-report }},${{ steps.sbom.outputs.sbom-spdx-report }},${{ steps.sbom.outputs.sbom-cyclonedx-report }}}
+    #       mv \
+    #         ../${{ steps.sbom.outputs.grype-json-report }} \
+    #         ../${{ steps.sbom.outputs.grype-sarif-report }} \
+    #         ../${{ steps.sbom.outputs.sbom-spdx-report }} \
+    #         ../${{ steps.sbom.outputs.sbom-cyclonedx-report }} \
+    #         ${{ vars.HOST_REPORTS_DIRECTORY }}
+    #
+    #       echo 'Replacing GUI dist files ...'
+    #       rm -rf ${{ vars.HOST_DIST_DIRECTORY }}
+    #       cp -r ../${{ vars.DIST_DIRECTORY }}/ ${{ vars.HOST_DIST_DIRECTORY }}
+    #
+    #   # https://github.com/peter-evans/create-pull-request
+    #   - uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
+    #     with:
+    #       # Note: This token can be a GITHUB_TOKEN if the created PR doesn’t need to trigger workflows `on: push` or `on: pull_request`. However, we definitely need to trigger workflows (e.g. to run test workflows on the PR). Instead, we should use a personal access token (PAT). See https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#triggering-further-workflow-runs for a more detailed explanation.
+    #       token: ${{ steps.github-app-token.outputs.token }}
+    #       path: main-application
+    #       base: ${{ env.BRANCH }}
+    #       commit-message: |
+    #         chore(deps): bump ${{ github.repository }} to ${{ env.SHA }}
+    #
+    #         Bumps ${{ github.repository }} to version [${{ env.BRANCH }}@${{ env.SHA }}](https://github.com/${{ github.repository }}/tree/${{ env.SHA }})
+    #       committer: GitHub <[email protected]>
+    #       author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
+    #       team-reviewers: kuma-maintainers
+    #       signoff: true
+    #       branch: chore/update-gui-in-${{ env.BRANCH }}
+    #       delete-branch: true
+    #       title: 'chore(deps): bump ${{ github.repository }} to ${{ env.SHA }}'
+    #       labels: ci/skip-e2e-test,${{ env.BRANCH }},ci/auto-merge
+    #       body: |
+    #         Bumps ${{ github.repository }} to version  [${{ env.BRANCH }}@${{ env.SHA }}](https://github.com/${{ github.repository }}/tree/${{ env.SHA }})
+    #
+    #         > Changelog: chore(deps): use latest ${{ github.repository }}
+    #       draft: false