Pull request automation?

[martincostello]

To aid in the maintenance of Polly (dependabot updates, .NET SDK updates), it would be good to harness GitHub Actions and the GitHub API to perform some tasks automatically to reduce some of the human element.

The initial automation I'd like to add are:

• Approve dependabot updates (based on an allow-list) - example pull request Bump github/codeql-action from 2.3.0 to 2.3.1 justeattakeaway/httpclient-interception#551
• Updating the .NET SDK - example pull request Update .NET SDK to 7.0.203 martincostello/dotnet-patch-automation-sample#107
• Auto-approve .NET SDK updates - example pull request Update .NET SDK to 7.0.203 martincostello/dotnet-patch-automation-sample#107
• Marking old issues and pull requests as stale

To get the most out of this, the first three ideas for automation needs to run as a GitHub user or app (bot), rather than use GITHUB_TOKEN, which has limitations in terms of triggering actions (docs) - otherwise CI runs aren't queued-up.

Assuming others are happy with these ideas, we'd just need a bot (or two; one to edit, one to approve) created in App-vNext (pollybot, polly-reviewer? ideas for better names welcome) and a private key to exchange for an access token to act on the bot's behalf added to the GitHub Actions secrets in this repo.

[martintmk]

@joelhulen, I really like @martincostello suggestion here. Would save us a lot of time. Can we try to go ahead with this?

[joelhulen]

I'm game. What do I need to do?

[martincostello]

To do this, roughly these steps:

1. Create a GitHub application to be a "reviewer" in the App-vNext organisation scoped to the Polly repo. The app will be private so it isn't possible to install to any other organisation. The app needs the following repository permissions to be able to review and merge pull requests:
   • Read and write Contents
   • Read and write Pull requests
   • Read and write Workflows
2. Generate a private key for the reviewer GitHub app
3. Add the reviewer application ID and private key into the GitHub Actions secrets for the Polly repository
4. Create a GitHub application to be the "updater" in the App-vNext organisation scoped to the Polly repo. The app will be private so it isn't possible to install to any other organisation. The app needs the following repository permissions to push commits and create pull requests:
   • Read and write Contents
   • Read and write Pull requests
5. Generate a private key for the updater GitHub app
6. Add the updater application ID and private key into the GitHub Actions secrets for the Polly repository
7. Bonus points for setting the avatar for

After those are set up I can do the pull requests based on the examples I linked to to use the bots to add the automation.

Happy to do a quick call with you to walk through doing the steps of setting up the apps if that's easier.

[martincostello]

Joel and I did a quick call just now and got the bots and secrets set up and installed.

Tomorrow I'll push up a PR adding the workflows and we can check we're happy with the implementation and that everything's set up correctly.