ci: add a github workflow to verify that the release workflows are co…

…rrect (#12603)

Signed-off-by: Callum Styan <callumstyan@gmail.com>

.github/jsonnetfile.json

@@ -8,7 +8,7 @@
           "subdir": "workflows"
         }
       },
-      "version": "main"
+      "version": "124c4d996f9625478a79f1884465e29ea082d224"
     }
   ],
   "legacyImports": true

.github/jsonnetfile.lock.json

@@ -8,8 +8,8 @@
           "subdir": "workflows"
         }
       },
-      "version": "634945b73e8eed4f5161ec08810178ddeca7505b",
-      "sum": "BOnwSjzyOjWwv9ikwJSAgPBNnYHTU2PEDJ0PWY6nr7I="
+      "version": "124c4d996f9625478a79f1884465e29ea082d224",
+      "sum": "8wrJURq48ZBAtZcReO1W7AiXmvUyLqb932Q9sXyfFVo="
     }
   ],
   "legacyImports": false

.github/release-workflows.jsonnet

@@ -1,10 +1,7 @@
 local lokiRelease = import 'workflows/main.jsonnet';
 local build = lokiRelease.build;
 
-local releaseLibRef = std.filter(
-  function(dep) dep.source.git.remote == 'https://github.com/grafana/loki-release.git',
-  (import 'jsonnetfile.json').dependencies
-)[0].version;
+local releaseLibRef = 'main';
 
 local checkTemplate = 'grafana/loki-release/.github/workflows/check.yml@%s' % releaseLibRef;
 

.github/workflows/check.yml

@@ -12,4 +12,4 @@
   "pull_request": {}
   "push":
     "branches":
-    - "main"
+    - "main"

.github/workflows/minor-release-pr.yml

@@ -58,7 +58,7 @@ jobs:
     - id: "get_github_app_token"
       if: "${{ fromJSON(env.USE_GITHUB_APP_TOKEN) }}"
       name: "get github app token"
-      uses: "actions/github-app-token@v1"
+      uses: "actions/create-github-app-token@v1"
       with:
         app-id: "${{ secrets.APP_ID }}"
         owner: "${{ github.repository_owner }}"
@@ -753,7 +753,7 @@ jobs:
     - id: "get_github_app_token"
       if: "${{ fromJSON(env.USE_GITHUB_APP_TOKEN) }}"
       name: "get github app token"
-      uses: "actions/github-app-token@v1"
+      uses: "actions/create-github-app-token@v1"
       with:
         app-id: "${{ secrets.APP_ID }}"
         owner: "${{ github.repository_owner }}"
@@ -826,4 +826,4 @@ name: "Prepare Minor Release PR from Weekly"
 permissions:
   contents: "write"
   id-token: "write"
-  pull-requests: "write"
+  pull-requests: "write"

.github/workflows/patch-release-pr.yml

@@ -58,7 +58,7 @@ jobs:
     - id: "get_github_app_token"
       if: "${{ fromJSON(env.USE_GITHUB_APP_TOKEN) }}"
       name: "get github app token"
-      uses: "actions/github-app-token@v1"
+      uses: "actions/create-github-app-token@v1"
       with:
         app-id: "${{ secrets.APP_ID }}"
         owner: "${{ github.repository_owner }}"
@@ -753,7 +753,7 @@ jobs:
     - id: "get_github_app_token"
       if: "${{ fromJSON(env.USE_GITHUB_APP_TOKEN) }}"
       name: "get github app token"
-      uses: "actions/github-app-token@v1"
+      uses: "actions/create-github-app-token@v1"
       with:
         app-id: "${{ secrets.APP_ID }}"
         owner: "${{ github.repository_owner }}"
@@ -826,4 +826,4 @@ name: "Prepare Patch Release PR"
 permissions:
   contents: "write"
   id-token: "write"
-  pull-requests: "write"
+  pull-requests: "write"

.github/workflows/release.yml

@@ -46,7 +46,7 @@ jobs:
     - id: "get_github_app_token"
       if: "${{ fromJSON(env.USE_GITHUB_APP_TOKEN) }}"
       name: "get github app token"
-      uses: "actions/github-app-token@v1"
+      uses: "actions/create-github-app-token@v1"
       with:
         app-id: "${{ secrets.APP_ID }}"
         owner: "${{ github.repository_owner }}"
@@ -158,7 +158,7 @@ jobs:
     - id: "get_github_app_token"
       if: "${{ fromJSON(env.USE_GITHUB_APP_TOKEN) }}"
       name: "get github app token"
-      uses: "actions/github-app-token@v1"
+      uses: "actions/create-github-app-token@v1"
       with:
         app-id: "${{ secrets.APP_ID }}"
         owner: "${{ github.repository_owner }}"
@@ -219,4 +219,4 @@ name: "create release"
 permissions:
   contents: "write"
   id-token: "write"
-  pull-requests: "write"
+  pull-requests: "write"

.github/workflows/verify-release-workflow.yaml

@@ -0,0 +1,18 @@
+name: Verify release workflow updates
+on: [pull_request]
+jobs:
+  check-release-changes:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: setup go
+      uses: actions/setup-go@v5
+      with:
+        go-version: '1.22.2'
+    - name: setup jsonnet
+      run: |
+        go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
+        go install github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@v0.5.1
+    - name: Check that the release workflows have been updated properly
+      run: |
+          make BUILD_IN_CONTAINER=false release-workflows-check

Makefile

@@ -900,3 +900,9 @@ scan-vulnerabilities: trivy snyk
 release-workflows:
 	pushd $(CURDIR)/.github && jb update && popd
 	jsonnet -SJ .github/vendor -m .github/workflows .github/release-workflows.jsonnet
+
+.PHONY: release-workflows-check
+release-workflows-check:
+	@$(MAKE) release-workflows
+	@echo "Checking diff"
+	@git diff --exit-code -- ".github/workflows/*release*" || (echo "Please build release workflows by running 'make release-workflows'" && false)