Skip to content

Create a GH issue when trusted root certs are outdated #235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
asgrim merged 3 commits into from
May 6, 2025
Merged

Create a GH issue when trusted root certs are outdated #235

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
da2745b
Create a GH issue when trusted root certs are outdated
asgrim May 5, 2025
651db3b
Check for existing trusted root update issue before making a new one
asgrim May 6, 2025
b8273f4
Run trusted root cert update check daily
asgrim May 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/check-outdated-trusted-root.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: "Check for outdated trusted root certificates"

on:
schedule:
- cron: "0 0 * * *"

jobs:
Copy link
Member

@TimWolla TimWolla May 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing permissions section: I believe all repositories in the php/* organization are configured with read-only GHA permissions by default. Thus this is unable to create the issue. You'll need:

permissions:
  contents: read
  issues: write

see: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token

Copy link
Contributor Author

@asgrim asgrim May 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Good catch, tested it on my own fork, but that doesn't have that restriction I think :) #237

Copy link
Member

@TimWolla TimWolla May 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Quite possible. Organization-owned repositories behave a little differently. You can sync up the permissions here by switching to the second setting:

image

That would likely be at https://github.com/asgrim/pie/settings/actions

check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Pull new trusted root
run: gh attestation trusted-root > resources/new-trusted-root.jsonl
- name: Create an issue if different
env:
GH_TOKEN: ${{ github.token }}
run: |
diff resources/trusted-root.jsonl resources/new-trusted-root.jsonl \
&& echo "Trusted root cert has not changed, no action required." \
|| ( \
(gh issue list | grep -i "Trusted root needs updating") \
Copy link
Member

@TimWolla TimWolla May 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this might not work if too many open issues exist. This should not happen in practice, but perhaps you could make this a little smarter by leveraging the filter flags: https://cli.github.com/manual/gh_issue_list

Something: gh issue list --author "github-actions[bot]" might help. Or just create a dedicated label.

&& echo "Issue to update trusted root already exists, no action required." \
|| gh issue create --title "Trusted root needs updating" --body "The trusted root certificate file needs updating. Use the \`gh attestation trusted-root > resources/trusted-root.jsonl\` command to update it." --assignee "asgrim" \
)