Skip to content

Commit 7a89b11

Browse files
anthony-nhsanthony-nhs
authored
New: [AEA-0000] - Tag jira when release is created (#93)
## Summary - Routine Change ### Details - add new optional params to update jira when a when release is created
1 parent 3166a79 commit 7a89b11

File tree

10 files changed

+1803
-160
lines changed

10 files changed

+1803
-160
lines changed

‎.gitallowed‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,5 @@ token = os\.environ\.get\(\"GH_TOKEN\"\)
88
poetry\.lock
99
\-Dsonar\.token=\"\$SONAR_TOKEN\"
1010
token: "\${{ steps\.generate-token\.outputs\.token }}"
11+
id-token: 'write'
12+
id-token: "write"

‎.github/workflows/pull_request.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
secrets:
1515
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
1616
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
17-
17+
1818
pr_title_format_check:
1919
uses: ./.github/workflows/pr_title_check.yml
2020

@@ -30,14 +30,14 @@ jobs:
3030
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
3131
secrets:
3232
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
33-
33+
3434
tag_release:
3535
needs: get_config_values
3636
uses: ./.github/workflows/tag-release-devcontainer.yml
3737
permissions:
38-
contents: read
3938
packages: read
40-
attestations: read
39+
id-token: write
40+
contents: write
4141
with:
4242
dry_run: true
4343
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ jobs:
2020
tag_release:
2121
needs: [quality_checks, get_config_values]
2222
uses: ./.github/workflows/tag-release-devcontainer.yml
23+
permissions:
24+
id-token: write
25+
contents: write
2326
with:
2427
dry_run: false
2528
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

‎.github/workflows/tag-release-devcontainer.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,16 @@ on:
2929
required: false
3030
type: string
3131
default: "main"
32+
update_jira:
33+
description: "Whether to update Jira issues during semantic-release"
34+
required: false
35+
type: boolean
36+
default: false
37+
jira_release_prefix:
38+
description: "Release prefix sent to Jira release tagging"
39+
required: false
40+
type: string
41+
default: ""
3242
extra_artifact_name:
3343
description: "An extra artifact to include in the release"
3444
required: false
@@ -58,8 +68,14 @@ on:
5868
NPM_TOKEN:
5969
required: false
6070
description: "NPM token to publish packages"
71+
EXECUTE_JIRA_LAMBDA_ROLE:
72+
required: false
73+
description: "ARN of the role to assume when executing the Jira update lambda"
6174
jobs:
6275
tag_release:
76+
permissions:
77+
id-token: "write"
78+
contents: "write"
6379
runs-on: ubuntu-22.04
6480
container:
6581
image: ${{ inputs.pinned_image }}
@@ -75,6 +91,16 @@ jobs:
7591
- name: copy .tool-versions
7692
run: |
7793
cp /home/vscode/.tool-versions "$HOME/.tool-versions"
94+
95+
- name: connect to dev account to run release notes lambda
96+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
97+
if: ${{ inputs.update_jira }}
98+
with:
99+
aws-region: eu-west-2
100+
role-to-assume: ${{ secrets.EXECUTE_JIRA_LAMBDA_ROLE }}
101+
role-session-name: execute-jira-lambda-session
102+
unset-current-credentials: true
103+
78104
- name: Clone calling repo
79105
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
80106
with:
@@ -92,6 +118,7 @@ jobs:
92118
package-lock.json
93119
release.config.cjs
94120
releaseNotesTemplates/commit.hbs
121+
packages/
95122
- name: Install semantic release dependencies globally
96123
run: |
97124
cd common_workflow_config
@@ -104,7 +131,9 @@ jobs:
104131
cp release.config.cjs ../
105132
mkdir -p ../releaseNotesTemplates
106133
cp releaseNotesTemplates/commit.hbs ../releaseNotesTemplates/
134+
cp -r packages/semantic_release_jira ../packages/
107135
echo "Current dir is ${PWD}"
136+
echo "NODE_PATH=$(npm root --quiet -g)" >> "$GITHUB_ENV"
108137
- name: Setup Git branch for semantic-release
109138
run: |
110139
# When running from a PR, GitHub checks out a merge commit
@@ -191,6 +220,8 @@ jobs:
191220
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
192221
MAIN_BRANCH: ${{ inputs.main_branch }}
193222
EXTRA_ASSET: ${{ inputs.extra_artifact_name }}
223+
UPDATE_JIRA: ${{ inputs.update_jira }}
224+
JIRA_RELEASE_PREFIX: ${{ inputs.jira_release_prefix }}
194225

195226
- name: Create semantic release tag
196227
if: ${{ !inputs.dry_run }}
@@ -201,6 +232,8 @@ jobs:
201232
TAG_FORMAT: ${{ inputs.tag_format }}
202233
MAIN_BRANCH: ${{ inputs.main_branch }}
203234
EXTRA_ASSET: ${{ inputs.extra_artifact_name }}
235+
UPDATE_JIRA: ${{ inputs.update_jira }}
236+
JIRA_RELEASE_PREFIX: ${{ inputs.jira_release_prefix }}
204237
run: |
205238
npx semantic-release --tag-format "${TAG_FORMAT}"
206239

‎.trivyignore.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,6 @@ vulnerabilities:
3131
- id: CVE-2026-2229
3232
statement: undici vulnerability accepted as risk
3333
expired_at: 2026-06-01
34+
- id: CVE-2026-33036
35+
statement: fast-xml-parser vulnerability accepted as risk
36+
expired_at: 2026-06-01

0 commit comments

Comments
 (0)