(maint) Replace shared workflow for version bumps

.github/chainguard/self.version_getter_shared.create-pr.sts.yaml → .github/chainguard/self.bump-private-action-runner-version.create-pr.sts.yaml

@@ -3,10 +3,10 @@ issuer: https://token.actions.githubusercontent.com
 subject: repo:DataDog/documentation:ref:refs/heads/master
 
 claim_pattern:
-  event_name: schedule
+  event_name: (schedule|workflow_dispatch)
   ref: refs/heads/master
   ref_protected: "true"
-  job_workflow_ref: DataDog/documentation/\.github/workflows/version_getter_shared\.yml@refs/heads/master
+  job_workflow_ref: DataDog/documentation/\.github/workflows/bump_private_action_runner_version\.yml@refs/heads/master
 
 permissions:
   contents: write

.github/workflows/bump-private-action-runner-version.yml

@@ -0,0 +1,77 @@
+on:
+  schedule:
+    # At 07:00 on every day-of-week from Monday through Friday.
+    - cron: "0 7 * * 1-5"
+  workflow_dispatch: # allows manual trigger
+
+jobs:
+  private-action-runner-version:
+    permissions:
+      contents: write # for git push
+      id-token: write # Needed to federate tokens.
+    runs-on: ubuntu-latest
+    name: Find latest private action runner version
+    steps:
+      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+        id: octo-sts
+        with:
+          scope: DataDog/documentation
+          policy: self.bump-private-action-runner-version.create-pr.sts.yaml
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+        with:
+          python-version: "3.11"
+      - run: pip install requests semver
+
+      - name: Find and write latest version
+        id: write-version
+        run: |
+          python local/bin/py/version_getter.py \
+          --url "https://api.datadoghq.com/api/v2/on-prem-management-service/runner/latest-image" \
+          --file-name "private_action_runner_version.json"
+
+      - name: Save modified file
+        run: |
+          mkdir -p $RUNNER_TEMP/temp
+          cp ./data/private_action_runner_version.json $RUNNER_TEMP/temp/
+
+      - name: echo new version
+        run: echo ${{ steps.write-version.outputs.new_version }}
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: true
+
+      - name: Restore modified file
+        run: |
+          cp $RUNNER_TEMP/temp/private_action_runner_version.json ./data/
+
+      - name: Write version
+        if: steps.write-version.outputs.new_version == 'true'
+        run: |-
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add ./data/private_action_runner_version.json
+          git commit -m "(Automated) Bump private action runner version"
+          git push -f origin HEAD:refs/heads/automatic-version-update/private-action-runner
+
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        name: Propose change with latest versions
+        if: steps.write-version.outputs.new_version == 'true'
+        with:
+          github-token: ${{ steps.octo-sts.outputs.token }}
+          result-encoding: string
+          script: |
+            await github.rest.pulls.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: "(Automated) Bump version",
+              body: "### Merge instructions\n- [x] Please merge after reviewing",
+              head: "automatic-version-update/private-action-runner",
+              base: "master",
+              maintainer_can_modify: true
+            })

.github/workflows/bump_synthetics_worker_version.yml

@@ -5,12 +5,73 @@ on:
   workflow_dispatch: # allows manual trigger
 
 jobs:
-  call-version-getter-shared-workflow:
+  synthetics_worker_version:
     permissions:
-      contents: write
-      pull-requests: write
-      id-token: write
-    uses: Datadog/documentation/.github/workflows/version_getter_shared.yml@17e5e14da9f9458565bc8925626a069a051c87fa
-    with:
-      url: https://ddsynthetics-windows.s3.amazonaws.com/installers.json
-      file-name: synthetics_worker_versions.json
+      contents: write # for git push
+      id-token: write # Needed to federate tokens.
+    runs-on: ubuntu-latest
+    name: Find latest synthetics-worker version
+    steps:
+      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+        id: octo-sts
+        with:
+          scope: DataDog/documentation
+          policy: self.bump-synthetics-worker-version.create-pr.sts.yaml
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+        with:
+          python-version: "3.11"
+      - run: pip install requests semver
+
+      - name: Find and write latest version
+        id: write-version
+        run: |
+          python local/bin/py/version_getter.py \
+          --url "https://ddsynthetics-windows.s3.amazonaws.com/installers.json" \
+          --file-name "synthetics_worker_versions.json"
+
+      - name: Save modified file
+        run: |
+          mkdir -p $RUNNER_TEMP/temp
+          cp ./data/synthetics_worker_versions.json $RUNNER_TEMP/temp/
+
+      - name: echo new version
+        run: echo ${{ steps.write-version.outputs.new_version }}
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: true
+
+      - name: Restore modified file
+        run: |
+          cp $RUNNER_TEMP/temp/synthetics_worker_versions.json ./data/
+
+      - name: Write version
+        if: steps.write-version.outputs.new_version == 'true'
+        run: |-
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add ./data/synthetics_worker_versions.json
+          git commit -m "(Automated) Bump synthetic worker version"
+          git push -f origin HEAD:refs/heads/automatic-version-update/synthetics-worker
+
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        name: Propose change with latest versions
+        if: steps.write-version.outputs.new_version == 'true'
+        with:
+          github-token: ${{ steps.octo-sts.outputs.token }}
+          result-encoding: string
+          script: |
+            await github.rest.pulls.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: "(Automated) Bump version",
+              body: "### Merge instructions\n- [x] Please merge after reviewing",
+              head: "automatic-version-update/synthetics-worker",
+              base: "master",
+              maintainer_can_modify: true
+            })