Add workflow to sync contrib resource types and publish Bicep extensions#11916
Open
kachawla wants to merge 2 commits into
Open
Add workflow to sync contrib resource types and publish Bicep extensions#11916kachawla wants to merge 2 commits into
kachawla wants to merge 2 commits into
Conversation
Add contrib-update-resource-types.yaml workflow that receives repository_dispatch events from resource-types-contrib whenever its main branch updates. The workflow: 1. Validates the contrib_ref from the dispatch payload as a hex SHA 2. Installs yq (required by make update-resource-types) 3. Runs make update-resource-types to bump go.mod to the latest resource-types-contrib version and copy manifests into deploy/manifest/built-in-providers/ 4. If changes are detected (including new untracked files), opens or updates a PR on the bot/update-resource-types branch 5. Merging that PR triggers the existing build-and-push-bicep-types job in build.yaml, which dispatches to radius-publisher to republish radius:latest with the refreshed contrib types Uses GH_RAD_CI_BOT_PAT for checkout and PR creation so the resulting push triggers CI checks (the default GITHUB_TOKEN cannot trigger workflows on pushes it creates). Part of: unified Bicep extension publishing (PR 3/4) Signed-off-by: Karishma Chawla <kachawla@microsoft.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions workflow that listens for repository_dispatch events from radius-project/resource-types-contrib, runs make update-resource-types to refresh the manifest copies under deploy/manifest/built-in-providers/, and opens (or refreshes) a PR on bot/update-resource-types. Merging that PR triggers the existing build-and-push-bicep-types job to republish the unified Bicep extension.
Changes:
- New workflow
contrib-update-resource-types.yamlreacting toresource-types-contrib-updateddispatch events - Validates the optional
contrib_refpayload as a hex SHA, installs Go + yq, runsmake update-resource-types, and force-pushes tobot/update-resource-types - Uses
actions/github-scriptwithGH_RAD_CI_BOT_PATto create or update the PR idempotently
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #11916 +/- ##
==========================================
- Coverage 51.72% 51.72% -0.01%
==========================================
Files 726 726
Lines 45608 45608
==========================================
- Hits 23593 23589 -4
- Misses 19792 19794 +2
- Partials 2223 2225 +2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Signed-off-by: Karishma Chawla <kachawla@microsoft.com>
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
nithyatsu
approved these changes
May 16, 2026
DariuszPorowski
requested changes
May 16, 2026
| # The default GITHUB_TOKEN cannot trigger workflows on pushes it creates. | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| token: ${{ secrets.GH_RAD_CI_BOT_PAT }} |
Member
There was a problem hiding this comment.
issue: related to radius-project/resource-types-contrib#160 (comment) we must eliminate PATs/fake accounts and use GH Apps
| # deploy/manifest/defaults.yaml. | ||
| run: | | ||
| mkdir -p "${RUNNER_TEMP}/bin" | ||
| GOBIN="${RUNNER_TEMP}/bin" go install github.com/mikefarah/yq/v4@v4.44.3 |
Member
There was a problem hiding this comment.
suggestion: if the tool releases official binaries, then we should use them (with checksums validation if possible) instead of compiling the source on us.
| env: | ||
| CONTRIB_REF: ${{ steps.contrib.outputs.ref }} | ||
| with: | ||
| github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }} |
Member
There was a problem hiding this comment.
issue: same here what I mentioned above - use GH Apps instead of PATs/fake accounts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Today the
radiusBicep extension is published tobiceptypes.azurecr.iovia the existingbuild-and-push-bicep-typesjob inbuild.yaml, which dispatches to theradius-publisherpipeline on every push tomainand on version tag pushes. With #11915 updatingmake generate-bicep-typesto include contrib types, the existing publish pipeline automatically produces the combined extension -- no new publish workflow is needed.However, there is no automation to pull updated resource type manifests from
resource-types-contribinto this repo. When someone merges a schema change or a new resource type in contrib, the manifest copies committed underdeploy/manifest/built-in-providers/must be refreshed manually viamake update-resource-typesbefore the next publish picks them up.This PR adds a workflow that closes that gap by automating the manifest sync.
How it works
What this PR adds
contrib-update-resource-types.yamlHandles
repository_dispatchevents (type:resource-types-contrib-updated) fromresource-types-contrib.Triggers:
repository_dispatch-- fired by the contrib repo'snotify-radius.yamlworkflow (PR 4)workflow_dispatch-- commented out for production, can be enabled during developmentSteps:
contrib_refas a hex commit SHA (informational only -- the actual version fetched is determined bymake update-resource-typeswhich runsgo get ...@latest)make update-resource-typesto parsedefaults.yaml)make update-resource-typesto bumpgo.modto latest contrib and copy manifestsgit status --porcelainto catch both modified and new untracked files), opens or updates a PR on thebot/update-resource-typesbranchradius:latestSecurity:
contrib_refis validated against^[a-f0-9]{7,40}$and passed via environment variables (not inline${{ }}interpolation) to prevent shell and script injectionGH_RAD_CI_BOT_PATfor checkout and PR creation so the resulting push triggers CI checks (the defaultGITHUB_TOKENcannot trigger workflows on pushes it creates)Note: This workflow depends on
make update-resource-typesfrom #11911. It includes a pre-flight check that fails fast with a descriptive error if the target is not yet available.Dependencies
make update-resource-types)GH_RAD_CI_BOT_PATChanges
.github/workflows/contrib-update-resource-types.yaml: New workflowPart of
Unified Bicep extension publishing (PR 3/4). See design doc.