dependabot: Use gh api to commit and push to have verified commits (#…

…12574) * Use gh api to commit and push to have verified commits * fix * Update .github/workflows/update-dependabot-pr.yml Co-authored-by: Carson Ip <[email protected]> * Update .github/workflows/update-dependabot-pr.yml Co-authored-by: Carson Ip <[email protected]> * Update .github/workflows/update-dependabot-pr.yml --------- Co-authored-by: Carson Ip <[email protected]> Co-authored-by: kruskall <[email protected]>
elastic · Feb 5, 2024 · 31d3bd5 · 31d3bd5
1 parent 3096f30
commit 31d3bd5
Showing 1 changed file with 13 additions and 6 deletions.
diff --git a/.github/workflows/update-dependabot-pr.yml b/.github/workflows/update-dependabot-pr.yml
@@ -25,9 +25,16 @@ jobs:
           go-version-file: go.mod
       - name: Update NOTICE.txt
         run: make notice
-      - run: |
-          git config --global user.name 'dependabot[bot]'
-          git config --global user.email 'dependabot[bot]@users.noreply.github.com'
-          git diff --exit-code NOTICE.txt || (git add NOTICE.txt && git commit -am "Update NOTICE.txt")
-          git push
-          
+      # inspired by https://gist.github.com/swinton/03e84635b45c78353b1f71e41007fc7c
+      - name: Commit changes (signed)
+        run: |
+          export BRANCH=${GITHUB_REF#refs/heads/}
+          export SHA=$(git rev-parse "$BRANCH:$FILE_TO_COMMIT")
+          gh api --method PUT "/repos/${REPO}/contents/$FILE_TO_COMMIT" \
+            --field message="Update $FILE_TO_COMMIT" \
+            --field content="@<(base64 -i $FILE_TO_COMMIT)" \
+            --field sha="${SHA}" \
+            --field branch="${BRANCH}"
+        env:
+          FILE_TO_COMMIT: NOTICE.txt
+          REPO: ${{ github.repository }}