Release from main and split Prisma CLI bumps into their own workflow #1996
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| name: Bump Prisma CLI | ||
| run-name: "Bump Prisma CLI to ${{ inputs.prisma_version }} on ${{ inputs.ref || 'main' }}" | ||
|
|
||
| # Updates the Prisma CLI dependencies and pushes the change to the branch. | ||
| # | ||
| # Publishing is a separate workflow. A bump pushed to main triggers an insider | ||
| # release through release.yml's push trigger; a stable release is always a | ||
| # manual dispatch of release.yml. | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| prisma_version: | ||
| description: 'Prisma CLI version to pin the dependencies to (e.g. 7.9.0)' | ||
| required: true | ||
| ref: | ||
| description: 'Branch to bump. Defaults to main. Use an x.y.x branch to patch an older version.' | ||
| required: false | ||
|
|
||
| concurrency: | ||
| group: bump-prisma | ||
| cancel-in-progress: false | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| env: | ||
| ENVIRONMENT: ${{ secrets.ENVIRONMENT }} | ||
| PRISMA_TELEMETRY_INFORMATION: 'language-tools bump_prisma.yml' | ||
|
|
||
| jobs: | ||
| pin: | ||
| name: Pin the Prisma CLI dependencies | ||
| if: github.repository == 'prisma/language-tools' | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 10 | ||
| outputs: | ||
| ref: ${{ steps.validate.outputs.ref }} | ||
| steps: | ||
| - name: Validate inputs | ||
| id: validate | ||
| env: | ||
| PRISMA_VERSION: ${{ inputs.prisma_version }} | ||
| INPUT_REF: ${{ inputs.ref }} | ||
| run: | | ||
| if ! echo "$PRISMA_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then | ||
| echo "'$PRISMA_VERSION' is not a Prisma CLI version." >&2 | ||
| exit 1 | ||
| fi | ||
| REF="${INPUT_REF:-main}" | ||
| case "$REF" in | ||
| main) ;; | ||
| *) | ||
| if ! echo "$REF" | grep -Eq '^[0-9]+\.[0-9]+\.x$'; then | ||
| echo "Refusing to bump '$REF'. Bumps run on main or an x.y.x patch branch." >&2 | ||
| exit 1 | ||
| fi | ||
| ;; | ||
| esac | ||
| echo "ref=$REF" >> "$GITHUB_OUTPUT" | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ steps.validate.outputs.ref }} | ||
| persist-credentials: false | ||
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v4 | ||
| - name: Use Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '22' | ||
| cache: 'pnpm' | ||
| - name: Install Dependencies | ||
| run: pnpm install | ||
| - name: Pin the Prisma CLI dependencies | ||
| env: | ||
| PRISMA_VERSION: ${{ inputs.prisma_version }} | ||
| run: node scripts/bump_prisma_dependencies.mjs "$PRISMA_VERSION" | ||
| - name: Update the lockfile | ||
| run: pnpm install --no-frozen-lockfile | ||
| - name: Upload the pinned manifests | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: pinned-manifests | ||
| path: | | ||
| packages/language-server/package.json | ||
| pnpm-lock.yaml | ||
| if-no-files-found: error | ||
|
|
||
| push: | ||
| name: Commit and push the bump | ||
| needs: [pin] | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 10 | ||
| env: | ||
| REF: ${{ needs.pin.outputs.ref }} | ||
| PRISMA_VERSION: ${{ inputs.prisma_version }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ needs.pin.outputs.ref }} | ||
| token: ${{ secrets.PRISMA_BOT_TOKEN }} | ||
| - name: Download the pinned manifests | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: pinned-manifests | ||
| - name: Commit and push | ||
| run: | | ||
| if git diff --quiet; then | ||
| echo "Dependencies are already pinned to $PRISMA_VERSION, nothing to commit." | ||
| exit 0 | ||
| fi | ||
| sh scripts/set_git_credentials.sh | ||
| git commit -am "bump Prisma CLI to $PRISMA_VERSION" | ||
| git push origin "HEAD:$REF" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,11 @@ | ||
| name: Check for Prisma CLI update | ||
|
|
||
| # Polls npm for new Prisma CLI versions and starts the Bump Prisma CLI | ||
| # workflow (bump_prisma.yml) for every channel that has a new version: | ||
| # | ||
| # - dev, latest -> bump main; the push to main publishes an insider release, | ||
| # and a stable release is a manual dispatch of release.yml | ||
| # - patch-dev -> bump the x.y.x patch branch, then release from it | ||
|
|
||
| on: | ||
| # Scheduled trigger disabled: ORM iteration is paused; CLI-update polling | ||
|
|
@@ -14,6 +14,13 @@ on: | |
| # - cron: '*/5 * * * *' | ||
| workflow_dispatch: | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
|
|
||
| concurrency: | ||
| group: check-for-prisma-update | ||
| cancel-in-progress: false | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| env: | ||
| ENVIRONMENT: ${{ secrets.ENVIRONMENT }} | ||
| PRISMA_TELEMETRY_INFORMATION: 'language-tools check_for_prisma_update.yml' | ||
|
|
@@ -24,13 +31,15 @@ jobs: | |
| if: github.repository == 'prisma/language-tools' | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 7 | ||
| outputs: | ||
| dev_version: ${{ steps.check_update.outputs.dev_version }} | ||
| latest_version: ${{ steps.check_update.outputs.latest_version }} | ||
| patch_dev_version: ${{ steps.check_update.outputs.patch-dev_version }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: main | ||
| persist-credentials: false | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v4 | ||
| - name: Use Node.js | ||
|
|
@@ -40,44 +49,58 @@ jobs: | |
| cache: 'pnpm' | ||
| - name: Install Dependencies | ||
| run: pnpm install | ||
| - name: Check for Prisma CLI update | ||
| id: check_update | ||
| run: node scripts/check_for_update.mjs | ||
|
|
||
| record: | ||
| name: Record versions and start the bumps | ||
| needs: [check] | ||
| if: needs.check.outputs.dev_version || needs.check.outputs.latest_version || needs.check.outputs.patch_dev_version | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 7 | ||
| env: | ||
| DEV_VERSION: ${{ needs.check.outputs.dev_version }} | ||
| LATEST_VERSION: ${{ needs.check.outputs.latest_version }} | ||
| PATCH_DEV_VERSION: ${{ needs.check.outputs.patch_dev_version }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: main | ||
| token: ${{ secrets.PRISMA_BOT_TOKEN }} | ||
| fetch-depth: 0 # patch branches are created from release tags | ||
|
Comment on lines
+67
to
+71
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win Disable credential persistence in the
🧰 Tools🪛 zizmor (1.29.0)[warning] 67-71: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 67-67: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSources: MCP tools, Linters/SAST tools |
||
| - name: Record new versions | ||
| run: | | ||
| sh scripts/set_git_credentials.sh | ||
| if [ -n "$DEV_VERSION" ]; then echo "$DEV_VERSION" > scripts/versions/prisma_dev; fi | ||
| if [ -n "$LATEST_VERSION" ]; then echo "$LATEST_VERSION" > scripts/versions/prisma_latest; fi | ||
| if [ -n "$PATCH_DEV_VERSION" ]; then echo "$PATCH_DEV_VERSION" > scripts/versions/prisma_patch-dev; fi | ||
| git commit -am "[skip ci] record new Prisma CLI versions" | ||
| git push origin HEAD:main | ||
|
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
file=".github/workflows/check_for_prisma_update.yml"
printf '%s\n' '--- workflow excerpt ---'
cat -n "$file" | sed -n '1,120p'
printf '%s\n' '--- referenced workflow names and marker logic ---'
rg -n -C 3 'bump_prisma|gh workflow run|git push|marker|PRISMA_BOT_TOKEN|persist-credentials|workflow_dispatch' .github/workflows "$file"Repository: prisma/language-tools Length of output: 28835 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- update checker ---'
cat -n scripts/check_for_update.mjs | sed -n '1,240p'
printf '%s\n' '--- bump workflow ---'
cat -n .github/workflows/bump_prisma.yml | sed -n '1,135p'
printf '%s\n' '--- version marker references ---'
rg -n -C 4 'prisma_(dev|latest|patch-dev)|set_git_credentials|check_for_update' scripts .github/workflowsRepository: prisma/language-tools Length of output: 9959 🌐 Web query:
💡 Result: The Citations:
Delay version-marker acknowledgement until all bump runs succeed
🤖 Prompt for AI AgentsSource: MCP tools |
||
| - name: Create the patch branch if it is new | ||
| id: patch_branch | ||
| if: needs.check.outputs.patch_dev_version | ||
| run: | | ||
| BRANCH=$(node scripts/setup_branch.mjs patch-dev) | ||
| if [ -z "$(git ls-remote --heads origin "$BRANCH")" ]; then | ||
| # New patch branch: base it on the last marketplace-tested stable release | ||
| git branch "$BRANCH" "$(cat scripts/versions/tested_extension_stable)" | ||
| git push origin "$BRANCH" | ||
| fi | ||
| echo "branch=$BRANCH" >> "$GITHUB_OUTPUT" | ||
| - name: Bump main (Prisma dev) | ||
| if: needs.check.outputs.dev_version | ||
| env: | ||
| GH_TOKEN: ${{ secrets.PRISMA_BOT_TOKEN }} | ||
| run: gh workflow run bump_prisma.yml --ref main -f prisma_version="$DEV_VERSION" | ||
| - name: Bump main (Prisma latest) | ||
| if: needs.check.outputs.latest_version && !needs.check.outputs.dev_version | ||
| env: | ||
| GH_TOKEN: ${{ secrets.PRISMA_BOT_TOKEN }} | ||
| run: gh workflow run bump_prisma.yml --ref main -f prisma_version="$LATEST_VERSION" | ||
| - name: Bump the patch branch (Prisma patch-dev) | ||
| if: needs.check.outputs.patch_dev_version | ||
| env: | ||
| GH_TOKEN: ${{ secrets.PRISMA_BOT_TOKEN }} | ||
| BRANCH: ${{ steps.patch_branch.outputs.branch }} | ||
| run: gh workflow run bump_prisma.yml --ref main -f prisma_version="$PATCH_DEV_VERSION" -f ref="$BRANCH" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: prisma/language-tools
Length of output: 8461
🌐 Web query:
GitHub Actions official documentation pin actions to full length commit SHA tags mutable💡 Result:
Yes, official GitHub Actions documentation explicitly recommends pinning actions to a full-length (40-character) commit SHA to ensure security and immutability [1][2]. Why pinning to a full-length commit SHA is recommended: - Immutability: Unlike version tags (e.g., v1, v2) or branches (e.g., main), which are mutable pointers that can be moved or deleted, a full-length commit SHA is an immutable identifier for a specific version of code [1][2][3]. - Security: Pinning to a SHA mitigates the risk of supply chain attacks where a malicious actor gains access to an action's repository and updates a tag to point to compromised code [1][4][3]. - Policy Enforcement: GitHub now supports organization and repository-level policies that can be configured to require workflows to use only full-length commit SHAs for actions [1][5]. Workflows that do not comply with this policy will fail [5]. Recommended Best Practice: To maintain the security benefits of SHA pinning while still easily tracking updates, it is widely recommended to pin to the full-length SHA while including the human-readable version as a comment on the same line [6][4][7]. This allows automated tools like Dependabot to identify and suggest updates while your workflow remains pinned to an immutable reference [6][4][3]. Example usage: uses: actions/checkout@b4ffde6 # v4.1.1
Citations:
Pin every GitHub Action to a full-length commit SHA.
The listed
@v4references are mutable tags. A retargeted tag can change action code. Theactions/checkoutsteps also passPRISMA_BOT_TOKENto that code.🧰 Tools
🪛 zizmor (1.29.0)
[error] 61-61: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
📍 Affects 2 files
.github/workflows/bump_prisma.yml#L61-L61(this comment).github/workflows/bump_prisma.yml#L66-L66.github/workflows/bump_prisma.yml#L68-L68.github/workflows/bump_prisma.yml#L81-L81.github/workflows/bump_prisma.yml#L98-L98.github/workflows/bump_prisma.yml#L103-L103.github/workflows/check_for_prisma_update.yml#L35-L35.github/workflows/check_for_prisma_update.yml#L39-L39.github/workflows/check_for_prisma_update.yml#L41-L41.github/workflows/check_for_prisma_update.yml#L62-L62🤖 Prompt for AI Agents
Source: Linters/SAST tools