|
| 1 | +title: Automate GitHub for more than CI/CD |
| 2 | +--- |
| 3 | +categories: |
| 4 | +community |
| 5 | +cc-search |
| 6 | +open-source |
| 7 | +--- |
| 8 | +author: zackkrida |
| 9 | +--- |
| 10 | +pub_date: 2020-08-26 |
| 11 | +--- |
| 12 | +body: |
| 13 | + |
| 14 | +> *Get started using GitHub bots and actions for community management and repository health.* |
| 15 | +
|
| 16 | +In late 2018, in the midst of being acquired by Microsoft, GitHub [launched Github Actions](https://github.blog/2018-10-16-future-of-software/) into public beta, allowing users to run code on the popular development platform for the first time. With a straightforward `YAML` configuration syntax and the power of Microsoft's Azure cloud, GitHub Actions quickly rose to compete with existing Continuous Integration (CI) and Continuous Deployment (CD) platforms like **Circle CI** and **Travis CI**. GitHub Actions made it easier than ever for developers to test and deploy software in the cloud, but from the beginning GitHub had bigger plans for the service. |
| 17 | + |
| 18 | +In a [2018 TechCrunch interview](https://techcrunch.com/2018/10/16/github-launches-actions-its-workflow-automation-tool/), GitHub's then head of platform acknowledged the usefulness of actions for more than CI/CD. "I see CI/CD as one narrow use case of actions. It’s so, so much more,” Lambert stressed. “And I think it’s going to revolutionize DevOps because people are now going to build best in breed deployment workflows for specific applications and frameworks, and those become the de facto standard shared on GitHub. […] It’s going to do everything we did for open source again for the DevOps space and for all those different parts of that workflow ecosystem." |
| 19 | + |
| 20 | +At Creative Commons, we use Github Actions and Bots on many of [our open-source projects](https://github.com/creativecommons?type=source) for more than CI/CD—to manage our [community team](/community/community-team/); to automate repository health; and to automate tedious but frequent tasks. The following examples are just a small snapshot of our existing and in-progress automations. |
| 21 | + |
| 22 | +## Example automations |
| 23 | + |
| 24 | +<!-- no toc --> |
| 25 | +- [Release note generation](#automatic-release-note-generation) |
| 26 | +- [Repository normalization](#repository-normalization) |
| 27 | +- [Dependency updates](#automatic-dependency-updates) |
| 28 | + |
| 29 | +### Release note generation |
| 30 | + |
| 31 | +Our frontend Vue.js application for CC Search gets released weekly, and is subject to constant pull requests from myself, one-time volunteers making their first open source contribution, and long-term, dedicated community members who frequently contribute. It's important for us to highlight *all* of these contributions in our release notes, regardless of size or scope. Additionally, we find it useful to group changes into categories, so our users have a clear sense of what kinds of updates we've made. |
| 32 | + |
| 33 | +<div style="text-align: center;"> |
| 34 | + <figure class="margin-bottom-large"> |
| 35 | + <img src="release-notes-screenshot.png" alt="GitHub screenshot of release notes for CC Search" /> |
| 36 | + <figcaption> |
| 37 | + <em> |
| 38 | + An example of CC Search release notes generated by the <a href="https://github.com/marketplace/actions/release-drafter">Release Drafter</a> GitHub Action. |
| 39 | + </em> |
| 40 | + </figcaption> |
| 41 | + </figure> |
| 42 | +</div> |
| 43 | + |
| 44 | +The quality of these release notes made them quite tedious to generate manually. With the [release drafter action](https://github.com/marketplace/actions/release-drafter), we're able to automatically update a draft release note on every pull request to CC Search. The action lets us configure the line added for each pull request with some basic templating which includes variables for the pr number, title, and author (among others): |
| 45 | + |
| 46 | +```yaml |
| 47 | +change-template: '- $TITLE: #$NUMBER by @$AUTHOR' |
| 48 | +``` |
| 49 | +
|
| 50 | +<br />This means each pull request gets a line like this in our release notes: |
| 51 | +
|
| 52 | +> Enable web monetization on single result pages: **#1191** by **@zackkrida** |
| 53 | +
|
| 54 | +Perfect! We can also map GitHub labels on our pull requests to the sections of our generated release notes, like so: |
| 55 | +
|
| 56 | +```yaml |
| 57 | +categories: |
| 58 | + - title: 'New Features' |
| 59 | + label: 'feature' |
| 60 | + - title: 'Bug Fixes' |
| 61 | + label: |
| 62 | + - 'bug' |
| 63 | + - 'critical' |
| 64 | +``` |
| 65 | +
|
| 66 | +The resulting release notes require no manual editing at release time, and has saved us hours over time and allows our developers to focus on DevOps work instead of copywriting on release days. We also never miss a contribution or expression of gratitude to one of our contributors. You can read the [latest CC Search release notes](https://github.com/creativecommons/cccatalog-frontend/releases/latest) or [see our full release-drafter.yml file here](https://github.com/creativecommons/cccatalog-frontend/blob/develop/.github/release-drafter.yml). |
| 67 | +
|
| 68 | +### Repository Normalization |
| 69 | +
|
| 70 | +Within a private repository of internal helper scripts, the CC technical team has a number of Github Actions which trigger Python scripts to keep configuration standardized across our repositories. We casually call this process "repository normalization". One such script ensures that we use a standard set of GitHub labels across all of our projects. This consistency helps us do things like direct users to [open issues in need of assistance](https://github.com/search?q=org%3Acreativecommons+label%3A%22help+wanted%22+state%3Aopen&type=Issues) across the organization, or issues [good for first-time open source contributors](https://github.com/search?q=org%3Acreativecommons+label%3A%22good+first+issue%22+state%3Aopen&type=Issues). With GitHub Actions, its easy to set up scheduled tasks with only a few lines of human-readable configuration. Here's the gist of running a Python script daily, for example: |
| 71 | +
|
| 72 | +```yaml |
| 73 | +name: Example scheduled python action |
| 74 | +on: |
| 75 | + schedule: |
| 76 | + - cron: '0 0 * * *' |
| 77 | + push: |
| 78 | + branches: |
| 79 | + - master |
| 80 | +jobs: |
| 81 | + build: |
| 82 | + runs-on: ubuntu-latest |
| 83 | + steps: |
| 84 | + - uses: actions/checkout@v2 |
| 85 | + - name: Set up Python 3.7 |
| 86 | + uses: actions/setup-python@v1 |
| 87 | + with: |
| 88 | + python-version: 3.7 |
| 89 | + - name: Install dependencies |
| 90 | + run: | |
| 91 | + python -m pip install --upgrade pip |
| 92 | + python -m pip install pipenv |
| 93 | + pipenv install |
| 94 | + - name: Export token to env and run our script |
| 95 | + run: | |
| 96 | + pipenv run python our-script.py |
| 97 | + env: |
| 98 | + ADMIN_GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }} |
| 99 | +``` |
| 100 | +
|
| 101 | +Internally and publicly, we use [GitHub Projects](https://github.com/orgs/creativecommons/projects) to manage our bi-weekly sprints and backlogs. The [GitHub Project Bot](https://github.com/subhamX/github-project-bot) action was built by [one of our community contributors](https://github.com/subhamX) and allows us to add pull requests to our project columns. Here's an example step in such a job: |
| 102 | +
|
| 103 | +```yaml |
| 104 | +- name: Handle cccatalog-frontend Repo |
| 105 | + uses: subhamX/github-project-bot@v1.0.0 |
| 106 | + with: |
| 107 | + ACCESS_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }} |
| 108 | + COLUMN_NAME: "In Progress (Community)" |
| 109 | + PROJECT_URL: https://github.com/orgs/creativecommons/projects/7 |
| 110 | + REPO_URL: https://github.com/creativecommons/cccatalog-frontend |
| 111 | +``` |
| 112 | +
|
| 113 | +We have additional scripts that sync our community team members across our open source website and GitHub, and several others that do even more of this cross-platform synchronization work. All of these scripts relive significant burden off of our engineering manager and open source community coordinator. |
| 114 | +
|
| 115 | +### Dependency Updates |
| 116 | +
|
| 117 | +Modern JavaScript projects are built atop piles of 3rd party dependencies. This frees developers to focus on product code instead of writing the same utility code over and over again, but exposes projects to issues of security and dependency management. To help alleviate these issues, GitHub [acquired a startup called Dependabot](https://github.blog/2019-05-23-introducing-new-ways-to-keep-your-code-secure/#automated-security-fixes-with-dependabot) which initially focused on automatic security updates for repositories. Dependabot creates pull requests that update third-party code with known security vulnerabilities to the latest safe and stable versions. |
| 118 | +
|
| 119 | +This summer (June 2020), GitHub [expanded dependabot's scope](https://github.blog/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot/) to keep *all* third-party code up to date, regardless of security. By adding a `dependabot-config.yml` file to any repo, developers no longer need to keep track of dependency updates on their own. |
| 120 | + |
| 121 | +<div style="text-align: center;"> |
| 122 | + <figure class="margin-bottom-large"> |
| 123 | + <img src="dependabot-example.png" alt="GitHub screenshot of a Dependabot PR message" /> |
| 124 | + <figcaption> |
| 125 | + <em> |
| 126 | + Dependabot writes pull requests to bump JavaScript dependencies and will automatically resolve merge conflicts and keep the PR up to date. |
| 127 | + </em> |
| 128 | + </figcaption> |
| 129 | + </figure> |
| 130 | +</div> |
| 131 | + |
| 132 | +If your project has strong test coverage and a solid quality control process for release management, Dependabot pull requests can be made even more powerful with the [Merge Me Action.](https://github.com/ridedott/merge-me-action) Merge Me can be added to the end of any series of Github Actions to automatically merge pull requests that pass all CI tests which were authored by a particular user (the action assumes `dependabot` by default). This means your repository can have highly-configurable, fully-automated dependency updates in just a few lines of `YAML`. |
| 133 | + |
| 134 | +## Here's a few more |
| 135 | + |
| 136 | +Here's some smaller and simpler automations that can make a huge difference in your workflows. |
| 137 | + |
| 138 | +- [Automatically close old PRs after a period of inactivity](https://github.com/probot/stale) |
| 139 | +- [Automate security releases on Sentry](https://github.blog/2020-08-24-automate-releases-and-more-with-the-new-sentry-release-github-action/) |
| 140 | +- [Add reminders to issues and pull requests](https://github.com/probot/reminders) |
| 141 | + |
| 142 | + |
| 143 | +These examples are a small sample of the non-CI/CD capabilities of GitHub Actions. You can peek in the `.github/` directory of any of our open source repositories to see the actions we're using, and feel free to make an issue on any project if you have an idea for an automation of your own. As we increase the number and quality of integrations in our open source repositories, we may update this article or create follow-up posts with more examples. |
| 144 | + |
| 145 | +If you're interested in learning more about GitHub Actions, GitHub has a wonderful [marketplace](https://github.com/marketplace?type=actions) of avaliable actions you can explore, and the [documentation for actions](https://docs.github.com/actions) is avaliable in several languages. |
0 commit comments