From e82135fa3e9121ef666d788c7d9e8ec40877a19b Mon Sep 17 00:00:00 2001
From: Baptiste Augrain <daiyam@zokugun.org>
Date: Mon, 6 Jan 2025 16:23:34 +0100
Subject: [PATCH] ci: use verified commit (#2186)

---
 .github/workflows/insider-spearhead.yml | 13 ++++++++++---
 .github/workflows/stable-spearhead.yml  | 13 ++++++++++---
 update_upstream.sh                      | 15 +++++++--------
 3 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/insider-spearhead.yml b/.github/workflows/insider-spearhead.yml
index 71b09ea..0b814fd 100644
--- a/.github/workflows/insider-spearhead.yml
+++ b/.github/workflows/insider-spearhead.yml
@@ -58,11 +58,18 @@ jobs:
 
       - name: Update upstream version
         run: ./update_upstream.sh
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
         if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
 
+      - name: Commit changes
+        uses: iarekylew00t/verified-bot-commit@v1
+        with:
+          ref: env.COMMIT_REF
+          message: env.COMMIT_MESSAGE
+          token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          files: |
+            upstream/*.json
+        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_COMMIT == 'yes'
+
       - name: Prepare source
         run: ./prepare_src.sh
         if: env.SHOULD_BUILD == 'yes'
diff --git a/.github/workflows/stable-spearhead.yml b/.github/workflows/stable-spearhead.yml
index 2a5c7b5..e5aa7f8 100644
--- a/.github/workflows/stable-spearhead.yml
+++ b/.github/workflows/stable-spearhead.yml
@@ -53,11 +53,18 @@ jobs:
 
       - name: Update upstream version
         run: ./update_upstream.sh
-        env:
-          GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
-          GITHUB_USERNAME: ${{ github.repository_owner }}
         if: env.SHOULD_BUILD == 'yes' && github.event.inputs.dont_update != 'true'
 
+      - name: Commit changes
+        uses: iarekylew00t/verified-bot-commit@v1
+        with:
+          ref: env.COMMIT_REF
+          message: env.COMMIT_MESSAGE
+          token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
+          files: |
+            upstream/*.json
+        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_COMMIT == 'yes'
+
       - name: Prepare source
         run: ./prepare_src.sh
         if: env.SHOULD_BUILD == 'yes'
diff --git a/update_upstream.sh b/update_upstream.sh
index eceff8b..bde5f7d 100755
--- a/update_upstream.sh
+++ b/update_upstream.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# shellcheck disable=SC2129
 
 set -e
 
@@ -15,19 +16,17 @@ fi
 jsonTmp=$( cat "./upstream/${VSCODE_QUALITY}.json" | jq --arg 'tag' "${MS_TAG/\-insider/}" --arg 'commit' "${MS_COMMIT}" '. | .tag=$tag | .commit=$commit' )
 echo "${jsonTmp}" > "./upstream/${VSCODE_QUALITY}.json" && unset jsonTmp
 
-git config user.email "$( echo "${GITHUB_USERNAME}" | awk '{print tolower($0)}' )-ci@not-real.com"
-git config user.name "${GITHUB_USERNAME} CI"
 git add .
 
 CHANGES=$( git status --porcelain )
 
 if [[ -n "${CHANGES}" ]]; then
-  git commit -m "build(${VSCODE_QUALITY}): update to commit ${MS_COMMIT:0:7}"
+  COMMIT_MESSAGE="build(${VSCODE_QUALITY}): update to commit ${MS_COMMIT:0:7}"
+  COMMIT_REF=$( git rev-parse --abbrev-ref HEAD )
 
-  BRANCH_NAME=$( git rev-parse --abbrev-ref HEAD )
-
-  if ! git push origin "${BRANCH_NAME}" --quiet; then
-    git pull origin "${BRANCH_NAME}"
-    git push origin "${BRANCH_NAME}" --quiet
+  if [[ "${GITHUB_ENV}" ]]; then
+    echo "SHOULD_COMMIT=yes" >> "${GITHUB_ENV}"
+    echo "COMMIT_MESSAGE=${COMMIT_MESSAGE}" >> "${GITHUB_ENV}"
+    echo "COMMIT_REF=${COMMIT_REF}" >> "${GITHUB_ENV}"
   fi
 fi