diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch index 35e5b30..d4fa443 100644 --- a/patches/nextcloud/sync-workflow-templates.yml.patch +++ b/patches/nextcloud/sync-workflow-templates.yml.patch @@ -3,20 +3,20 @@ @@ -1,13 +1,16 @@ # This workflow is provided via the organization template repository # --# https://github.com/nextcloud/.github +# https://github.com/LibreCodeCoop/.github +-# https://github.com/nextcloud/.github # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization # # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors # SPDX-License-Identifier: MIT --# This workflow will update all workflow templates --# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result +# This workflow will update all workflow templates. +# Additionally it will reapply workflow.yml.patch files after syncing and only then commit the result. +# +# Authentication is selected explicitly with vars.WORKFLOW_SYNC_AUTH_MODE. +# See docs/cross-repository-automation.md for modes, credentials and GITHUB_TOKEN limitations. +-# This workflow will update all workflow templates +-# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result name: Update workflows on: workflow_dispatch: @@ -30,10 +30,22 @@ name: Update workflows in ${{ matrix.branches }} -@@ -42,12 +42,111 @@ - with: - require: admin +@@ -38,16 +38,123 @@ + steps: + - name: Check actor permission ++ if: ${{ github.event_name == 'workflow_dispatch' }} ++ shell: bash ++ env: ++ GH_TOKEN: ${{ github.token }} ++ run: | ++ set -euo pipefail ++ permission="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${GITHUB_ACTOR}/permission" --jq '.permission')" ++ [[ "${permission}" == "admin" ]] || { ++ echo "::error::Manual workflow runs require repository admin permission; ${GITHUB_ACTOR} has ${permission}" ++ exit 1 ++ } ++ + - name: Validate workflow sync authentication + shell: bash + env: @@ -90,7 +102,8 @@ + if: ${{ vars.WORKFLOW_SYNC_AUTH_MODE == 'github-app' }} + id: consumer-app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 -+ with: +- uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0 + with: + app-id: ${{ vars.WORKFLOW_SYNC_APP_ID }} + private-key: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} @@ -126,13 +139,13 @@ + + echo "::add-mask::${token}" + echo "token=${token}" >> "${GITHUB_OUTPUT}" -+ +- require: admin + - name: Checkout workflow repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false path: source -- repository: nextcloud/.github + repository: LibreCodeCoop/.github + + - name: Record workflow catalog revision @@ -140,13 +153,21 @@ + working-directory: source + shell: bash + run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" +- repository: nextcloud/.github - name: Checkout app uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 -@@ -56,86 +155,31 @@ +@@ -56,86 +163,31 @@ path: target ref: ${{ matrix.branches }} ++ - name: Synchronize workflow templates ++ id: sync ++ uses: ./source/actions/sync-workflows ++ with: ++ source: source/workflow-templates ++ target: target ++ catalog-commit: ${{ steps.catalog-revision.outputs.sha }} - - name: Copy all workflow templates - run: | - echo 'SUMMARY<> $GITHUB_ENV @@ -156,7 +177,7 @@ - if [ -f "$workflow" ]; then - filename=$(basename "$workflow") - target_file="./target/.github/workflows/$filename" -- + - # Only copy if the file exists in the target repository - if [ -f "$target_file" ]; then - if [ -f "./target/.github/actions-lock.txt" ]; then @@ -210,36 +231,29 @@ - done - echo 'EOF' >> $GITHUB_ENV - echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV -+ - name: Synchronize workflow templates -+ id: sync -+ uses: ./source/actions/sync-workflows -+ with: -+ source: source/workflow-templates -+ target: target -+ catalog-commit: ${{ steps.catalog-revision.outputs.sha }} - +- - name: Create Pull Request + if: ${{ steps.sync.outputs.changed == 'true' }} uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: -- token: ${{ secrets.COMMAND_BOT_WORKFLOWS }} + token: ${{ steps.auth-token.outputs.token }} +- token: ${{ secrets.COMMAND_BOT_WORKFLOWS }} commit-message: 'ci(actions): Update workflow templates from organization template repository' committer: GitHub -- author: nextcloud-command + author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> +- author: nextcloud-command path: target signoff: true branch: 'automated/noid/${{ matrix.branches }}-update-workflows' title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository' -- draft: ${{ env.DRAFT_ONLY == 1 }} + draft: ${{ steps.sync.outputs.patch_failed == 'true' }} +- draft: ${{ env.DRAFT_ONLY == 1 }} add-paths: .github/workflows/*.yml,.github/actions-lock.txt body: | -- Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github) -- ${{ env.SUMMARY }} + Automated update of workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github) + ${{ steps.sync.outputs.summary }} +- Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github) +- ${{ env.SUMMARY }} labels: | dependencies 3. to review diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml index 311773e..93c4201 100644 --- a/workflow-templates/sync-workflow-templates.yml +++ b/workflow-templates/sync-workflow-templates.yml @@ -38,9 +38,17 @@ jobs: steps: - name: Check actor permission - uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0 - with: - require: admin + if: ${{ github.event_name == 'workflow_dispatch' }} + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + permission="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${GITHUB_ACTOR}/permission" --jq '.permission')" + [[ "${permission}" == "admin" ]] || { + echo "::error::Manual workflow runs require repository admin permission; ${GITHUB_ACTOR} has ${permission}" + exit 1 + } - name: Validate workflow sync authentication shell: bash