Sync Workflow Templates #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sync Workflow Templates | |
| on: | |
| workflow_dispatch: | |
| jobs: | |
| sync-workflow-templates: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Load repository list | |
| id: repos | |
| run: | | |
| set -euo pipefail | |
| mapfile -t repos < <( | |
| grep -vE '^(#|[[:space:]]*$)' workflow_templates/repositories.txt | tr -d '\r' | |
| ) | |
| if [ ${#repos[@]} -eq 0 ]; then | |
| echo "::error::No repositories listed in workflow_templates/repositories.txt" | |
| exit 1 | |
| fi | |
| IFS=, | |
| echo "list=${repos[*]}" >> "$GITHUB_OUTPUT" | |
| printf 'Repositories to sync:\n' | |
| printf ' - %s\n' "${repos[@]}" | |
| - uses: ./.github/actions/setup-github-app-git | |
| with: | |
| private-key: ${{ secrets.PM_CICD_APP_PRIVATE_KEY }} | |
| repositories: ${{ steps.repos.outputs.list }} | |
| - name: Sync workflow templates | |
| env: | |
| ORG_NAME: ProcessMaker | |
| run: | | |
| set -euo pipefail | |
| TEMPLATES_DIR="workflow_templates" | |
| shopt -s nullglob | |
| templates=("$TEMPLATES_DIR"/*.yml) | |
| if [ ${#templates[@]} -eq 0 ]; then | |
| echo "::error::No workflow templates found in $TEMPLATES_DIR" | |
| exit 1 | |
| fi | |
| echo "Workflow templates to sync:" | |
| printf ' - %s\n' "${templates[@]}" | |
| echo "Repositories accessible to this CICD app installation:" | |
| mapfile -t ACCESSIBLE_REPOS < <( | |
| gh api /installation/repositories --paginate --jq '.repositories[].name' | sort -u | |
| ) | |
| printf ' - %s\n' "${ACCESSIBLE_REPOS[@]}" | |
| while IFS= read -r repo || [ -n "$repo" ]; do | |
| [ -z "$repo" ] && continue | |
| [[ "$repo" =~ ^# ]] && continue | |
| echo "Processing $ORG_NAME/$repo" | |
| if ! printf '%s\n' "${ACCESSIBLE_REPOS[@]}" | grep -qx "$repo"; then | |
| echo "::error::CICD app cannot access $ORG_NAME/$repo. Org install exists, but this repo is not in the app's repository access list. Add it at https://github.com/organizations/ProcessMaker/settings/installations (Configure → Repository access)." | |
| exit 1 | |
| fi | |
| rm -rf "$repo" | |
| gh repo clone "$ORG_NAME/$repo" "$repo" -- --depth 1 | |
| mkdir -p "$repo/.github/workflows" | |
| for template in "${templates[@]}"; do | |
| cp "$template" "$repo/.github/workflows/$(basename "$template")" | |
| done | |
| cd "$repo" | |
| # This permission check incorrectly checks the user, not the app permissions | |
| # perms="$(gh api "repos/$ORG_NAME/$repo" --jq '.permissions')" | |
| # echo "Token permissions for $ORG_NAME/$repo: $perms" | |
| # if [ "$(echo "$perms" | jq -r '.push')" != "true" ]; then | |
| # echo "::error::Token cannot push to $ORG_NAME/$repo. On the org installation (not app settings), set Repository permissions → Contents to Read and write, then approve any pending permission request." | |
| # exit 1 | |
| # fi | |
| git add .github/workflows/ | |
| if git diff --cached --quiet; then | |
| echo "No changes for $repo" | |
| else | |
| git commit -m "chore: sync workflow templates" | |
| git push origin HEAD | |
| fi | |
| cd .. | |
| rm -rf "$repo" | |
| done < "$TEMPLATES_DIR/repositories.txt" |