Adding dependabot workflow to sync config file #18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sync Dependabot Config | |
| on: | |
| workflow_dispatch: | |
| push: | |
| paths: | |
| - '.github/templates/dependabot.yml' | |
| - 'repos-dependabot.txt' | |
| jobs: | |
| sync-dependabot: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Generate token using ProcessMaker CICD App | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| client-id: Iv23liEEWBEvXnSckkld | |
| private-key: ${{ secrets.PM_CICD_APP_PRIVATE_KEY }} | |
| owner: ProcessMaker | |
| - name: Sync Dependabot Config | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| ORG_NAME: ProcessMaker | |
| run: | | |
| set -euo pipefail | |
| gh auth setup-git | |
| echo "Repositories accessible to this CICD app installation:" | |
| mapfile -t ACCESSIBLE_REPOS < <( | |
| gh api /installation/repositories --paginate --jq '.repositories[].name' | sort -u | |
| ) | |
| printf ' - %s\n' "${ACCESSIBLE_REPOS[@]}" | |
| while IFS= read -r repo || [ -n "$repo" ]; do | |
| [ -z "$repo" ] && continue | |
| [[ "$repo" =~ ^# ]] && continue | |
| echo "Processing $ORG_NAME/$repo" | |
| if ! printf '%s\n' "${ACCESSIBLE_REPOS[@]}" | grep -qx "$repo"; then | |
| echo "::error::CICD app cannot access $ORG_NAME/$repo. Org install exists, but this repo is not in the app's repository access list. Add it at https://github.com/organizations/ProcessMaker/settings/installations (Configure → Repository access)." | |
| exit 1 | |
| fi | |
| rm -rf "$repo" | |
| gh repo clone "$ORG_NAME/$repo" "$repo" -- --depth 1 | |
| mkdir -p "$repo/.github" | |
| cp .github/templates/dependabot.yml "$repo/.github/dependabot.yml" | |
| cd "$repo" | |
| perms="$(gh api "repos/$ORG_NAME/$repo" --jq '.permissions')" | |
| echo "Token permissions for $ORG_NAME/$repo: $perms" | |
| if [ "$(echo "$perms" | jq -r '.push')" != "true" ]; then | |
| echo "::error::Token cannot push to $ORG_NAME/$repo. On the org installation (not app settings), set Repository permissions → Contents to Read and write, then approve any pending permission request." | |
| exit 1 | |
| fi | |
| if git diff --quiet; then | |
| echo "No changes for $repo" | |
| else | |
| git config user.name "ProcessMaker CICD App" | |
| git config user.email "engineering@processmaker.com" | |
| git config commit.gpgsign false | |
| git add .github/dependabot.yml | |
| git commit -m "chore: sync dependabot config" | |
| git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${ORG_NAME}/${repo}.git" | |
| git push origin HEAD | |
| fi | |
| cd .. | |
| rm -rf "$repo" | |
| done < repos-dependabot.txt |