also looking at this
fix(ci): bot commits land through a checked pull request, not a bypass
#274
10 files
+621
-23
| @@ -53,10 +53,12 @@ jobs: | ||
| 53 | 53 | update-packages: |
| 54 | 54 | name: Update packages and index |
| 55 | 55 | runs-on: ubuntu-latest |
| 56 | timeout-minutes: 30 | |
| 56 | # Covers the sweep plus the wait for CI to report on the pull request. | |
| 57 | timeout-minutes: 80 | |
| 57 | 58 | permissions: |
| 58 | 59 | contents: write |
| 59 | 60 | actions: write |
| 61 | pull-requests: write | |
| 60 | 62 | |
| 61 | 63 | steps: |
| 62 | 64 | - name: Checkout repository |
| @@ -221,7 +223,7 @@ jobs: | ||
| 221 | 223 | fi |
| 222 | 224 | echo "safe_to_commit=true" >> $GITHUB_OUTPUT |
| 223 | 225 | |
| 224 | - name: Commit and push changes | |
| 226 | - name: Commit changes | |
| 225 | 227 | id: commit |
| 226 | 228 | if: steps.git-check.outputs.changes == 'true' && steps.deletion-check.outputs.safe_to_commit == 'true' |
| 227 | 229 | run: | |
| @@ -234,12 +236,32 @@ jobs: | ||
| 234 | 236 | test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" |
| 235 | 237 | git add packages/ts-pantry/src/packages/ packages/ts-pantry/src/generated-package-names.ts packages/zig/src/packages/generated.zig packages/action/dist/index.js packages/action/dist/post.js |
| 236 | 238 | git commit -F /tmp/pantry-update-commit-message.txt |
| 237 | git push origin HEAD:refs/heads/main | |
| 238 | 239 | |
| 239 | echo "committed=true" >> $GITHUB_OUTPUT | |
| 240 | # This commit used to go straight to main. It cannot any more: main | |
| 241 | # requires the CI contexts, and a bot push carries no repository role to | |
| 242 | # be excused by, so the push comes back GH013. The alternative to a pull | |
| 243 | # request was excusing the Actions app from the checks, which would have | |
| 244 | # exempted every workflow that ever pushes rather than this one, and | |
| 245 | # would have kept the generated catalog the only thing on main nobody | |
| 246 | # checks. So it is checked now, like everything else. | |
| 247 | - name: Land the update through a pull request | |
| 248 | id: land | |
| 249 | if: steps.commit.conclusion == 'success' | |
| 250 | uses: ./.github/actions/merge-via-pr | |
| 251 | with: | |
| 252 | token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }} | |
| 253 | branch-prefix: chore/package-updates | |
| 254 | body: | | |
| 255 | Automated catalog refresh from `update-packages.yml`. | |
| 256 | ||
| 257 | Opened rather than pushed because `main` requires the CI contexts | |
| 258 | and a bot push holds no role to be excused by. CI is dispatched at | |
| 259 | this branch explicitly: a pull request opened with `GITHUB_TOKEN` | |
| 260 | does not fire `pull_request`, so without the dispatch nothing would | |
| 261 | ever report here. | |
| 240 | 262 | |
| 241 | 263 | - name: Publish updated packages to the registry |
| 242 | if: steps.commit.outputs.committed == 'true' | |
| 264 | if: steps.land.outputs.merged == 'true' | |
| 243 | 265 | env: |
| 244 | 266 | GH_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }} |
| 245 | 267 | run: | |