-
Notifications
You must be signed in to change notification settings - Fork 0
feat: add template-sync reusable workflow #261
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
+188
−0
Merged
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,130 @@ | ||
| name: 🔄 Template Sync | ||
|
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| source-repo-path: | ||
| description: >- | ||
| The `owner/repo` path of the upstream template repository to sync from | ||
| (passed to `actions-template-sync` as `source_repo_path`). When | ||
| `use-app-token` is set, the App token is auto-scoped to read this repo | ||
| as well, so a PRIVATE template under the same owner works out of the | ||
| box; a cross-owner private template needs a custom token with read | ||
| access to it. | ||
| required: true | ||
| type: string | ||
| upstream-branch: | ||
| description: Branch of the template repository to sync from | ||
| required: false | ||
| type: string | ||
| default: main | ||
| pr-title: | ||
| description: >- | ||
| Title of the sync PR. Defaults to a Conventional-Commit `chore:` title | ||
| because every consumer squash-merges on the PR title into its changelog. | ||
| required: false | ||
| type: string | ||
| default: "chore: sync changes from the upstream template" | ||
| pr-commit-msg: | ||
| description: Commit message for the sync PR | ||
| required: false | ||
| type: string | ||
| default: "chore: sync changes from the upstream template" | ||
| pr-labels: | ||
| description: Comma-separated labels applied to the sync PR | ||
| required: false | ||
| type: string | ||
| default: dependencies,automation | ||
| pr-branch-name-prefix: | ||
| description: Prefix for the branch the sync PR is opened from | ||
| required: false | ||
| type: string | ||
| default: chore/template-sync | ||
| template-sync-ignore-file-path: | ||
| description: >- | ||
| Path to the ignore file listing consumer-owned files that must NOT be | ||
| overwritten by the template (same format as `.gitignore`). | ||
| required: false | ||
| type: string | ||
| default: .templatesyncignore | ||
| dry-run: | ||
| description: "Skip the sync and PR creation (validate the workflow interface only)" | ||
| required: false | ||
| default: false | ||
| type: boolean | ||
| use-app-token: | ||
| description: >- | ||
| When `true` (the default), open the sync PR with a GitHub App token | ||
| (minted from the `APP_ID` variable and the `APP_PRIVATE_KEY` secret) | ||
| instead of the default `GITHUB_TOKEN`. A PR opened with `GITHUB_TOKEN` | ||
| does NOT trigger the caller's `on: pull_request`/`push` CI runs, so its | ||
| required checks never report and it stays blocked; an App token avoids | ||
| this. Set to `false` to fall back to `GITHUB_TOKEN`. | ||
| required: false | ||
| default: true | ||
| type: boolean | ||
| secrets: | ||
| APP_PRIVATE_KEY: | ||
| description: >- | ||
| GitHub App private key, required when `use-app-token` is `true` (the | ||
| default). Paired with the `APP_ID` repository/organization variable to | ||
| mint an App token for opening the sync PR. | ||
| required: false | ||
|
|
||
| permissions: {} | ||
|
|
||
| jobs: | ||
| template-sync: | ||
| name: Template sync | ||
| if: ${{ !inputs.dry-run }} | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| steps: | ||
| - name: 🧮 Resolve template repo name | ||
| id: template | ||
| if: ${{ inputs.use-app-token }} | ||
| shell: bash | ||
| env: | ||
| SOURCE_REPO_PATH: ${{ inputs.source-repo-path }} | ||
| run: echo "name=${SOURCE_REPO_PATH##*/}" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: 🔑 Generate GitHub App token | ||
| id: app-token | ||
| if: ${{ inputs.use-app-token }} | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| with: | ||
| app-id: ${{ vars.APP_ID }} | ||
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | ||
| owner: ${{ github.repository_owner }} | ||
| # Scope the token to exactly the caller repo (push the sync branch + | ||
| # open the PR) AND the upstream template repo (clone it — required when | ||
| # the template is PRIVATE, harmless when it is public). Assumes both | ||
| # live under the same owner; a cross-owner private template needs its | ||
| # own read-scoped token instead. | ||
| repositories: ${{ github.event.repository.name }},${{ steps.template.outputs.name }} | ||
| permission-contents: write | ||
| permission-pull-requests: write | ||
|
|
||
| - name: 📑 Checkout | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| # actions-template-sync needs full history to compute and merge the | ||
| # template diff. It handles its own git auth via `github_token`, so the | ||
| # checkout does not need to persist credentials. | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| token: ${{ steps.app-token.outputs.token || github.token }} | ||
|
|
||
| - name: 🔄 Sync from template | ||
| uses: AndreasAugustin/actions-template-sync@8a0f668b83c32a0f673353086d74f12b8853d4f5 # v2.5.3 | ||
| with: | ||
| source_repo_path: ${{ inputs.source-repo-path }} | ||
| upstream_branch: ${{ inputs.upstream-branch }} | ||
| github_token: ${{ steps.app-token.outputs.token || github.token }} | ||
| pr_title: ${{ inputs.pr-title }} | ||
| pr_commit_msg: ${{ inputs.pr-commit-msg }} | ||
| pr_labels: ${{ inputs.pr-labels }} | ||
| pr_branch_name_prefix: ${{ inputs.pr-branch-name-prefix }} | ||
| template_sync_ignore_file_path: ${{ inputs.template-sync-ignore-file-path }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.