ShadowsOverWestgate/sow-tools
7
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 38 Activity

bot token (#11)
build-binaries / build-binaries (push) Successful in 2m8s
Details
test / test (push) Successful in 1m23s
Details

Browse Source 
Reviewed-on: #11
Co-authored-by: vickydotbat <vickydotbat@tutamail.com>
Co-committed-by: vickydotbat <vickydotbat@tutamail.com>
This commit was merged in pull request #11.
This commit is contained in:
archvillainette
2026-06-20 19:33:10 +00:00
committed by archvillainette
parent 4bab09412d
commit 97f4c00393
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/sync-wrappers.yml
+15 -5
View File
@@ -1,7 +1,7 @@
# Auto-PR canonical wrapper updates to consumer repos when wrappers/ changes on # Auto-PR canonical wrapper updates to consumer repos when wrappers/ changes on
# main. Maintenance automation (not artifact publishing), so it is allowed on a # main. Maintenance automation (not artifact publishing), so it is allowed on a
# main push under the D7 trigger standard. Requires WRAPPER_SYNC_TOKEN: a bot # main push under the D7 trigger standard. Requires BOT_TOKEN: the gitea-bot
# user's token with content+PR write to the consumer repos (never committed). # org token (content+PR write to the consumer repos; never committed).
name: sync-wrappers name: sync-wrappers
on: on:
@@ -19,12 +19,13 @@ jobs:
- name: Open sync PRs to consumers - name: Open sync PRs to consumers
env: env:
TOKEN: ${{ secrets.WRAPPER_SYNC_TOKEN }} TOKEN: ${{ secrets.BOT_TOKEN }}
SERVER: ${{ github.server_url }} SERVER: ${{ github.server_url }}
SRC_SHA: ${{ github.sha }} SRC_SHA: ${{ github.sha }}
run: | run: |
nix develop --command bash -c ' nix develop --command bash -c '
set -euo pipefail set -euo pipefail
[ -n "${TOKEN}" ] || { echo "::error::BOT_TOKEN secret is empty — set the gitea-bot org token"; exit 1; }
host="$(echo "$SERVER" | sed -E "s#https?://##")" host="$(echo "$SERVER" | sed -E "s#https?://##")"
branch="chore/sync-wrappers-$(echo "$SRC_SHA" | cut -c1-12)" branch="chore/sync-wrappers-$(echo "$SRC_SHA" | cut -c1-12)"
grep -vE "^\s*#|^\s*$" wrappers/consumers.txt | while read -r target; do grep -vE "^\s*#|^\s*$" wrappers/consumers.txt | while read -r target; do
@@ -40,10 +41,19 @@ jobs:
git add crucible.sh crucible.ps1 git add crucible.sh crucible.ps1
git commit -m "chore: sync crucible wrappers from sow-tools@${SRC_SHA}" git commit -m "chore: sync crucible wrappers from sow-tools@${SRC_SHA}"
git push -f origin "$branch" git push -f origin "$branch"
curl -fsS -X POST \ # Capture HTTP status: 201=created, 422=PR already open for this
# branch (fine, the force-push above refreshed it). Anything else
# (401/404/...) is a real failure — fail loud, do not swallow it.
resp="$(mktemp)"
code="$(curl -sS -o "$resp" -w "%{http_code}" -X POST \
-H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" \ -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" \
"${SERVER}/api/v1/repos/${target}/pulls" \ "${SERVER}/api/v1/repos/${target}/pulls" \
-d "{\"head\":\"${branch}\",\"base\":\"main\",\"title\":\"chore: sync crucible wrappers from sow-tools\"}" || true -d "{\"head\":\"${branch}\",\"base\":\"main\",\"title\":\"chore: sync crucible wrappers from sow-tools\"}")"
case "$code" in
201) echo "opened sync PR for $target" ;;
422) echo "sync PR already open for $target; refreshed its branch" ;;
*) echo "::error::PR create failed for $target (HTTP $code)"; cat "$resp"; exit 1 ;;
esac
) )
rm -rf "$work" rm -rf "$work"
done done