ncmake workflow update #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 [ernolf] Raphael Gradenwitz <raphael.gradenwitz@googlemail.com> | |
| # SPDX-License-Identifier: MIT | |
| # | |
| # ncmake workflow updater: on a schedule, refreshes the ncmake-managed CI | |
| # workflows from their upstream templates (make workflows-update) and opens a | |
| # pull request when anything changed. This replaces Dependabot for the files | |
| # under .github/workflows/. Once that pull request is merged it deletes its own | |
| # branch, so no stale ncmake/ci/workflow-update branch is left behind. | |
| # | |
| # Authentication is a GitHub App (Contents, Pull requests and Workflows: write), | |
| # minted per run as a short-lived token. The app is required because the default | |
| # GITHUB_TOKEN may not push workflow files, and it is preferred over a PAT | |
| # because the same token both pushes the files and produces verified, signed | |
| # commits. Store its credentials as the NCMAKE_UPDATER_CLIENT_ID and | |
| # NCMAKE_UPDATER_PRIVATE_KEY secrets. See doc/AUTOUPDATE_WORKFLOW.md and | |
| # doc/GITHUB_APP.md. | |
| name: ncmake workflow update | |
| on: | |
| schedule: | |
| # Daily at 05:30 UTC. GitHub starts scheduled runs on a best-effort basis and | |
| # delays them under load, so expect this a few hours late, not on the minute | |
| # (see doc/AUTOUPDATE_WORKFLOW.md). Trigger workflow_dispatch to run without | |
| # waiting for the schedule. | |
| - cron: '30 5 * * *' | |
| workflow_dispatch: | |
| # React to a merge so the cleanup job can remove the updater's own branch. | |
| # This fires for every closed pull request in the repository; the cleanup job | |
| # filters down to a merged ncmake/ci/workflow-update. | |
| pull_request: | |
| types: [closed] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ncmake-workflow-update | |
| cancel-in-progress: false | |
| jobs: | |
| update: | |
| # The scheduled/manual side: refresh the workflows and open the pull request. | |
| # Skipped for the pull_request trigger, which only drives the cleanup job. | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Create app token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.NCMAKE_UPDATER_CLIENT_ID }} | |
| private-key: ${{ secrets.NCMAKE_UPDATER_PRIVATE_KEY }} | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Refresh managed workflows from upstream | |
| run: | | |
| make dev-init | |
| make workflows-update | |
| - name: Open pull request | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| sign-commits: true | |
| signoff: true | |
| branch: ncmake/ci/workflow-update | |
| delete-branch: true | |
| add-paths: .github/workflows/ | |
| title: 'ci: update managed CI workflows from upstream' | |
| commit-message: 'ci: update managed CI workflows from upstream' | |
| body: | | |
| Automated by the ncmake workflow updater. | |
| `make workflows-update` refreshed the ncmake-managed workflows from | |
| their upstream templates (nextcloud/.github + ncmake). Locally | |
| modified workflows are left untouched. Review the diff and merge. | |
| cleanup: | |
| # Delete the updater's own branch as soon as its pull request is merged, | |
| # instead of leaving it until the next scheduled run removes it (which is | |
| # what create-pull-request's delete-branch does). It uses the same GitHub | |
| # App as the update job, so it always has Contents: write regardless of the | |
| # repository's default token permissions. This only ever touches | |
| # ncmake/ci/workflow-update, and is unrelated to the repository-wide | |
| # "Automatically delete head branches" setting (see doc/DELETE_MERGED_BRANCHES.md). | |
| if: >- | |
| github.event_name == 'pull_request' | |
| && github.event.pull_request.merged == true | |
| && github.event.pull_request.head.ref == 'ncmake/ci/workflow-update' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Create app token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.NCMAKE_UPDATER_CLIENT_ID }} | |
| private-key: ${{ secrets.NCMAKE_UPDATER_PRIVATE_KEY }} | |
| - name: Delete the merged updater branch | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| gh api --method DELETE \ | |
| "repos/${{ github.repository }}/git/refs/heads/ncmake/ci/workflow-update" |