Skip to content

Commit d64ef19

Browse files
desrosjdesrosj
committed
Build/Test Tools: Eliminate the need for custom tokens.
This reworks the workflow files introduced in [59983] to eliminate the need for a custom app token. Follow up to [59983], [60052], [60059]. See #62221. git-svn-id: https://develop.svn.wordpress.org/trunk@60063 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 4d19161 commit d64ef19

3 files changed

Lines changed: 153 additions & 88 deletions

File tree

‎.github/workflows/check-built-files.yml‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
# Checks for uncommitted changes to built files and pushes changes back.
2-
name: Check built files
1+
# Checks for uncommitted changes to built files in pull requests.
2+
name: Check Built Files (PRs)
33

44
on:
55
# Because all commits happen through SVN and should always be manually reviewed by a committer, this workflow only
66
# runs for pull requests.
77
#
8-
# Other workflows that run on push will detect changes to versioned files and fail.
9-
pull_request_target:
8+
# Other workflows that run for the push event will detect changes to versioned files and fail.
9+
pull_request:
1010
branches:
1111
- trunk
1212
- '6.[8-9]'
@@ -31,21 +31,16 @@ on:
3131
concurrency:
3232
# The concurrency group contains the workflow name and the branch name for pull requests
3333
# or the commit hash for any other events.
34-
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.head_ref || github.sha }}
34+
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
3535
cancel-in-progress: true
3636

3737
# Disable permissions for all available scopes by default.
3838
# Any needed permissions should be configured at the job level.
3939
permissions: {}
4040

4141
jobs:
42-
update-built-files:
43-
name: Update built files
44-
permissions:
45-
contents: write
46-
if: ${{ github.repository == 'WordPress/wordpress-develop' }}
47-
# This should always reference a version of the workflow committed through SVN and never a local reference.
48-
uses: WordPress/wordpress-develop/.github/workflows/reusable-check-built-files.yml@trunk
49-
secrets:
50-
GH_APP_ID: ${{ secrets.GH_PR_MANAGEMENT_APP_ID }}
51-
GH_APP_PRIVATE_KEY: ${{ secrets.GH_PR_MANAGEMENT_APP_PRIVATE_KEY }}
42+
check-for-built-file-changes:
43+
name: Check built files
44+
# This prevents an unnecessary second run after changes are committed back because Dependabot always rebases and force pushes.
45+
if: ${{ github.repository == 'wordpress/wordpress-develop' && ( github.actor != 'dependabot[bot]' || github.event.commits < 2 ) }}
46+
uses: ./.github/workflows/reusable-check-built-files.yml

‎.github/workflows/commit-built-file-changes.yml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
# Commits all missed changes to built files back to pull request branches.
2+
name: Commit Built File Changes (PRs)
3+
4+
on:
5+
workflow_run:
6+
workflows: [ 'Check Built Files (PRs)' ]
7+
types:
8+
- completed
9+
10+
# Cancels all previous workflow runs for pull requests that have not completed.
11+
concurrency:
12+
# The concurrency group contains the workflow name and the branch name for pull requests
13+
# or the commit hash for any other events.
14+
group: ${{ github.workflow }}-${{ github.event_name == 'workflow_run' && format( '{0}-{1}', github.event.workflow_run.head_branch, github.event.workflow_run.head_repository.name ) || github.sha }}
15+
16+
# Disable permissions for all available scopes by default.
17+
# Any needed permissions should be configured at the job level.
18+
permissions: {}
19+
20+
jobs:
21+
# Checks a PR for uncommitted changes to built files.
22+
#
23+
# Performs the following steps:
24+
# - Attempts to download the artifact containing the PR diff.
25+
# - Checks for the existence of an artifact.
26+
# - Unzips the artifact.
27+
# - Checks out the repository.
28+
# - Applies the patch file.
29+
# - Displays the result of git diff.
30+
# - Configures the Git author.
31+
# - Stages changes.
32+
# - Commits changes.
33+
# - Pushes changes.
34+
update-built-files:
35+
name: Check and update built files
36+
runs-on: ubuntu-24.04
37+
if: ${{ github.repository == 'wordpress/wordpress-develop' }}
38+
timeout-minutes: 10
39+
permissions:
40+
contents: write
41+
steps:
42+
- name: Download artifact
43+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
44+
with:
45+
script: |
46+
const artifacts = await github.rest.actions.listWorkflowRunArtifacts( {
47+
owner: context.repo.owner,
48+
repo: context.repo.repo,
49+
run_id: process.env.RUN_ID,
50+
} );
51+
52+
const matchArtifact = artifacts.data.artifacts.filter( ( artifact ) => {
53+
return artifact.name === 'pr-built-file-changes'
54+
} )[0];
55+
56+
if ( ! matchArtifact ) {
57+
core.info( 'No artifact found!' );
58+
return;
59+
}
60+
61+
const download = await github.rest.actions.downloadArtifact( {
62+
owner: context.repo.owner,
63+
repo: context.repo.repo,
64+
artifact_id: matchArtifact.id,
65+
archive_format: 'zip',
66+
} );
67+
68+
const fs = require( 'fs' );
69+
fs.writeFileSync( '${{ github.workspace }}/pr-built-file-changes.zip', Buffer.from( download.data ) )
70+
env:
71+
RUN_ID: ${{ github.event.workflow_run.id }}
72+
73+
- name: Check for artifact
74+
id: artifact-check
75+
run: |
76+
if [ -f "pr-built-file-changes.zip" ]; then
77+
echo "exists=true" >> "$GITHUB_OUTPUT"
78+
else
79+
echo "exists=false" >> "$GITHUB_OUTPUT"
80+
fi
81+
82+
- name: Unzip the artifact containing the PR data
83+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
84+
run: unzip pr-built-file-changes.zip
85+
86+
- name: Checkout repository
87+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
88+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
89+
with:
90+
repository: ${{ github.event.workflow_run.repository.full_name }}
91+
ref: ${{ github.event.workflow_run.head_branch }}
92+
path: 'pr-repo'
93+
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
94+
95+
- name: Apply patch
96+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
97+
working-directory: 'pr-repo'
98+
run: git apply ${{ github.workspace }}/changes.diff
99+
100+
- name: Display changes to versioned files
101+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
102+
working-directory: 'pr-repo'
103+
run: git diff
104+
105+
- name: Configure git user name and email
106+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
107+
working-directory: 'pr-repo'
108+
run: |
109+
git config user.name "WordPress Build Script Bot[bot]"
110+
git config user.email wordpress@users.noreply.github.com
111+
112+
- name: Stage changes
113+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
114+
working-directory: 'pr-repo'
115+
run: git add .
116+
117+
- name: Commit changes
118+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
119+
working-directory: 'pr-repo'
120+
run: |
121+
git commit -m "Automation: Updating built files with changes. [dependabot skip]"
122+
123+
- name: Push changes
124+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
125+
working-directory: 'pr-repo'
126+
run: git push

‎.github/workflows/reusable-check-built-files.yml‎

Lines changed: 17 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,20 @@
1-
name: Lint GitHub Actions workflows
1+
##
2+
# A reusable workflow that checks for uncommitted changes to built files in pull requests.
3+
##
4+
name: Check Built Files (PRs)
5+
26
on:
37
workflow_call:
4-
secrets:
5-
GH_APP_ID:
6-
description: 'A GitHub App ID.'
7-
required: true
8-
GH_APP_PRIVATE_KEY:
9-
description: 'A GitHub App private key.'
10-
required: true
118

129
permissions: {}
1310

1411
jobs:
1512
# Checks a PR for uncommitted changes to built files.
1613
#
17-
# This job uses a GitHub App instead of $GITHUB_TOKEN because Dependabot pull requests are only granted
18-
# read-only access.
14+
# When changes are detected, the patch is stored as an artifact for processing by the Commit Built File Changes
15+
# workflow.
1916
#
2017
# Performs the following steps:
21-
# - Generates a token for authenticating with the GitHub App.
2218
# - Checks out the repository.
2319
# - Sets up Node.js.
2420
# - Configures caching for Composer.
@@ -31,62 +27,17 @@ jobs:
3127
# - Builds WordPress.
3228
# - Checks for changes to versioned files.
3329
# - Displays the result of git diff for debugging purposes.
34-
# - Configures the Git author.
35-
# - Stages changes.
36-
# - Commits changes.
37-
# - Pushes changes.
30+
# - Saves the diff to a patch file.
31+
# - Uploads the patch file as an artifact.
3832
update-built-files:
3933
name: Check and update built files
4034
runs-on: ubuntu-24.04
41-
# This prevents an unnecessary second run after changes are committed back because Dependabot always rebases
42-
# updates and force pushes.
43-
if: ${{ github.actor != 'dependabot[bot]' || github.event.commits < 2 }}
4435
timeout-minutes: 10
45-
permissions:
46-
contents: write
4736
steps:
48-
- name: Generate Installation Token
49-
id: generate_token
50-
env:
51-
GH_APP_ID: ${{ secrets.GH_APP_ID }}
52-
GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}
53-
run: |
54-
echo "$GH_APP_PRIVATE_KEY" > private-key.pem
55-
56-
# Generate JWT
57-
JWT=$(python3 - <<EOF
58-
import jwt, time
59-
private_key = open("private-key.pem", "r").read()
60-
payload = {
61-
"iat": int(time.time()),
62-
"exp": int(time.time()) + 600, # 10-minute expiration
63-
"iss": $GH_APP_ID
64-
}
65-
print(jwt.encode(payload, private_key, algorithm="RS256"))
66-
EOF
67-
)
68-
69-
# Get Installation ID
70-
INSTALLATION_ID=$(curl -s -X GET -H "Authorization: Bearer $JWT" \
71-
-H "Accept: application/vnd.github.v3+json" \
72-
https://api.github.com/app/installations | jq -r '.[0].id')
73-
74-
# Request Installation Access Token
75-
ACCESS_TOKEN=$(curl -s -X POST -H "Authorization: Bearer $JWT" \
76-
-H "Accept: application/vnd.github.v3+json" \
77-
"https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens" | jq -r '.token')
78-
79-
echo "ACCESS_TOKEN=$ACCESS_TOKEN" >> "$GITHUB_ENV"
80-
81-
rm -f private-key.pem
82-
8337
- name: Checkout repository
8438
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8539
with:
86-
repository: ${{ github.event.pull_request.head.repo.full_name }}
87-
ref: ${{ github.event.pull_request.head.ref }}
8840
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
89-
token: ${{ env.ACCESS_TOKEN }}
9041

9142
- name: Set up Node.js
9243
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
@@ -144,21 +95,14 @@ jobs:
14495
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
14596
run: git diff
14697

147-
- name: Configure git user name and email
98+
- name: Save diff to a file
14899
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
149-
run: |
150-
git config user.name "wordpress-develop-pr-bot[bot]"
151-
git config user.email ${{ secrets.GH_APP_ID }}+wordpress-develop-pr-bot[bot]@users.noreply.github.com
100+
run: git diff > ./changes.diff
152101

153-
- name: Stage changes
102+
# Uploads the diff file as an artifact.
103+
- name: Upload diff file as artifact
104+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
154105
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
155-
run: git add .
156-
157-
- name: Commit changes
158-
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
159-
run: |
160-
git commit -m "Automation: Updating built files with changes. [dependabot skip]"
161-
162-
- name: Push changes
163-
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
164-
run: git push
106+
with:
107+
name: pr-built-file-changes
108+
path: changes.diff

0 commit comments

Comments
 (0)