together-py/.github/workflows/trunk-sync-lock.yml at main · togethercomputer/together-py · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
name: Trunk sync lock

# OPTIONAL: copy into .github/workflows/ if your production repo takes community PRs
# or if custom-code PRs merge on staging during release windows. This workflow posts
# a `trunk-synced` status to open PRs against staging main.
#
# Make it a required check on staging. It gates PRs only; the back-sync pushes staging main directly.
#
# Never route the back-sync through a PR gated by this check or it deadlocks.
# First-run: a check counts as "required" only after it reports once, so trigger this workflow once before marking trunk-synced required.
on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]
  workflow_run:
    workflows: ["Sync SDK repos"]
    types: [completed]
  repository_dispatch:
    types: [prod-released]
  workflow_dispatch: {}
  schedule:
    - cron: "*/30 * * * *"

permissions:
  contents: read
  statuses: write
  pull-requests: read

jobs:
  lock:
    runs-on: ubuntu-latest
    if: github.repository == 'togethercomputer/together-py-staging'
    env:
      PRODUCTION_REPO: togethercomputer/together-py
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Mint STLC app token (scoped to SDK staging repos)
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.STLC_WORKFLOW_APP_CLIENT_ID }}
          private-key: ${{ secrets.STLC_WORKFLOW_APP_PRIVATE_KEY }}
          owner: togethercomputer
          repositories: |
            together-py-staging
            together-py
      - name: Configure auth for github
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          git config --global user.name  "stlc-workflow-app[bot]"
          git config --global user.email "287504455+stlc-workflow-app[bot]@users.noreply.github.com"
          gh auth setup-git

      - name: Evaluate sync state and post status to open main PRs
        env:
          # App token: fetch production. GITHUB_TOKEN: list PRs + post statuses
          # (workflow permissions.statuses/pull-requests apply only to github.token).
          APP_TOKEN: ${{ steps.app-token.outputs.token }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          git remote add production "https://x-access-token:${APP_TOKEN}@github.com/${PRODUCTION_REPO}.git"
          git fetch --no-tags production main
          if git -c credential.helper= merge-base --is-ancestor production/main HEAD; then
            state=success; desc="staging main is in sync with production"
          else
            state=failure; desc="production is ahead — wait for the back-sync before merging"
          fi
          echo "trunk-synced => $state ($desc)"
          shas=$(gh pr list --repo "$GITHUB_REPOSITORY" --base main --state open --json headRefOid --jq '.[].headRefOid')
          if [ -z "$shas" ]; then echo "no open PRs targeting main"; exit 0; fi
          for sha in $shas; do
            gh api -X POST "repos/$GITHUB_REPOSITORY/statuses/$sha" \
              -f state="$state" -f context="trunk-synced" -f description="$desc" >/dev/null
            echo "posted trunk-synced=$state to $sha"
          done