Skip to content

Commit 85681d8

Browse files
youknowriadyouknowriad
committed
Revert "Disable auto-commit workflow temporarily"
This reverts commit cd57438.
1 parent 7d294c2 commit 85681d8

File tree

3 files changed

+331
-0
lines changed

3 files changed

+331
-0
lines changed

‎.github/workflows/check-built-files.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Checks for uncommitted changes to built files in pull requests.
2+
name: Check Built Files (PRs)
3+
4+
on:
5+
# Because all commits happen through SVN and should always be manually reviewed by a committer, this workflow only
6+
# runs for pull requests.
7+
#
8+
# Other workflows that run for the push event will detect changes to versioned files and fail.
9+
pull_request:
10+
branches:
11+
- trunk
12+
- '6.[8-9]'
13+
- '[7-9].[0-9]'
14+
paths:
15+
# Any change to a CSS, JavaScript, JSON, or SASS file should run checks.
16+
- '**.css'
17+
- '**.js'
18+
- '**.json'
19+
- '**.sass'
20+
# These files configure npm and the task runner. Changes could affect the outcome.
21+
- 'package*.json'
22+
- '.npmrc'
23+
- '.nvmrc'
24+
- 'Gruntfile.js'
25+
- 'webpack.config.js'
26+
- 'tools/webpack/**'
27+
# These files configure Composer. Changes could affect the outcome.
28+
- 'composer.*'
29+
# Confirm any changes to relevant workflow files.
30+
- '.github/workflows/check-built-files.yml'
31+
# Changes to the default themes should be handled by the themes workflows.
32+
- '!src/wp-content/themes/twenty**'
33+
34+
# Cancels all previous workflow runs for pull requests that have not completed.
35+
concurrency:
36+
# The concurrency group contains the workflow name and the branch name for pull requests
37+
# or the commit hash for any other events.
38+
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
39+
cancel-in-progress: true
40+
41+
# Disable permissions for all available scopes by default.
42+
# Any needed permissions should be configured at the job level.
43+
permissions: {}
44+
45+
jobs:
46+
check-for-built-file-changes:
47+
name: Check built files
48+
if: ${{ github.repository == 'wordpress/wordpress-develop' }}
49+
uses: ./.github/workflows/reusable-check-built-files.yml
50+
permissions:
51+
contents: read

‎.github/workflows/commit-built-file-changes.yml‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
# Commits all missed changes to built files back to pull request branches.
2+
name: Commit Built File Changes (PRs)
3+
4+
on:
5+
workflow_run:
6+
workflows:
7+
- 'Check Built Files (PRs)'
8+
- 'Test Default Themes & Create ZIPs'
9+
types:
10+
- completed
11+
12+
# Cancels all previous workflow runs for pull requests that have not completed.
13+
concurrency:
14+
# The concurrency group contains the workflow name and the branch name for pull requests
15+
# or the commit hash for any other events.
16+
group: ${{ github.workflow }}-${{ github.event_name == 'workflow_run' && format( '{0}-{1}', github.event.workflow_run.head_branch, github.event.workflow_run.head_repository.name ) || github.sha }}
17+
18+
# Disable permissions for all available scopes by default.
19+
# Any needed permissions should be configured at the job level.
20+
permissions: {}
21+
22+
jobs:
23+
# Checks a PR for uncommitted changes to built files.
24+
#
25+
# Performs the following steps:
26+
# - Attempts to download the artifact containing the PR diff.
27+
# - Checks for the existence of an artifact.
28+
# - Unzips the artifact.
29+
# - Generates a token for authenticating with the GitHub App.
30+
# - Checks out the repository.
31+
# - Applies the patch file.
32+
# - Displays the result of git diff.
33+
# - Configures the Git author.
34+
# - Stages changes.
35+
# - Commits changes.
36+
# - Pushes changes.
37+
update-built-files:
38+
name: Check and update built files
39+
runs-on: ubuntu-24.04
40+
# Temporarily disabled while working on Gutenberg integration
41+
if: false
42+
# if: ${{ github.repository == 'wordpress/wordpress-develop' }}
43+
timeout-minutes: 10
44+
permissions:
45+
contents: write
46+
steps:
47+
- name: Download artifact
48+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
49+
with:
50+
script: |
51+
const artifacts = await github.rest.actions.listWorkflowRunArtifacts( {
52+
owner: context.repo.owner,
53+
repo: context.repo.repo,
54+
run_id: process.env.RUN_ID,
55+
} );
56+
57+
const matchArtifact = artifacts.data.artifacts.filter( ( artifact ) => {
58+
return artifact.name === 'pr-built-file-changes'
59+
} )[0];
60+
61+
if ( ! matchArtifact ) {
62+
core.info( 'No artifact found!' );
63+
return;
64+
}
65+
66+
const download = await github.rest.actions.downloadArtifact( {
67+
owner: context.repo.owner,
68+
repo: context.repo.repo,
69+
artifact_id: matchArtifact.id,
70+
archive_format: 'zip',
71+
} );
72+
73+
const fs = require( 'fs' );
74+
fs.writeFileSync( '${{ github.workspace }}/pr-built-file-changes.zip', Buffer.from( download.data ) )
75+
env:
76+
RUN_ID: ${{ github.event.workflow_run.id }}
77+
78+
- name: Check for artifact
79+
id: artifact-check
80+
run: |
81+
if [ -f "pr-built-file-changes.zip" ]; then
82+
echo "exists=true" >> "$GITHUB_OUTPUT"
83+
else
84+
echo "exists=false" >> "$GITHUB_OUTPUT"
85+
fi
86+
87+
- name: Unzip the artifact containing the PR data
88+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
89+
run: unzip pr-built-file-changes.zip
90+
91+
- name: Generate Installation Token
92+
id: generate_token
93+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
94+
env:
95+
GH_APP_ID: ${{ secrets.GH_PR_BUILT_FILES_APP_ID }}
96+
GH_APP_PRIVATE_KEY: ${{ secrets.GH_PR_BUILT_FILES_PRIVATE_KEY }}
97+
run: |
98+
echo "$GH_APP_PRIVATE_KEY" > private-key.pem
99+
100+
# Generate JWT
101+
JWT=$(python3 - <<EOF
102+
import jwt, time
103+
private_key = open("private-key.pem", "r").read()
104+
payload = {
105+
"iat": int(time.time()),
106+
"exp": int(time.time()) + 600, # 10-minute expiration
107+
"iss": $GH_APP_ID
108+
}
109+
print(jwt.encode(payload, private_key, algorithm="RS256"))
110+
EOF
111+
)
112+
113+
# Get Installation ID
114+
INSTALLATION_ID=$(curl -s -X GET -H "Authorization: Bearer $JWT" \
115+
-H "Accept: application/vnd.github.v3+json" \
116+
https://api.github.com/app/installations | jq -r '.[0].id')
117+
118+
# Request Installation Access Token
119+
ACCESS_TOKEN=$(curl -s -X POST -H "Authorization: Bearer $JWT" \
120+
-H "Accept: application/vnd.github.v3+json" \
121+
"https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens" | jq -r '.token')
122+
123+
echo "ACCESS_TOKEN=$ACCESS_TOKEN" >> "$GITHUB_ENV"
124+
125+
rm -f private-key.pem
126+
127+
- name: Checkout repository
128+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
129+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
130+
with:
131+
repository: ${{ github.event.workflow_run.head_repository.full_name }}
132+
ref: ${{ github.event.workflow_run.head_branch }}
133+
path: 'pr-repo'
134+
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
135+
token: ${{ env.ACCESS_TOKEN }}
136+
137+
- name: Apply patch
138+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
139+
working-directory: 'pr-repo'
140+
run: git apply ${{ github.workspace }}/changes.diff
141+
142+
- name: Display changes to versioned files
143+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
144+
working-directory: 'pr-repo'
145+
run: git diff
146+
147+
- name: Configure git user name and email
148+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
149+
working-directory: 'pr-repo'
150+
env:
151+
GH_APP_ID: ${{ secrets.GH_PR_BUILT_FILES_APP_ID }}
152+
run: |
153+
git config user.name "wordpress-develop-pr-bot[bot]"
154+
git config user.email ${{ env.GH_APP_ID }}+wordpress-develop-pr-bot[bot]@users.noreply.github.com
155+
156+
- name: Stage changes
157+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
158+
working-directory: 'pr-repo'
159+
run: git add .
160+
161+
- name: Commit changes
162+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
163+
working-directory: 'pr-repo'
164+
run: |
165+
git commit -m "Automation: Updating built files with changes."
166+
167+
- name: Push changes
168+
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
169+
working-directory: 'pr-repo'
170+
run: git push

‎.github/workflows/reusable-check-built-files.yml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
##
2+
# A reusable workflow that checks for uncommitted changes to built files in pull requests.
3+
##
4+
name: Check Built Files (PRs)
5+
6+
on:
7+
workflow_call:
8+
9+
permissions: {}
10+
11+
jobs:
12+
# Checks a PR for uncommitted changes to built files.
13+
#
14+
# When changes are detected, the patch is stored as an artifact for processing by the Commit Built File Changes
15+
# workflow.
16+
#
17+
# Performs the following steps:
18+
# - Checks out the repository.
19+
# - Sets up Node.js.
20+
# - Configures caching for Composer.
21+
# - Installs Composer dependencies.
22+
# - Logs general debug information about the runner.
23+
# - Installs npm dependencies.
24+
# - Builds CSS file using SASS.
25+
# - Builds Emoji files.
26+
# - Builds bundled Root Certificate files.
27+
# - Builds WordPress.
28+
# - Checks for changes to versioned files.
29+
# - Displays the result of git diff for debugging purposes.
30+
# - Saves the diff to a patch file.
31+
# - Uploads the patch file as an artifact.
32+
update-built-files:
33+
name: Check and update built files
34+
runs-on: ubuntu-24.04
35+
timeout-minutes: 10
36+
permissions:
37+
contents: read
38+
steps:
39+
- name: Checkout repository
40+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
41+
with:
42+
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
43+
44+
- name: Set up Node.js
45+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
46+
with:
47+
node-version-file: '.nvmrc'
48+
cache: npm
49+
50+
# This date is used to ensure that the PHPCS cache is cleared at least once every week.
51+
# http://man7.org/linux/man-pages/man1/date.1.html
52+
- name: "Get last Monday's date"
53+
id: get-date
54+
run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
55+
56+
# Since Composer dependencies are installed using `composer update` and no lock file is in version control,
57+
# passing a custom cache suffix ensures that the cache is flushed at least once per week.
58+
- name: Install Composer dependencies
59+
uses: ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520 # v3.1.1
60+
with:
61+
custom-cache-suffix: ${{ steps.get-date.outputs.date }}
62+
63+
- name: Log debug information
64+
run: |
65+
npm --version
66+
node --version
67+
curl --version
68+
git --version
69+
70+
- name: Install npm Dependencies
71+
run: npm ci
72+
73+
- name: Run SASS precommit tasks
74+
run: npm run grunt precommit:css
75+
76+
- name: Run Emoji precommit task
77+
run: npm run grunt precommit:emoji
78+
env:
79+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
80+
81+
- name: Run certificate tasks
82+
run: npm run grunt copy:certificates
83+
84+
- name: Build WordPress
85+
run: npm run build:dev
86+
87+
- name: Check for changes to versioned files
88+
id: built-file-check
89+
run: |
90+
if git diff --quiet; then
91+
echo "uncommitted_changes=false" >> "$GITHUB_OUTPUT"
92+
else
93+
echo "uncommitted_changes=true" >> "$GITHUB_OUTPUT"
94+
fi
95+
96+
- name: Display changes to versioned files
97+
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
98+
run: git diff
99+
100+
- name: Save diff to a file
101+
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
102+
run: git diff > ./changes.diff
103+
104+
# Uploads the diff file as an artifact.
105+
- name: Upload diff file as artifact
106+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
107+
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
108+
with:
109+
name: pr-built-file-changes
110+
path: changes.diff

0 commit comments

Comments
 (0)