|
| 1 | +# Commits all missed changes to built files back to pull request branches. |
| 2 | +name: Commit Built File Changes (PRs) |
| 3 | + |
| 4 | +on: |
| 5 | + workflow_run: |
| 6 | + workflows: [ 'Check Built Files (PRs)' ] |
| 7 | + types: |
| 8 | + - completed |
| 9 | + |
| 10 | +# Cancels all previous workflow runs for pull requests that have not completed. |
| 11 | +concurrency: |
| 12 | + # The concurrency group contains the workflow name and the branch name for pull requests |
| 13 | + # or the commit hash for any other events. |
| 14 | + group: ${{ github.workflow }}-${{ github.event_name == 'workflow_run' && format( '{0}-{1}', github.event.workflow_run.head_branch, github.event.workflow_run.head_repository.name ) || github.sha }} |
| 15 | + |
| 16 | +# Disable permissions for all available scopes by default. |
| 17 | +# Any needed permissions should be configured at the job level. |
| 18 | +permissions: {} |
| 19 | + |
| 20 | +jobs: |
| 21 | + # Checks a PR for uncommitted changes to built files. |
| 22 | + # |
| 23 | + # Performs the following steps: |
| 24 | + # - Attempts to download the artifact containing the PR diff. |
| 25 | + # - Checks for the existence of an artifact. |
| 26 | + # - Unzips the artifact. |
| 27 | + # - Generates a token for authenticating with the GitHub App. |
| 28 | + # - Checks out the repository. |
| 29 | + # - Applies the patch file. |
| 30 | + # - Displays the result of git diff. |
| 31 | + # - Configures the Git author. |
| 32 | + # - Stages changes. |
| 33 | + # - Commits changes. |
| 34 | + # - Pushes changes. |
| 35 | + update-built-files: |
| 36 | + name: Check and update built files |
| 37 | + runs-on: ubuntu-24.04 |
| 38 | + if: ${{ github.repository == 'wordpress/wordpress-develop' }} |
| 39 | + timeout-minutes: 10 |
| 40 | + permissions: |
| 41 | + contents: write |
| 42 | + steps: |
| 43 | + - name: Download artifact |
| 44 | + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 |
| 45 | + with: |
| 46 | + script: | |
| 47 | + const artifacts = await github.rest.actions.listWorkflowRunArtifacts( { |
| 48 | + owner: context.repo.owner, |
| 49 | + repo: context.repo.repo, |
| 50 | + run_id: process.env.RUN_ID, |
| 51 | + } ); |
| 52 | +
|
| 53 | + const matchArtifact = artifacts.data.artifacts.filter( ( artifact ) => { |
| 54 | + return artifact.name === 'pr-built-file-changes' |
| 55 | + } )[0]; |
| 56 | +
|
| 57 | + if ( ! matchArtifact ) { |
| 58 | + core.info( 'No artifact found!' ); |
| 59 | + return; |
| 60 | + } |
| 61 | +
|
| 62 | + const download = await github.rest.actions.downloadArtifact( { |
| 63 | + owner: context.repo.owner, |
| 64 | + repo: context.repo.repo, |
| 65 | + artifact_id: matchArtifact.id, |
| 66 | + archive_format: 'zip', |
| 67 | + } ); |
| 68 | +
|
| 69 | + const fs = require( 'fs' ); |
| 70 | + fs.writeFileSync( '${{ github.workspace }}/pr-built-file-changes.zip', Buffer.from( download.data ) ) |
| 71 | + env: |
| 72 | + RUN_ID: ${{ github.event.workflow_run.id }} |
| 73 | + |
| 74 | + - name: Check for artifact |
| 75 | + id: artifact-check |
| 76 | + run: | |
| 77 | + if [ -f "pr-built-file-changes.zip" ]; then |
| 78 | + echo "exists=true" >> "$GITHUB_OUTPUT" |
| 79 | + else |
| 80 | + echo "exists=false" >> "$GITHUB_OUTPUT" |
| 81 | + fi |
| 82 | +
|
| 83 | + - name: Unzip the artifact containing the PR data |
| 84 | + if: ${{ steps.artifact-check.outputs.exists == 'true' }} |
| 85 | + run: unzip pr-built-file-changes.zip |
| 86 | + |
| 87 | + - name: Generate Installation Token |
| 88 | + id: generate_token |
| 89 | + if: ${{ steps.artifact-check.outputs.exists == 'true' }} |
| 90 | + env: |
| 91 | + GH_APP_ID: ${{ secrets.GH_PR_BUILT_FILES_APP_ID }} |
| 92 | + GH_APP_PRIVATE_KEY: ${{ secrets.GH_PR_BUILT_FILES_PRIVATE_KEY }} |
| 93 | + run: | |
| 94 | + echo "$GH_APP_PRIVATE_KEY" > private-key.pem |
| 95 | +
|
| 96 | + # Generate JWT |
| 97 | + JWT=$(python3 - <<EOF |
| 98 | + import jwt, time |
| 99 | + private_key = open("private-key.pem", "r").read() |
| 100 | + payload = { |
| 101 | + "iat": int(time.time()), |
| 102 | + "exp": int(time.time()) + 600, # 10-minute expiration |
| 103 | + "iss": $GH_APP_ID |
| 104 | + } |
| 105 | + print(jwt.encode(payload, private_key, algorithm="RS256")) |
| 106 | + EOF |
| 107 | + ) |
| 108 | +
|
| 109 | + # Get Installation ID |
| 110 | + INSTALLATION_ID=$(curl -s -X GET -H "Authorization: Bearer $JWT" \ |
| 111 | + -H "Accept: application/vnd.github.v3+json" \ |
| 112 | + https://api.github.com/app/installations | jq -r '.[0].id') |
| 113 | +
|
| 114 | + # Request Installation Access Token |
| 115 | + ACCESS_TOKEN=$(curl -s -X POST -H "Authorization: Bearer $JWT" \ |
| 116 | + -H "Accept: application/vnd.github.v3+json" \ |
| 117 | + "https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens" | jq -r '.token') |
| 118 | +
|
| 119 | + echo "ACCESS_TOKEN=$ACCESS_TOKEN" >> "$GITHUB_ENV" |
| 120 | +
|
| 121 | + rm -f private-key.pem |
| 122 | +
|
| 123 | + - name: Checkout repository |
| 124 | + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
| 125 | + if: ${{ steps.artifact-check.outputs.exists == 'true' }} |
| 126 | + with: |
| 127 | + repository: ${{ github.event.workflow_run.head_repository.full_name }} |
| 128 | + ref: ${{ github.event.workflow_run.head_branch }} |
| 129 | + path: 'pr-repo' |
| 130 | + show-progress: ${{ runner.debug == '1' && 'true' || 'false' }} |
| 131 | + token: ${{ env.ACCESS_TOKEN }} |
| 132 | + |
| 133 | + - name: Apply patch |
| 134 | + if: ${{ steps.artifact-check.outputs.exists == 'true' }} |
| 135 | + working-directory: 'pr-repo' |
| 136 | + run: git apply ${{ github.workspace }}/changes.diff |
| 137 | + |
| 138 | + - name: Display changes to versioned files |
| 139 | + if: ${{ steps.artifact-check.outputs.exists == 'true' }} |
| 140 | + working-directory: 'pr-repo' |
| 141 | + run: git diff |
| 142 | + |
| 143 | + - name: Configure git user name and email |
| 144 | + if: ${{ steps.artifact-check.outputs.exists == 'true' }} |
| 145 | + working-directory: 'pr-repo' |
| 146 | + env: |
| 147 | + GH_APP_ID: ${{ secrets.GH_PR_BUILT_FILES_APP_ID }} |
| 148 | + run: | |
| 149 | + git config user.name "wordpress-develop-pr-bot[bot]" |
| 150 | + git config user.email ${{ env.GH_APP_ID }}+wordpress-develop-pr-bot[bot]@users.noreply.github.com |
| 151 | +
|
| 152 | + - name: Stage changes |
| 153 | + if: ${{ steps.artifact-check.outputs.exists == 'true' }} |
| 154 | + working-directory: 'pr-repo' |
| 155 | + run: git add . |
| 156 | + |
| 157 | + - name: Commit changes |
| 158 | + if: ${{ steps.artifact-check.outputs.exists == 'true' }} |
| 159 | + working-directory: 'pr-repo' |
| 160 | + run: | |
| 161 | + git commit -m "Automation: Updating built files with changes. [dependabot skip]" |
| 162 | +
|
| 163 | + - name: Push changes |
| 164 | + if: ${{ steps.artifact-check.outputs.exists == 'true' }} |
| 165 | + working-directory: 'pr-repo' |
| 166 | + run: git push |
0 commit comments