Skip to content

Commit e0cbc00

Browse files
desrosjdesrosj
committed
Make use of reusable pattern.
1 parent 51e7668 commit e0cbc00

File tree

2 files changed

+154
-143
lines changed

2 files changed

+154
-143
lines changed

‎.github/workflows/check-built-files.yml‎

Lines changed: 3 additions & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -38,148 +38,8 @@ concurrency:
3838
permissions: {}
3939

4040
jobs:
41-
# Checks a PR for uncommitted changes to built files.
42-
#
43-
# This job uses a GitHub App instead of $GITHUB_TOKEN because Dependabot pull requests are only granted
44-
# read-only access.
45-
#
46-
# Performs the following steps:
47-
# - Generates a token for authenticating with the GitHub App.
48-
# - Checks out the repository.
49-
# - Sets up Node.js.
50-
# - Configures caching for Composer.
51-
# - Installs Composer dependencies.
52-
# - Logs general debug information about the runner.
53-
# - Installs npm dependencies.
54-
# - Builds CSS file using SASS.
55-
# - Builds Emoji files.
56-
# - Builds bundled Root Certificate files.
57-
# - Builds WordPress.
58-
# - Configures the Git author.
59-
# - Checks for changes to versioned files.
60-
# - Stages changes.
61-
# - Commits changes.
62-
# - Pushes changes.
6341
update-built-files:
64-
name: Check and update built files
65-
runs-on: ubuntu-24.04
42+
name: Update built files
6643
permissions:
67-
contents: write
68-
# This prevents a second run after changes are committed back because Dependabot always rebases updates onto trunk.
69-
if: ${{ github.actor != 'dependabot[bot]' || github.event.commits < 2 }}
70-
steps:
71-
- name: Generate Installation Token
72-
id: generate_token
73-
env:
74-
GH_APP_ID: ${{ secrets.GH_APP_ID }}
75-
GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}
76-
run: |
77-
echo "$GH_APP_PRIVATE_KEY" > private-key.pem
78-
79-
# Generate JWT
80-
JWT=$(python3 - <<EOF
81-
import jwt, time
82-
private_key = open("private-key.pem", "r").read()
83-
payload = {
84-
"iat": int(time.time()),
85-
"exp": int(time.time()) + 600, # 10-minute expiration
86-
"iss": $GH_APP_ID
87-
}
88-
print(jwt.encode(payload, private_key, algorithm="RS256"))
89-
EOF
90-
)
91-
92-
# Get Installation ID
93-
INSTALLATION_ID=$(curl -s -X GET -H "Authorization: Bearer $JWT" \
94-
-H "Accept: application/vnd.github.v3+json" \
95-
https://api.github.com/app/installations | jq -r '.[0].id')
96-
97-
# Request Installation Access Token
98-
ACCESS_TOKEN=$(curl -s -X POST -H "Authorization: Bearer $JWT" \
99-
-H "Accept: application/vnd.github.v3+json" \
100-
"https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens" | jq -r '.token')
101-
102-
echo "ACCESS_TOKEN=$ACCESS_TOKEN" >> "$GITHUB_ENV"
103-
104-
rm -f private-key.pem
105-
106-
- name: Checkout repository
107-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
108-
with:
109-
ref: ${{ github.head_ref }}
110-
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
111-
token: ${{ env.ACCESS_TOKEN }}
112-
113-
- name: Set up Node.js
114-
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
115-
with:
116-
node-version-file: '.nvmrc'
117-
cache: npm
118-
119-
# This date is used to ensure that the PHPCS cache is cleared at least once every week.
120-
# http://man7.org/linux/man-pages/man1/date.1.html
121-
- name: "Get last Monday's date"
122-
id: get-date
123-
run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
124-
125-
# Since Composer dependencies are installed using `composer update` and no lock file is in version control,
126-
# passing a custom cache suffix ensures that the cache is flushed at least once per week.
127-
- name: Install Composer dependencies
128-
uses: ramsey/composer-install@57532f8be5bda426838819c5ee9afb8af389d51a # v3.0.0
129-
with:
130-
custom-cache-suffix: ${{ steps.get-date.outputs.date }}
131-
132-
- name: Log debug information
133-
run: |
134-
npm --version
135-
node --version
136-
curl --version
137-
git --version
138-
139-
- name: Install npm Dependencies
140-
run: npm ci
141-
142-
- name: Run SASS precommit tasks
143-
run: npm run grunt precommit:css
144-
145-
- name: Run Emoji precommit task
146-
run: npm run grunt precommit:emoji
147-
env:
148-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
149-
150-
- name: Run certificate tasks
151-
run: npm run grunt copy:certificates
152-
153-
- name: Build WordPress
154-
run: npm run build:dev
155-
156-
- name: Configure git user name and email
157-
run: |
158-
git config user.name "dependabot[bot]"
159-
git config user.email 49699333+dependabot[bot]@users.noreply.github.com
160-
161-
- name: Check for changes to versioned files
162-
id: built-file-check
163-
run: |
164-
if git diff --quiet; then
165-
echo "uncommitted_changes=false" >> "$GITHUB_OUTPUT"
166-
else
167-
echo "uncommitted_changes=true" >> "$GITHUB_OUTPUT"
168-
fi
169-
170-
- name: Display changes to versioned files
171-
run: git diff
172-
173-
- name: Stage changes
174-
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
175-
run: git add .
176-
177-
- name: Commit changes
178-
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
179-
run: |
180-
git commit -m "Automation: Updating built files with changes. [dependabot skip]"
181-
182-
- name: Push changes
183-
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
184-
run: git push
185-
44+
pull-requests: write
45+
uses: ./.github/workflows/reusable-check-built-files.yml

‎.github/workflows/reusable-check-built-files.yml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
name: Lint GitHub Actions workflows
2+
on:
3+
workflow_call:
4+
5+
permissions: {}
6+
7+
jobs:
8+
# Checks a PR for uncommitted changes to built files.
9+
#
10+
# This job uses a GitHub App instead of $GITHUB_TOKEN because Dependabot pull requests are only granted
11+
# read-only access.
12+
#
13+
# Performs the following steps:
14+
# - Generates a token for authenticating with the GitHub App.
15+
# - Checks out the repository.
16+
# - Sets up Node.js.
17+
# - Configures caching for Composer.
18+
# - Installs Composer dependencies.
19+
# - Logs general debug information about the runner.
20+
# - Installs npm dependencies.
21+
# - Builds CSS file using SASS.
22+
# - Builds Emoji files.
23+
# - Builds bundled Root Certificate files.
24+
# - Builds WordPress.
25+
# - Configures the Git author.
26+
# - Checks for changes to versioned files.
27+
# - Stages changes.
28+
# - Commits changes.
29+
# - Pushes changes.
30+
update-built-files:
31+
name: Check and update built files
32+
runs-on: ubuntu-24.04
33+
permissions:
34+
contents: write
35+
# This prevents a second run after changes are committed back because Dependabot always rebases updates onto trunk.
36+
if: ${{ github.actor != 'dependabot[bot]' || github.event.commits < 2 }}
37+
steps:
38+
- name: Generate Installation Token
39+
id: generate_token
40+
env:
41+
GH_APP_ID: ${{ secrets.GH_APP_ID }}
42+
GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}
43+
run: |
44+
echo "$GH_APP_PRIVATE_KEY" > private-key.pem
45+
46+
# Generate JWT
47+
JWT=$(python3 - <<EOF
48+
import jwt, time
49+
private_key = open("private-key.pem", "r").read()
50+
payload = {
51+
"iat": int(time.time()),
52+
"exp": int(time.time()) + 600, # 10-minute expiration
53+
"iss": $GH_APP_ID
54+
}
55+
print(jwt.encode(payload, private_key, algorithm="RS256"))
56+
EOF
57+
)
58+
59+
# Get Installation ID
60+
INSTALLATION_ID=$(curl -s -X GET -H "Authorization: Bearer $JWT" \
61+
-H "Accept: application/vnd.github.v3+json" \
62+
https://api.github.com/app/installations | jq -r '.[0].id')
63+
64+
# Request Installation Access Token
65+
ACCESS_TOKEN=$(curl -s -X POST -H "Authorization: Bearer $JWT" \
66+
-H "Accept: application/vnd.github.v3+json" \
67+
"https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens" | jq -r '.token')
68+
69+
echo "ACCESS_TOKEN=$ACCESS_TOKEN" >> "$GITHUB_ENV"
70+
71+
rm -f private-key.pem
72+
73+
- name: Checkout repository
74+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
75+
with:
76+
ref: ${{ github.head_ref }}
77+
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
78+
token: ${{ env.ACCESS_TOKEN }}
79+
80+
- name: Set up Node.js
81+
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
82+
with:
83+
node-version-file: '.nvmrc'
84+
cache: npm
85+
86+
# This date is used to ensure that the PHPCS cache is cleared at least once every week.
87+
# http://man7.org/linux/man-pages/man1/date.1.html
88+
- name: "Get last Monday's date"
89+
id: get-date
90+
run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
91+
92+
# Since Composer dependencies are installed using `composer update` and no lock file is in version control,
93+
# passing a custom cache suffix ensures that the cache is flushed at least once per week.
94+
- name: Install Composer dependencies
95+
uses: ramsey/composer-install@57532f8be5bda426838819c5ee9afb8af389d51a # v3.0.0
96+
with:
97+
custom-cache-suffix: ${{ steps.get-date.outputs.date }}
98+
99+
- name: Log debug information
100+
run: |
101+
npm --version
102+
node --version
103+
curl --version
104+
git --version
105+
106+
- name: Install npm Dependencies
107+
run: npm ci
108+
109+
- name: Run SASS precommit tasks
110+
run: npm run grunt precommit:css
111+
112+
- name: Run Emoji precommit task
113+
run: npm run grunt precommit:emoji
114+
env:
115+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
116+
117+
- name: Run certificate tasks
118+
run: npm run grunt copy:certificates
119+
120+
- name: Build WordPress
121+
run: npm run build:dev
122+
123+
- name: Configure git user name and email
124+
run: |
125+
git config user.name "dependabot[bot]"
126+
git config user.email 49699333+dependabot[bot]@users.noreply.github.com
127+
128+
- name: Check for changes to versioned files
129+
id: built-file-check
130+
run: |
131+
if git diff --quiet; then
132+
echo "uncommitted_changes=false" >> "$GITHUB_OUTPUT"
133+
else
134+
echo "uncommitted_changes=true" >> "$GITHUB_OUTPUT"
135+
fi
136+
137+
- name: Display changes to versioned files
138+
run: git diff
139+
140+
- name: Stage changes
141+
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
142+
run: git add .
143+
144+
- name: Commit changes
145+
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
146+
run: |
147+
git commit -m "Automation: Updating built files with changes. [dependabot skip]"
148+
149+
- name: Push changes
150+
if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
151+
run: git push

0 commit comments

Comments
 (0)