You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# At this point we only duplicated the wrapup flow.
33
+
# Add all additional jobs you want to run on the ready branch before the merge-to-trunk job
34
+
# and make merge-to-trunk depend on them (like it depends on trunk-worthy) to ensure they run before the merge.
35
+
36
+
37
+
merge-to-trunk:
38
+
name: Merge to trunk
39
+
runs-on: ubuntu-latest
40
+
needs: trunk-worthy
41
+
env:
42
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43
+
permissions:
44
+
pull-requests: write
45
+
issues: write
46
+
contents: write
47
+
48
+
steps:
49
+
50
+
# Not sue what goes on here? Whre did the secret come from?
51
+
# check *./docs/ready-pusher.md' for more details on how to set up and use this workflow
52
+
- uses: actions/checkout@v6
53
+
with:
54
+
fetch-depth: 0# Fetch full history to ensure we can merge and push
55
+
token: ${{ secrets.READY_PUSHER }} # PAT with content:write (can not use secrets.GITHUB_TOKEN as it is a special case, it does not trigger other workflows on push)
56
+
57
+
- uses: devx-cafe/takt-actions/ready-to-trunk@v1
58
+
# with: #Uncomment if you want to override any of the default inputs
59
+
# target_branch: #default is main
60
+
# user_name: #default is "Ready Pusher Bot"
61
+
# user_email: #default is "ready-pusher@${{ github.repository_owner }}.github.com"
- '[0-9]+.[0-9]+.[0-9]+'# Matches Core SemVer versions - without a prefix: 0.9.0, 1.2.3
7
+
- '[a-zA-Z]+[0-9]+.[0-9]+.[0-9]+'# Matches Core SemVer versions - with a prefix: v1.0.0, ver1.0.0, RC1.0.0
8
+
- '[0-9]+.[0-9]+.[0-9]+*'# Matches Build and Prerelease SemVer versions - without a prefix: 0.9.0+1.03ed4d1, 0.9.0-alpha1, 0.9.0-alpha1+1.03ed4d1
9
+
- '[a-zA-Z]+[0-9]+.[0-9]+.[0-9]+*'# Matches Build and Prerelease SemVer versions - with a prefix: v0.9.0+1.03ed4d1, ver0.9.0-alpha1, RC0.9.0-alpha1+1.03ed4d1
10
+
11
+
workflow_dispatch:
12
+
inputs:
13
+
tag:
14
+
description: "Tag to release (e.g., v1.0.0 or 1.0.0)"
15
+
required: true
16
+
type: string
17
+
18
+
jobs:
19
+
release:
20
+
runs-on: ubuntu-latest
21
+
permissions:
22
+
contents: write
23
+
24
+
steps:
25
+
- uses: actions/checkout@v6
26
+
with:
27
+
ref: ${{ github.event.inputs.tag || github.ref }}
28
+
fetch-depth: 0# Fetch full history (needed for release notes generation)
29
+
fetch-tags: true # Ensure tags are fetched (needed for release notes generation)
The [TakT](https://www.lakruzz.com/stories/takt/) workflow which allows you to run a smooth Pull-Request free flow needs access to merge stuff into your trunk (`main`).
4
+
5
+
GitHub flows comes with a built-in worker-bee token. In the flows you can access it in `${{ secrets.GITHUB_TOKEN }}`
6
+
7
+
> [!CAUTION]
8
+
> While the ${{ secrets.GITHUB_TOKEN }} can be lifted to `contents:write` permissions. GitHub actions treats
9
+
> commits created with this token as a special case which:
10
+
> **These commits will not trigger other workflows**
11
+
12
+
We need that! The `ready.yml` flow is designed to trigger the `stage.yml` flow.
13
+
14
+
## Solution
15
+
16
+
- In you developer profile settings Go and create a [**Fine-grained personal access token**](https://github.com/settings/personal-access-tokens)
17
+
- Settings (recommended)
18
+
-**Token name**: `TAKT_CONTENT_WRITE`
19
+
-**Description**: `Used to support the workflows devx-cafe/gh-tt workflow`
20
+
-**Ressource owner**: `<YOUR-ORGANIZATION>` (recommended) or `<USER>` if you don't have an organization
21
+
-**Expiration**: `<A-LONG-TIME>`
22
+
-**Repository access**`All` or `Only selected`
23
+
-**Permissions**: `contents:write`_(nothing else is needed)_
24
+
25
+
When you are done you will be presented a `gho****` token (GitHub oAuth) \_this is the only time you'll see this, but possibly not the only time you'll need it! So store it in your favorite password wallet.
26
+
27
+
<!-- cspell:ignore Cemi Okxps -->
28
+
29
+
> [!TIP]
30
+
> You can not store this in git!
31
+
> If you do, GitHub will see 👀 it in the security scans going on in the background and
32
+
> and it will revoke the token!
33
+
> IF you want to store it in git, encode it with `base64` first and decode it when you need to use it:
34
+
> Example:
35
+
> If your token is `gho_1ZCCemiYAvkChNLJ4zOkxpsBh6X7FUZn25`
- **Secret**: `<TAKT_CONTENT_WRITE-VALUE>` (starts with `gho***`)
67
+
68
+
## Use the secret
69
+
70
+
Regardless if you created the secret as a _repo_ or an _organizations_ wide secret you use it the same way.
71
+
72
+
When you need to manipulate a repo, push it back to origin and have possible flows trigger on the change, simply pass `${{ secrets.READY_PUSHER }}` at the token to the `checkout` action
73
+
74
+
```yaml
75
+
...
76
+
77
+
jobs:
78
+
some-job:
79
+
80
+
...
81
+
82
+
permissions:
83
+
contents: write # Required if you plan to push back _ even with your own token
84
+
85
+
steps:
86
+
87
+
...
88
+
89
+
- uses: actions/checkout@v6
90
+
with:
91
+
fetch-depth: 0 # Required if you plan to push back - Fetch full history
92
+
token: ${{ secrets.READY_PUSHER }} # Required if you want push backs to trigger other flows must have contents:write
0 commit comments