Skip to content

Commit 3b543e9

Browse files
remalremal
authored
Merge template repository changes: remal-github-actions/template-typescript (#2544)
1 parent 63dd941 commit 3b543e9

File tree

6 files changed

+59
-124
lines changed

6 files changed

+59
-124
lines changed

‎.github/workflows/bump-repository-activity.yml‎

Lines changed: 8 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ on:
2525
type: number
2626

2727
permissions:
28-
contents: write
28+
id-token: write
2929

3030
concurrency:
3131
group: bump-repository-activity-${{github.ref}}
@@ -35,42 +35,24 @@ defaults:
3535
run:
3636
shell: bash
3737

38-
env:
39-
PUSH_BACK_TOKEN: ${{secrets.PUSH_BACK_TOKEN || github.token}}
40-
4138
jobs:
4239
bump-repository-activity:
4340
name: Bump repository activity
4441
runs-on: ubuntu-latest
4542
timeout-minutes: 5
4643
steps:
47-
- name: Get rate limits
48-
uses: remal-github-actions/get-rate-limits@v1
49-
id: rate-limits
44+
- name: Get GitHub Token
45+
id: get-token
46+
uses: remal/github-repository-token-issuer@v1
5047
with:
51-
githubToken: ${{env.PUSH_BACK_TOKEN}}
52-
- name: Make rate limits decision
53-
id: decision
54-
run: |
55-
echo "Core rate limit usage: ${{steps.rate-limits.outputs.coreUsage}}"
56-
if [ "${{steps.rate-limits.outputs.coreUsage < 75}}" == "true" ]; then
57-
echo "Enough rate limits"
58-
echo 'enough=true' >> $GITHUB_OUTPUT
59-
else
60-
echo "::warning::Not enough rate limits!"
61-
if [ "${{github.event_name != 'schedule'}}" == "true" ]; then
62-
echo "::warning::Executing anyway, as event is '${{github.event_name}}'"
63-
echo 'enough=true' >> $GITHUB_OUTPUT
64-
else
65-
echo 'enough=false' >> $GITHUB_OUTPUT
66-
fi
67-
fi
48+
scopes: |
49+
contents: write
6850
6951
- name: Bump repository activity
70-
if: ${{fromJSON(steps.decision.outputs.enough) == true}}
7152
uses: remal-github-actions/bump-repository-activity@v1
7253
with:
7354
dryRun: ${{inputs.dryRun || 'false'}}
74-
githubToken: ${{env.PUSH_BACK_TOKEN}}
55+
githubToken: ${{steps.get-token.outputs.token}}
56+
maxInactivityDays: ${{inputs.maxInactivityDays || 14}}
7557
bumperFile: 'repository-activity.bumper'
7658
commitMessage: '[push-back] Bump repository activity'

‎.github/workflows/cancel-pr-actions.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ on:
66
- closed
77

88
permissions:
9-
pull-requests: 'read'
10-
checks: 'read'
11-
actions: 'write'
9+
pull-requests: read
10+
checks: read
11+
actions: write
1212

1313
jobs:
1414
cancel-pr-actions:

‎.github/workflows/check-action-secrets.yml‎

Lines changed: 18 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ on:
1111
- cron: '15 17 * * *' # sync-with-template: adjust
1212
workflow_dispatch: { }
1313

14+
permissions:
15+
id-token: write
16+
1417
concurrency:
1518
group: check-action-secrets-${{github.ref}}
1619
cancel-in-progress: true
@@ -25,30 +28,23 @@ jobs:
2528
runs-on: ubuntu-latest
2629
timeout-minutes: 5
2730
steps:
28-
- name: Get rate limits
29-
uses: remal-github-actions/get-rate-limits@v1
30-
id: rate-limits
31-
with:
32-
githubToken: ${{secrets.LIST_SECRETS || github.token}}
33-
- name: Make rate limits decision
34-
id: decision
31+
- name: Get repository owner type
32+
id: owner-type
3533
run: |
36-
echo "Core rate limit usage: ${{steps.rate-limits.outputs.coreUsage}}"
37-
if [ "${{steps.rate-limits.outputs.coreUsage < 75}}" == "true" ]; then
38-
echo "Enough rate limits"
39-
echo 'enough=true' >> $GITHUB_OUTPUT
40-
else
41-
echo "::warning::Not enough rate limits!"
42-
if [ "${{github.event_name != 'schedule'}}" == "true" ]; then
43-
echo "::warning::Executing anyway, as event is '${{github.event_name}}'"
44-
echo 'enough=true' >> $GITHUB_OUTPUT
45-
else
46-
echo 'enough=false' >> $GITHUB_OUTPUT
47-
fi
48-
fi
34+
REPO_JSON=$(curl -s "${{github.api_url}}/repos/${{github.repository}}" -H "Authorization: token ${{github.token}}")
35+
OWNER_TYPE=$(echo $REPO_JSON | jq -r '.owner.type')
36+
OWNER_TYPE=$(echo "$OWNER_TYPE" | tr '[:upper:]' '[:lower:]')
37+
echo "owner-type=$OWNER_TYPE" | tee -a $GITHUB_OUTPUT
38+
39+
- name: Get GitHub Token
40+
id: get-token
41+
uses: remal/github-repository-token-issuer@v1
42+
with:
43+
scopes: |
44+
secrets: read
45+
${{steps.owner-type.outputs.owner-type == 'organization' && 'organization_secrets:read' || ''}}
4946
5047
- name: Check action secrets
51-
if: ${{fromJSON(steps.decision.outputs.enough) == true}}
5248
uses: remal-github-actions/check-action-secrets@v1
5349
with:
54-
githubToken: ${{secrets.LIST_SECRETS || github.token}}
50+
githubToken: ${{steps.get-token.outputs.token}}

‎.github/workflows/codeowners-validator.yml‎

Lines changed: 12 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -14,49 +14,14 @@ on:
1414
workflow_dispatch: { }
1515

1616
permissions:
17-
contents: read
17+
id-token: write
1818

1919
concurrency:
2020
group: codeowners-validation-${{github.ref}}
2121
cancel-in-progress: true
2222

23-
env:
24-
VALIDATION_TOKEN: ${{secrets.CODEOWNERS_VALIDATOR_TOKEN && secrets.CODEOWNERS_VALIDATOR_TOKEN || github.token}}
25-
2623
jobs:
27-
rate-limits:
28-
name: Check rate limits
29-
runs-on: ubuntu-latest
30-
timeout-minutes: 5
31-
steps:
32-
- name: Get rate limits
33-
uses: remal-github-actions/get-rate-limits@v1
34-
id: rate-limits
35-
with:
36-
githubToken: ${{env.VALIDATION_TOKEN || github.token}}
37-
- name: Make decision
38-
id: decision
39-
run: |
40-
echo "Core rate limit usage: ${{steps.rate-limits.outputs.coreUsage}}"
41-
if [ "${{steps.rate-limits.outputs.coreUsage < 75}}" == "true" ]; then
42-
echo "Enough rate limits"
43-
echo 'enough=true' >> $GITHUB_OUTPUT
44-
else
45-
echo "::warning::Not enough rate limits!"
46-
if [ "${{github.event_name != 'schedule'}}" == "true" ]; then
47-
echo "::warning::Executing anyway, as event is '${{github.event_name}}'"
48-
echo 'enough=true' >> $GITHUB_OUTPUT
49-
else
50-
echo 'enough=false' >> $GITHUB_OUTPUT
51-
fi
52-
fi
53-
outputs:
54-
enough: ${{steps.decision.outputs.enough}}
55-
5624
codeowners-validation:
57-
needs:
58-
- rate-limits
59-
if: ${{fromJSON(needs.rate-limits.outputs.enough) == true}}
6025
runs-on: ubuntu-latest
6126
timeout-minutes: 15
6227
steps:
@@ -68,20 +33,22 @@ jobs:
6833
- name: Get repository owner type
6934
id: owner-type
7035
run: |
71-
REPO_JSON=$(curl -s "${{github.api_url}}/repos/${{github.repository}}" -H "Authorization: token ${{env.VALIDATION_TOKEN}}")
36+
REPO_JSON=$(curl -s "${{github.api_url}}/repos/${{github.repository}}" -H "Authorization: token ${{github.token}}")
7237
OWNER_TYPE=$(echo $REPO_JSON | jq -r '.owner.type')
7338
OWNER_TYPE=$(echo "$OWNER_TYPE" | tr '[:upper:]' '[:lower:]')
7439
echo "owner-type=$OWNER_TYPE" | tee -a $GITHUB_OUTPUT
7540
76-
- name: Basic CODEOWNERS validation
77-
if: ${{steps.owner-type.outputs.owner-type != 'organization'}}
78-
uses: mszostok/[email protected]
41+
- name: Get GitHub Token
42+
id: get-token
43+
uses: remal/github-repository-token-issuer@v1
7944
with:
80-
github_access_token: '${{env.VALIDATION_TOKEN}}'
81-
checks: 'syntax,duppatterns,files'
45+
scopes: |
46+
contents: read
47+
${{steps.owner-type.outputs.owner-type == 'organization' && 'members:read' || ''}}
8248
83-
- name: Full CODEOWNERS validation
84-
if: ${{steps.owner-type.outputs.owner-type == 'organization'}}
49+
- name: CODEOWNERS validation
50+
if: ${{steps.owner-type.outputs.owner-type != 'organization'}}
8551
uses: mszostok/[email protected]
8652
with:
87-
github_access_token: '${{env.VALIDATION_TOKEN}}'
53+
github_access_token: '${{steps.get-token.outputs.token}}'
54+
checks: ${{steps.owner-type.outputs.owner-type == 'organization' && '' || 'duppatterns,files,syntax'}}

‎.github/workflows/rebase-dependabot-pull-requests.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ on:
1212
workflow_dispatch: { }
1313

1414
permissions:
15-
contents: read
16-
issues: write
1715
pull-requests: write
16+
issues: write
17+
contents: read
1818

1919
concurrency:
2020
group: rebase-dependabot-pull-requests-${{github.ref}}

‎.github/workflows/sync-with-template.yml‎

Lines changed: 16 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -22,49 +22,39 @@ on:
2222
- 'true'
2323
- 'false'
2424

25+
permissions:
26+
id-token: write
27+
2528
concurrency:
2629
group: sync-with-template-${{github.ref}}
2730
cancel-in-progress: true
2831

32+
env:
33+
TEMPLATE_REPOSITORY: ${{secrets.TEMPLATE_REPOSITORY || vars.TEMPLATE_REPOSITORY || ''}}
34+
2935
defaults:
3036
run:
3137
shell: bash
3238

33-
env:
34-
PUSH_BACK_TOKEN: ${{secrets.PUSH_BACK_TOKEN}}
35-
3639
jobs:
3740
sync-with-template:
3841
name: Sync with template repository
3942
runs-on: ubuntu-latest
4043
timeout-minutes: 30
4144
steps:
42-
- name: Get rate limits
43-
uses: remal-github-actions/get-rate-limits@v1
44-
id: rate-limits
45+
- name: Get GitHub Token
46+
id: get-token
47+
uses: remal/github-repository-token-issuer@v1
4548
with:
46-
githubToken: ${{env.PUSH_BACK_TOKEN || github.token}}
47-
- name: Make rate limits decision
48-
id: decision
49-
run: |
50-
echo "Core rate limit usage: ${{steps.rate-limits.outputs.coreUsage}}"
51-
if [ "${{steps.rate-limits.outputs.coreUsage < 75}}" == "true" ]; then
52-
echo "Enough rate limits"
53-
echo 'enough=true' >> $GITHUB_OUTPUT
54-
else
55-
echo "::warning::Not enough rate limits!"
56-
if [ "${{github.event_name != 'schedule'}}" == "true" ]; then
57-
echo "::warning::Executing anyway, as event is '${{github.event_name}}'"
58-
echo 'enough=true' >> $GITHUB_OUTPUT
59-
else
60-
echo 'enough=false' >> $GITHUB_OUTPUT
61-
fi
62-
fi
49+
scopes: |
50+
contents: write
51+
workflows: write
52+
pull_requests: write
53+
issues: write
6354
6455
- name: Sync with template repository
65-
if: ${{env.PUSH_BACK_TOKEN && fromJSON(steps.decision.outputs.enough) == true}}
6656
uses: remal-github-actions/sync-with-template@v3
6757
with:
6858
dryRun: ${{inputs.dryRun}}
69-
githubToken: ${{env.PUSH_BACK_TOKEN}}
70-
templateRepository: ${{secrets.TEMPLATE_REPOSITORY || vars.TEMPLATE_REPOSITORY || ''}}
59+
githubToken: ${{steps.get-token.outputs.token}}
60+
templateRepository: ${{env.TEMPLATE_REPOSITORY}}

0 commit comments

Comments
 (0)