chore: update changelog for GitHub Actions version updates #255
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| # © Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. | |
| name: Synchronise OSPO Workflows | |
| on: | |
| pull_request: | |
| # we should not inject commits into Pull Requests targeting the main branch | |
| # everything should go via develop and then be merged to main via release/hotfix | |
| branches-ignore: | |
| - "main" | |
| jobs: | |
| synchronise-ospo-workflows: | |
| if: github.actor != 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Fetch GitHub App token for target repo (write) | |
| id: target_token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.OSPO_WORKFLOW_APP_ID }} | |
| private-key: ${{ secrets.OSPO_WORKFLOW_PRIVATE_KEY }} | |
| # principle of least privilege, request only the permissions needed for this job | |
| permission-contents: write | |
| permission-workflows: write | |
| - name: Checkout target repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| token: ${{ steps.target_token.outputs.token }} | |
| - name: Checkout OSPO source repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: National-Digital-Twin/ospo-resources | |
| path: ospo-resources | |
| - name: Copy and compare workflow files from OSPO repo | |
| run: | | |
| while IFS= read -r file || [ -n "$file" ]; do | |
| # Skip comments and empty lines | |
| if [[ -z "$file" || "$file" == \#* ]]; then | |
| continue | |
| fi | |
| src="ospo-resources/$file" | |
| filename="$(basename "$file")" | |
| tgt=".github/workflows/$filename" | |
| if [ ! -f "$src" ]; then | |
| echo "WARNING: Source file not found in OSPO repository: $src" | |
| continue | |
| fi | |
| mkdir -p "$(dirname "$tgt")" | |
| if [ ! -f "$tgt" ]; then | |
| echo "File missing in target repo: $tgt" | |
| cp "$src" "$tgt" | |
| elif ! cmp -s "$src" "$tgt"; then | |
| echo "File differs and will be updated: $tgt" | |
| cp "$src" "$tgt" | |
| else | |
| echo "File is already up to date: $tgt" | |
| fi | |
| done < ospo-resources/organisation-required-workflows.txt | |
| - name: Copy and compare fork-specific workflow files from OSPO repo | |
| if: github.event.repository.fork == true && vars.FORK_WORKFLOWS_OPT_IN == 'true' | |
| run: | | |
| while IFS= read -r file || [ -n "$file" ]; do | |
| # Skip comments and empty lines | |
| if [[ -z "$file" || "$file" == \#* ]]; then | |
| continue | |
| fi | |
| src="ospo-resources/tools/fork-support/$file" | |
| filename="$(basename "$file")" | |
| tgt=".github/workflows/$filename" | |
| if [ ! -f "$src" ]; then | |
| echo "WARNING: Source file not found in OSPO repository: $src" | |
| continue | |
| fi | |
| mkdir -p "$(dirname "$tgt")" | |
| if [ ! -f "$tgt" ]; then | |
| echo "File missing in target repo: $tgt" | |
| cp "$src" "$tgt" | |
| elif ! cmp -s "$src" "$tgt"; then | |
| echo "File differs and will be updated: $tgt" | |
| cp "$src" "$tgt" | |
| else | |
| echo "File is already up to date: $tgt" | |
| fi | |
| done < ospo-resources/organisation-required-workflows-forks.txt | |
| - name: Check out pull request branch | |
| env: | |
| HEAD_REF: ${{ github.head_ref }} | |
| run: | | |
| git fetch origin "$HEAD_REF" | |
| git checkout "$HEAD_REF" | |
| - name: Auto-commit updated workflow files (if applicable) | |
| uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 | |
| with: | |
| commit_message: "feat(OSPO): synchronise OSPO workflows" | |
| commit_user_name: ${{ steps.target_token.outputs.app-slug }}[bot] | |
| commit_user_email: ${{ steps.target_token.outputs.user-id }}+${{ steps.target_token.outputs.app-slug }}[bot]@users.noreply.github.com | |
| file_pattern: .github/workflows/* | |
| skip_fetch: true | |
| - name: Check for file changes and fail if sync is not complete | |
| run: | | |
| if [ "$(git status --porcelain .github/workflows)" != "" ]; then | |
| echo "Some workflow files were changed. Failing status check to block merge until sync is complete." | |
| exit 1 | |
| else | |
| echo "No changes required. All OSPO workflow files are in sync." | |
| fi | |