ncmake workflow update #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 [ernolf] Raphael Gradenwitz <raphael.gradenwitz@googlemail.com> | |
| # SPDX-License-Identifier: MIT | |
| # | |
| # ncmake workflow updater: on a schedule, refreshes the ncmake-managed CI | |
| # workflows from their upstream templates (make workflows-update) and opens a | |
| # pull request when anything changed. This replaces Dependabot for the files | |
| # under .github/workflows/. | |
| # | |
| # Authentication is a GitHub App (Contents, Pull requests and Workflows: write), | |
| # minted per run as a short-lived token. The app is required because the default | |
| # GITHUB_TOKEN may not push workflow files, and it is preferred over a PAT | |
| # because the same token both pushes the files and produces verified, signed | |
| # commits. Store its credentials as the NCMAKE_UPDATER_CLIENT_ID and | |
| # NCMAKE_UPDATER_PRIVATE_KEY secrets. See doc/AUTOUPDATE_WORKFLOW.md and | |
| # doc/GITHUB_APP.md. | |
| name: ncmake workflow update | |
| on: | |
| schedule: | |
| # Daily at 05:30 UTC. GitHub starts scheduled runs on a best-effort basis and | |
| # delays them under load, so expect this a few hours late, not on the minute | |
| # (see doc/AUTOUPDATE_WORKFLOW.md). Trigger workflow_dispatch to run without | |
| # waiting for the schedule. | |
| - cron: '30 5 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ncmake-workflow-update | |
| cancel-in-progress: false | |
| jobs: | |
| update: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Create app token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.NCMAKE_UPDATER_CLIENT_ID }} | |
| private-key: ${{ secrets.NCMAKE_UPDATER_PRIVATE_KEY }} | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Refresh managed workflows from upstream | |
| run: | | |
| make dev-init | |
| make workflows-update | |
| - name: Open pull request | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| sign-commits: true | |
| signoff: true | |
| branch: ncmake/ci/workflow-update | |
| delete-branch: true | |
| add-paths: .github/workflows/ | |
| title: 'ci: update managed CI workflows from upstream' | |
| commit-message: 'ci: update managed CI workflows from upstream' | |
| body: | | |
| Automated by the ncmake workflow updater. | |
| `make workflows-update` refreshed the ncmake-managed workflows from | |
| their upstream templates (nextcloud/.github + ncmake). Locally | |
| modified workflows are left untouched. Review the diff and merge. |