Skip to content

Add GitHub Action to sync wiki to public repo #914

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mensfeld wants to merge 1 commit into from
Closed

Add GitHub Action to sync wiki to public repo #914

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions .github/workflows/sync-wiki.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
name: Sync Wiki

on:
gollum: # Triggers when the hidden wiki is edited via GitHub UI
workflow_dispatch: # Allow manual trigger

jobs:
sync-to-public:
runs-on: ubuntu-latest
steps:
- name: Checkout hidden wiki
uses: actions/checkout@v4
with:
repository: ruby-shoryuken/shoryuken.wiki
path: hidden-wiki

- name: Checkout public wiki
uses: actions/checkout@v4
with:
repository: ruby-shoryuken/wiki
path: public-wiki
token: ${{ secrets.WIKI_SYNC_TOKEN }}

- name: Sync wikis
run: |
# Copy all files from hidden wiki to public wiki (excluding .git)
rsync -av --delete hidden-wiki/ public-wiki/ --exclude .git

cd public-wiki

# Check if there are changes
git add -A
if git diff --staged --quiet; then
echo "No changes to sync"
exit 0
fi

# Configure git and commit
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git commit -m "Sync from shoryuken.wiki"
git push
Comment on lines +9 to +42

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 1 month ago

To fix the problem, add an explicit permissions: block at the job or workflow root specifying only the minimum required privileges for the workflow. Since the job interacts with repositories (performing git operations, but using a personal access token for push), at minimum it will need contents: read to check out code. If it never uses the GITHUB_TOKEN for write operations, contents: read is sufficient.
Best fix: Add

permissions:
  contents: read

at the top/root (just after name: and before on:), which ensures all jobs in the workflow only get read-only access to repository contents, unless overridden per-job.
No imports or extra definitions are required, just this change to the workflow YAML.

Suggested changeset 1
.github/workflows/sync-wiki.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/sync-wiki.yml b/.github/workflows/sync-wiki.yml
--- a/.github/workflows/sync-wiki.yml
+++ b/.github/workflows/sync-wiki.yml
@@ -1,4 +1,6 @@
 name: Sync Wiki
+permissions:
+  contents: read
 
 on:
   gollum:  # Triggers when the hidden wiki is edited via GitHub UI
EOF
@@ -1,4 +1,6 @@
name: Sync Wiki
permissions:
contents: read

on:
gollum: # Triggers when the hidden wiki is edited via GitHub UI
Copilot is powered by AI and may make mistakes. Always verify output.
Loading