diff --git a/.copier-answers.safe-settings.yml b/.copier-answers.safe-settings.yml index c05f9f3..1754e5d 100644 --- a/.copier-answers.safe-settings.yml +++ b/.copier-answers.safe-settings.yml @@ -1,3 +1,3 @@ # Changes here will be overwritten by Copier; NEVER EDIT MANUALLY -_commit: v1.1.0 +_commit: v2.3.0 _src_path: https://github.com/dafyddj/copier-safe-settings diff --git a/.github/workflows/apply-formula-safe-settings.yml b/.github/workflows/apply-formula-safe-settings.yml new file mode 100644 index 0000000..dc0cef4 --- /dev/null +++ b/.github/workflows/apply-formula-safe-settings.yml @@ -0,0 +1,22 @@ +name: Apply Formula Safe Settings +on: + workflow_dispatch: + inputs: + dry-run: + description: Whether to run in `dry-run` mode or not + required: false + type: boolean + default: true + +permissions: {} + +jobs: + apply-safe-settings: + permissions: + contents: read + # This is required to work with environment secrets in the called workflow + secrets: inherit # zizmor: ignore[secrets-inherit] + uses: ./.github/workflows/libsafe-settings.yml + with: + config-path: formula-safe-settings + dry-run: ${{ inputs.dry-run }} diff --git a/.github/workflows/libsafe-settings.yml b/.github/workflows/libsafe-settings.yml new file mode 100644 index 0000000..98f84bd --- /dev/null +++ b/.github/workflows/libsafe-settings.yml @@ -0,0 +1,83 @@ +name: Apply Safe Settings (Library) +on: + workflow_call: + inputs: + admin-repo: + type: string + default: .github + config-path: + type: string + default: safe-settings + deployment-config-file: + type: string + default: deployment-settings.yml + dry-run: + type: boolean + default: true + skip-dry-run-errors: + type: boolean + default: true + target-environment: + type: string + default: production + +permissions: {} + +jobs: + apply-safe-settings: + permissions: + contents: read + runs-on: ubuntu-24.04 + environment: ${{ github.ref_name == github.event.repository.default_branch && inputs.target-environment || 'test' }} + env: + # Version/tag of `github/safe-settings` repository to use: + SAFE_SETTINGS_VERSION: 1a2c52d22d58747718e54ad1fbbefd0b56b003c1 # 2.1.17-config-ref + + # Path on GHA runner box where safe-settings code downloaded to: + SAFE_SETTINGS_CODE_DIR: .safe-settings-code + steps: + - uses: qoomon/actions--context@e12e182be797e3476990faf801dd1b87f107f91c # v5.0.1 + - name: Job information + run: | + msg="" + msg+="APP_ID is: $APP_ID"$'\n' + msg+="PRIVATE_KEY is " && [ -z "$PRIVATE_KEY" ] && msg+="empty"$'\n' || msg+="not empty"$'\n' + msg+="Run environment is: $GITHUB_ENVIRONMENT" + msg=${msg//$'\n'/'%0A'} + + echo "::notice::$msg" + env: + APP_ID: ${{ vars.SAFE_SETTINGS_APP_ID }} + PRIVATE_KEY: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }} + # Self-checkout to access deployment configuration + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + # Checkout of `safe-settings` source repository to run app + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + repository: dafyddj/safe-settings + ref: ${{ env.SAFE_SETTINGS_VERSION }} + path: ${{ env.SAFE_SETTINGS_CODE_DIR }} + persist-credentials: false + - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + with: + cache: npm + cache-dependency-path: ${{ env.SAFE_SETTINGS_CODE_DIR }}/package-lock.json + node-version-file: ${{ env.SAFE_SETTINGS_CODE_DIR }}/.nvmrc + - run: npm install + working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }} + - name: Run Safe-Settings Full-Sync + continue-on-error: ${{ inputs.dry-run && inputs.skip-dry-run-errors }} + run: | + npm run full-sync + working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }} + env: + APP_ID: ${{ vars.SAFE_SETTINGS_APP_ID }} + ADMIN_REPO: ${{ inputs.admin-repo }} + CONFIG_PATH: ${{ inputs.config-path }} + CONFIG_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} + DEPLOYMENT_CONFIG_FILE: ${{ github.workspace }}/${{ inputs.config-path }}/${{ inputs.deployment-config-file }} + FULL_SYNC_NOP: ${{ inputs.dry-run }} + LOG_LEVEL: ${{ vars.SAFE_SETTINGS_LOG_LEVEL || 'debug' }} + PRIVATE_KEY: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }} diff --git a/.github/workflows/safe-settings.yml b/.github/workflows/safe-settings.yml deleted file mode 100644 index 69ab65f..0000000 --- a/.github/workflows/safe-settings.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Apply Safe Settings -on: - workflow_dispatch: - inputs: - dry-run: - description: Whether to run in `dry-run` mode or not - required: false - type: boolean - default: true - -permissions: {} - -jobs: - apply-safe-settings: - permissions: - contents: read - runs-on: ubuntu-24.04 - environment: ${{ github.ref_name == github.event.repository.default_branch && 'production' || 'test' }} - env: - # Version/tag of `github/safe-settings` repository to use: - SAFE_SETTINGS_VERSION: ff7a65655d33006b9820479df0a9e1057a8927e4 # 2.1.17 - - # Path on GHA runner box where safe-settings code downloaded to: - SAFE_SETTINGS_CODE_DIR: .safe-settings-code - steps: - # Self-checkout of 'admin' repo for access to safe-settings deployment configuration - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - # Checkout of `safe-settings` source repository to apply all settings - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - repository: github/safe-settings - ref: ${{ env.SAFE_SETTINGS_VERSION }} - path: ${{ env.SAFE_SETTINGS_CODE_DIR }} - persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - cache: npm - cache-dependency-path: ${{ env.SAFE_SETTINGS_CODE_DIR }}/package-lock.json - node-version-file: ${{ env.SAFE_SETTINGS_CODE_DIR }}/.nvmrc - - run: npm install - working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }} - - name: Run Safe-Settings Full-Sync - run: | - set +e # Allow commands to fail - npm run full-sync - exit_code=$? - echo "Full-sync exit code: $exit_code" - - if [[ "$FULL_SYNC_NOP" == "true" ]]; then - echo "Dry-run mode — ignoring failure" - exit 0 - fi - - exit $exit_code - working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }} - env: - APP_ID: ${{ vars.SAFE_SETTINGS_APP_ID }} - ADMIN_REPO: ${{ vars.SAFE_SETTINGS_ADMIN_REPO || '.github' }} - CONFIG_PATH: ${{ vars.SAFE_SETTINGS_CONFIG_PATH || 'safe-settings' }} - DEPLOYMENT_CONFIG_FILE: ${{ github.workspace }}/${{ vars.SAFE_SETTINGS_CONFIG_PATH || 'safe-settings' }}/deployment-settings.yml - FULL_SYNC_NOP: ${{ inputs.dry-run }} - GH_ORG: ${{ vars.SAFE_SETTINGS_GH_ORG }} - LOG_LEVEL: ${{ vars.SAFE_SETTINGS_LOG_LEVEL || 'debug' }} - PRIVATE_KEY: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }} diff --git a/safe-settings/repos/template-formula.yml b/formula-safe-settings/repos/template-formula.yml similarity index 100% rename from safe-settings/repos/template-formula.yml rename to formula-safe-settings/repos/template-formula.yml diff --git a/safe-settings/settings.yml b/formula-safe-settings/settings.yml similarity index 100% rename from safe-settings/settings.yml rename to formula-safe-settings/settings.yml diff --git a/safe-settings/suborgs/rulesets.yml b/formula-safe-settings/suborgs/rulesets.yml similarity index 100% rename from safe-settings/suborgs/rulesets.yml rename to formula-safe-settings/suborgs/rulesets.yml