refactor(formula-safe-settings): switch the safe-settings config for Formulas

.copier-answers.safe-settings.yml

@@ -1,3 +1,3 @@
 # Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
-_commit: v1.1.0
+_commit: v2.3.0
 _src_path: https://github.com/dafyddj/copier-safe-settings

.github/workflows/apply-formula-safe-settings.yml

@@ -0,0 +1,22 @@
+name: Apply Formula Safe Settings
+on:
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: Whether to run in `dry-run` mode or not
+        required: false
+        type: boolean
+        default: true
+
+permissions: {}
+
+jobs:
+  apply-safe-settings:
+    permissions:
+      contents: read
+    # This is required to work with environment secrets in the called workflow
+    secrets: inherit # zizmor: ignore[secrets-inherit]
+    uses: ./.github/workflows/libsafe-settings.yml
+    with:
+      config-path: formula-safe-settings
+      dry-run: ${{ inputs.dry-run }}

.github/workflows/libsafe-settings.yml

@@ -0,0 +1,83 @@
+name: Apply Safe Settings (Library)
+on:
+  workflow_call:
+    inputs:
+      admin-repo:
+        type: string
+        default: .github
+      config-path:
+        type: string
+        default: safe-settings
+      deployment-config-file:
+        type: string
+        default: deployment-settings.yml
+      dry-run:
+        type: boolean
+        default: true
+      skip-dry-run-errors:
+        type: boolean
+        default: true
+      target-environment:
+        type: string
+        default: production
+
+permissions: {}
+
+jobs:
+  apply-safe-settings:
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
+    environment: ${{ github.ref_name == github.event.repository.default_branch && inputs.target-environment || 'test' }}
+    env:
+      # Version/tag of `github/safe-settings` repository to use:
+      SAFE_SETTINGS_VERSION: 1a2c52d22d58747718e54ad1fbbefd0b56b003c1 # 2.1.17-config-ref
+
+      # Path on GHA runner box where safe-settings code downloaded to:
+      SAFE_SETTINGS_CODE_DIR: .safe-settings-code
+    steps:
+      - uses: qoomon/actions--context@e12e182be797e3476990faf801dd1b87f107f91c # v5.0.1
+      - name: Job information
+        run: |
+          msg=""
+          msg+="APP_ID is: $APP_ID"$'\n'
+          msg+="PRIVATE_KEY is " && [ -z "$PRIVATE_KEY" ] && msg+="empty"$'\n' || msg+="not empty"$'\n'
+          msg+="Run environment is: $GITHUB_ENVIRONMENT"
+          msg=${msg//$'\n'/'%0A'}
+
+          echo "::notice::$msg"
+        env:
+          APP_ID: ${{ vars.SAFE_SETTINGS_APP_ID }}
+          PRIVATE_KEY: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }}
+      # Self-checkout to access deployment configuration
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      # Checkout of `safe-settings` source repository to run app
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: dafyddj/safe-settings
+          ref: ${{ env.SAFE_SETTINGS_VERSION }}
+          path: ${{ env.SAFE_SETTINGS_CODE_DIR }}
+          persist-credentials: false
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          cache: npm
+          cache-dependency-path: ${{ env.SAFE_SETTINGS_CODE_DIR }}/package-lock.json
+          node-version-file: ${{ env.SAFE_SETTINGS_CODE_DIR }}/.nvmrc
+      - run: npm install
+        working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }}
+      - name: Run Safe-Settings Full-Sync
+        continue-on-error: ${{ inputs.dry-run && inputs.skip-dry-run-errors }}
+        run: |
+          npm run full-sync
+        working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }}
+        env:
+          APP_ID: ${{ vars.SAFE_SETTINGS_APP_ID }}
+          ADMIN_REPO: ${{ inputs.admin-repo }}
+          CONFIG_PATH: ${{ inputs.config-path }}
+          CONFIG_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          DEPLOYMENT_CONFIG_FILE: ${{ github.workspace }}/${{ inputs.config-path }}/${{ inputs.deployment-config-file }}
+          FULL_SYNC_NOP: ${{ inputs.dry-run }}
+          LOG_LEVEL: ${{ vars.SAFE_SETTINGS_LOG_LEVEL || 'debug' }}
+          PRIVATE_KEY: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }}