apps/web/app/routes/workspace/actions-settings.tsx · flagon-io/g1t

async function managedAction(form: FormData, user: Parameters<typeof actions.removeWorkspaceManagedWorkflow>[0], workspace: string): Promise<ManagedResult> {

63

const intent = form.get("intent");

64

const name = String(form.get("name") ?? "").trim();

65

const done = (result: { ok: true } | { ok: false; error: { message: string } }): ManagedResult =>

66

result.ok ? { ok: true, error: null } : { ok: false, error: result.error.message };

67

if (intent === "managed-remove") return done(await actions.removeWorkspaceManagedWorkflow(user, workspace, name));

68

if (intent === "managed-refresh") return done(await actions.setWorkspaceManagedWorkflow(user, workspace, name, { refresh: true }));

69

const mode = form.get("mode") === "required" ? "required" : "default";

70

const visibility = String(form.get("visibility") ?? "all") as "all" | "public" | "private";

71

const change = {

72

source: String(form.get("source") ?? "").trim() || undefined,

73

mode,

74

repositories: form.get("target") === "all" ? [] : patterns(String(form.get("repositories") ?? "")),

75

visibility,

76

} as const;

77

return done(await actions.setWorkspaceManagedWorkflow(user, workspace, name, change, form.get("create") === "true"));

78

}

79

80

export async function action({ request, params, context }: Route.ActionArgs) {

81

assertSameOrigin(request);

82

if (roleIn(getViewer(context), params.owner) !== "owner") throw new Response(null, { status: 404 });

83

const user = requireUser(context, request);

84

const form = await request.formData();

85

if (String(form.get("intent") ?? "").startsWith("managed-")) {

86

return { saved: false, error: null, managed: await managedAction(form, user, params.owner.toLowerCase()) };

87

}

88

const level = (name: string): "read" | "write" => (form.get(name) === "write" ? "write" : "read");

89

const change: Partial<WorkspaceActionsSettings> = {

90

defaultPermissions: level("defaultPermissions"),

91

maxPermissions: level("maxPermissions"),

92

canApprovePullRequests: form.get("canApprovePullRequests") === "on",

93

};

94

const saved = await actions.setWorkspaceActionsSettings(user, params.owner.toLowerCase(), change);

95

return saved.ok ? { saved: true, error: null } : { saved: false, error: saved.error.message };

96

}

97

98

/** Where a workflow runs, in words. */

99

function targetWords(workflow: WorkspaceManagedWorkflow): string {

100

const which = workflow.repositories.length === 0 ? "Every repository" : workflow.repositories.join(", ");

101

if (workflow.visibility === "public") return `${which}, public ones only`;

102

if (workflow.visibility === "private") return `${which}, private ones only`;

return which;

}

/** The form that adds a managed workflow, or changes one. */

107

function ManagedWorkflowDialog({ workspace, workflow }: { workspace: string; workflow?: WorkspaceManagedWorkflow }) {

108

const [open, setOpen] = useState(false);

109

const fetcher = useFetcher<{ managed?: ManagedResult }>();

110

const result = fetcher.data?.managed;

111

const [target, setTarget] = useState(workflow && workflow.repositories.length > 0 ? "selected" : "all");

112

useEffect(() => {

113

if (fetcher.state === "idle" && result?.ok) setOpen(false);

114

}, [fetcher.state, result]);

return (

{workflow ? (

Edit

</Button>

) : (

Add workflow

</Button>

)}

</DialogTrigger>

<DialogTitle>{workflow ? `Edit ${workflow.workflowName}` : "Add a workflow"}</DialogTitle>

132

133

It runs in each repository it targets as that repository's own workflow, with its token and secrets. g1t copies the file when you save, and that

134

copy runs until you copy it again.

135

</DialogDescription>

136

</DialogHeader>

137

<fetcher.Form method="post" className="space-y-4">

{workflow ? (

) : (

</Field>

)}

</Field>

<RadioOption

value="required"

label="Required"

description="Runs in every repository it targets. A repository's workflow of the same name does not run in its place, and no one can turn it off there, so a ruleset can require its check."

/>

<RadioOption

value="default"

label="Default"

description="Runs where the repository has no workflow of the same name. A repository's admins can turn it off."

/>

</RadioGroup>

</div>

<p className="text-sm font-medium text-muted">Repositories</p>

<RadioOption

value="selected"

label="Repositories that match"

172

description="Names or patterns, one per line. * matches any characters; !name leaves one out."

173

/>

174

</RadioGroup>

175

{target === "selected" && (

<Textarea

name="repositories"

rows={4}

aria-label="Repository names and patterns"

180

defaultValue={workflow?.repositories.join("\n")}

181

placeholder={"web\napi-*\n!api-sandbox"}

/>

)}

</div>

<p className="text-sm font-medium text-muted">Visibility</p>

187

<SelectField

188

name="visibility"

189

defaultValue={workflow?.visibility ?? "all"}

190

aria-label="Visibility"

191

options={[

192

{ value: "all", label: "Public and private repositories" },

193

{ value: "public", label: "Public repositories only" },

194

{ value: "private", label: "Private repositories only" },

195

]}

196

/>

197

<p className="text-xs text-faint">A source in a private repository runs in private repositories only.</p>

198

</div>

199

<ErrorText>{result && !result.ok ? result.error : null}</ErrorText>

200

201

202

{workflow ? "Save" : "Add workflow"}

</SubmitButton>

</DialogFooter>

</fetcher.Form>

</DialogContent>

</Dialog>

);

}

function ManagedWorkflowCard({ workspace, workflow }: { workspace: string; workflow: WorkspaceManagedWorkflow }) {

212

const fetcher = useFetcher<{ managed?: ManagedResult }>();

213

const result = fetcher.data?.managed;

return (

{workflow.workflowName}

220

<Badge tone={workflow.mode === "required" ? "accent" : "neutral"}>{workflow.mode === "required" ? "Required" : "Default"}</Badge>

221

</p>

222

<p className="mt-0.5 font-mono text-xs break-all text-faint">{workflow.path}</p>

</div>

<fetcher.Form method="post">

Copy again

</SubmitButton>

</fetcher.Form>

Remove

</Button>

</AlertDialogTrigger>

239

240

<fetcher.Form method="post">

<AlertDialogTitle>Remove {workflow.workflowName}?</AlertDialogTitle>

245

<AlertDialogDescription>It stops running in {workspace}'s repositories. Its runs stay.</AlertDialogDescription>

246

</AlertDialogHeader>

247

248

<AlertDialogCancel type="button">Cancel</AlertDialogCancel>

Remove

</SubmitButton>

</AlertDialogFooter>

</fetcher.Form>

</AlertDialogContent>

</AlertDialog>

</div>

</div>

{workflow.source}

{workflow.sourceSha && <span className="text-faint"> at {workflow.sourceSha.slice(0, 7)}</span>}

263

</dd>

264

265

<dd>{targetWords(workflow)}</dd>

266

<dt className="text-muted">Copied</dt>

267

268

<TimeAgo at={workflow.updatedAt} /> by {workflow.updatedBy}

269

</dd>

270

</dl>

271

<ErrorText>{result && !result.ok ? result.error : null}</ErrorText>

</li>

);

}

function ManagedWorkflows({ workspace, managed }: { workspace: string; managed: WorkspaceManagedWorkflow[] | Failed }) {

return (

<div>

Workflows this workspace manages

284

</h2>

285

286

Workflows that run in {workspace}'s repositories without a file in them, each as <code className="font-mono text-xs">managed/<name>.yml</code>

287

. Each repository's Actions page lists them, managed by {workspace}.

</p>

</div>

</div>

{isFailed(managed) ? (

293

294

) : managed.length === 0 ? (

295

296

Add a workflow file from one of the workspace's repositories to run it in all of them, or in those you choose.

</EmptyState>

) : (

<ul>

{managed.map((workflow) => (

))}

</ul>

</Card>

)}

</section>

);

}

export default function WorkspaceActionsSettingsPage({ loaderData, actionData, params }: Route.ComponentProps) {

312

const { settings, managed, owner } = loaderData;

return (

<h1 className="text-xl font-semibold tracking-tight">Actions</h1>

317

318

What the token of each workflow job in this workspace's repositories may do when its workflow writes no{" "}

319

<code className="font-mono text-xs">permissions:</code>. Each repository can choose for itself under its Settings, Actions, within these limits.

</p>

</header>

<RadioOption

value="read"

label="Read repository contents and packages"

329

description={

330

<>

331

<code className="font-mono">contents: read</code> and <code className="font-mono">packages: read</code>. The default.

</>

}

/>

</RadioGroup>

<p className="text-sm text-muted">Repositories made before restricted tokens keep read and write until someone chooses otherwise.</p>

</Section>

<RadioOption

value="read"

label="Read only"

description="Every repository's jobs get read-only tokens unless their workflow writes permissions:."

/>

</RadioGroup>

</Section>

<CheckboxOption

name="canApprovePullRequests"

354

defaultChecked={settings.canApprovePullRequests}

355

label="Allow repositories to let g1t Actions create and approve pull requests"

356

description="Each repository still turns it on for itself, under its Settings, Actions."

/>

</Section>

</fieldset>

{owner ? (

<SubmitButton pending="Saving…">Save settings</SubmitButton>

364

{actionData?.saved && <span className="text-sm text-muted">Saved.</span>}

365

<ErrorText>{actionData?.error}</ErrorText>

366

</div>

367

) : (

368

<p className="text-sm text-muted">Only the workspace's owners can change these.</p>

)}

</Form>

{owner ? (

) : (

<h2 className="font-medium">Workflows this workspace manages</h2>

376

377

Only the workspace's owners can see and change the workflows it runs in its repositories. Each repository's Actions page lists the ones that run

there.

</p>

</section>

)}

</div>

);

}