| 1 | # Publishes g1t's own actions: each folder of actions/ (deploy, detect…) |
| 2 | # is pushed, as the whole of its own history, to the repository of the |
| 3 | # same name in the g1t workspace on g1t.sh (actions/deploy to g1t/deploy), |
| 4 | # and its major tag, v1, is moved to it. Workflows anywhere use them as |
| 5 | # `uses: g1t/deploy@v1`. A change to an action that breaks how it is |
| 6 | # used gets a new major tag here (MAJOR below), and the old one stays. |
| 7 | # |
| 8 | # g1t's reusable workflows, in workflows/, go to g1t/workflows the same |
| 9 | # way (workflows/.g1t/workflows/deploy.yml is |
| 10 | # `g1t/workflows/.g1t/workflows/deploy.yml@v1`). |
| 11 | # |
| 12 | # Runs on a push to main that changes actions/ or workflows/, and by hand. |
| 13 | # |
| 14 | # Needs the repository secret G1T_ACTIONS_PUBLISH_TOKEN: an access token of |
| 15 | # the g1t workspace with contents: write on its action repositories |
| 16 | # (g1t/deploy, g1t/detect, and one for each new folder, made public |
| 17 | # before its first release). The job's own token reaches this repository |
| 18 | # only, so it cannot push there. |
| 19 | name: Actions release |
| 20 | |
| 21 | on: |
| 22 | push: |
| 23 | branches: [main] |
| 24 | paths: |
| 25 | - actions/** |
| 26 | - workflows/** |
| 27 | workflow_dispatch: |
| 28 | |
| 29 | permissions: |
| 30 | contents: read |
| 31 | |
| 32 | concurrency: |
| 33 | group: actions-release |
| 34 | cancel-in-progress: false |
| 35 | |
| 36 | env: |
| 37 | MAJOR: v1 |
| 38 | NAMESPACE: g1t |
| 39 | |
| 40 | jobs: |
| 41 | publish: |
| 42 | name: Publish g1t/<action> |
| 43 | runs-on: ubuntu-latest |
| 44 | timeout-minutes: 15 |
| 45 | steps: |
| 46 | - uses: actions/checkout@v5 |
| 47 | with: |
| 48 | fetch-depth: 0 |
| 49 | - name: Push each action and move its major tag |
| 50 | env: |
| 51 | PUBLISH_TOKEN: ${{ secrets.G1T_ACTIONS_PUBLISH_TOKEN }} |
| 52 | SERVER: ${{ github.server_url }} |
| 53 | run: | |
| 54 | set -euo pipefail |
| 55 | if [ -z "${PUBLISH_TOKEN}" ]; then |
| 56 | echo "::error::Set the repository secret G1T_ACTIONS_PUBLISH_TOKEN (this workflow's header says what it needs)." |
| 57 | exit 1 |
| 58 | fi |
| 59 | echo "::add-mask::${PUBLISH_TOKEN}" |
| 60 | auth="Authorization: Basic $(printf 'g1t:%s' "${PUBLISH_TOKEN}" | base64 -w0)" |
| 61 | git config user.name g1t |
| 62 | git config user.email g1t@users.noreply.g1t.sh |
| 63 | for dir in actions/*/; do |
| 64 | name="$(basename "${dir}")" |
| 65 | [ -f "${dir}action.yml" ] || { echo "::warning::${dir} has no action.yml; skipped."; continue; } |
| 66 | commit="$(git subtree split --prefix "actions/${name}" HEAD)" |
| 67 | remote="${SERVER}/${NAMESPACE}/${name}.git" |
| 68 | echo "Publishing actions/${name} (${commit}) to ${NAMESPACE}/${name}" |
| 69 | git -c http.extraHeader="${auth}" push "${remote}" "${commit}:refs/heads/main" |
| 70 | git -c http.extraHeader="${auth}" push --force "${remote}" "${commit}:refs/tags/${MAJOR}" |
| 71 | echo "- \`${NAMESPACE}/${name}@${MAJOR}\` is ${commit}" >> "${GITHUB_STEP_SUMMARY}" |
| 72 | done |
| 73 | # g1t's reusable workflows, from workflows/, as g1t/workflows. |
| 74 | if [ -d workflows/.g1t/workflows ]; then |
| 75 | commit="$(git subtree split --prefix workflows HEAD)" |
| 76 | remote="${SERVER}/${NAMESPACE}/workflows.git" |
| 77 | echo "Publishing workflows (${commit}) to ${NAMESPACE}/workflows" |
| 78 | git -c http.extraHeader="${auth}" push "${remote}" "${commit}:refs/heads/main" |
| 79 | git -c http.extraHeader="${auth}" push --force "${remote}" "${commit}:refs/tags/${MAJOR}" |
| 80 | echo "- \`${NAMESPACE}/workflows@${MAJOR}\` is ${commit}" >> "${GITHUB_STEP_SUMMARY}" |
| 81 | fi |