mirror of
https://github.com/community-scripts/ProxmoxVE.git
synced 2026-09-13 17:26:43 +00:00
7481db59e1
Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:
vars.APP_ID / secrets.APP_PRIVATE_KEY -> GHAPP_HEADERS_*
secrets.APP_{ID,KEY}_APPROVE_AND_MERGE -> GHAPP_MERGEBOT_*
vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
secrets.PB_BOT_APP_{ID,PRIVATE_KEY} -> GHAPP_PBBOT_*
Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:
secrets.POCKETBASE_URL -> vars.POCKETBASE_URL
secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
secrets.FRONTEND_URL -> vars.FRONTEND_URL (also replaces vars.SITE_URL)
The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:
REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
BREAKING_CHANGE_INGEST_SECRET -> FRONTEND_ADVISORY_SECRET
PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.
120 lines
4.0 KiB
YAML
Generated
120 lines
4.0 KiB
YAML
Generated
name: Auto Update .app-files
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- "ct/**.sh"
|
|
- "tools/**.sh"
|
|
- "vm/**.sh"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
update-app-files:
|
|
if: github.repository == 'community-scripts/ProxmoxVE'
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- name: Generate a token
|
|
id: generate-token
|
|
uses: actions/create-github-app-token@v3
|
|
with:
|
|
app-id: ${{ vars.GHAPP_HEADERS_ID }}
|
|
private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
|
|
|
|
- name: Generate a token for PR approval and merge
|
|
id: generate-token-merge
|
|
uses: actions/create-github-app-token@v3
|
|
with:
|
|
app-id: ${{ vars.GHAPP_MERGEBOT_ID }}
|
|
private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }}
|
|
|
|
# Step 1: Checkout repository
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
|
|
# Step 2: Disable file mode changes detection
|
|
- name: Disable file mode changes
|
|
run: git config core.fileMode false
|
|
|
|
# Step 3: Set up Git user for committing changes
|
|
- name: Set up Git
|
|
run: |
|
|
git config --global user.name "GitHub Actions"
|
|
git config --global user.email "github-actions[bot]@users.noreply.github.com"
|
|
|
|
# Step 4: Install figlet
|
|
- name: Install figlet
|
|
run: sudo apt-get install -y figlet
|
|
|
|
# Step 5: Run the updated generate-app-files.sh script
|
|
- name: Run generate-app-files.sh
|
|
run: |
|
|
chmod +x .github/workflows/scripts/generate-app-headers.sh
|
|
.github/workflows/scripts/generate-app-headers.sh
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# Step 6: Check if there are any changes
|
|
- name: Check if there are any changes
|
|
run: |
|
|
echo "Checking for changes..."
|
|
git add -A # Untracked Dateien aufnehmen
|
|
git status
|
|
if git diff --cached --quiet; then
|
|
echo "No changes detected."
|
|
echo "changed=false" >> "$GITHUB_ENV"
|
|
else
|
|
echo "Changes detected:"
|
|
git diff --stat --cached
|
|
echo "changed=true" >> "$GITHUB_ENV"
|
|
fi
|
|
|
|
# Step 7: Commit and create PR if changes exist
|
|
- name: Commit and create PR if changes exist
|
|
if: env.changed == 'true'
|
|
run: |
|
|
git commit -m "Update .app files"
|
|
git checkout -b pr-update-app-files
|
|
git push origin pr-update-app-files --force
|
|
gh pr create --title "[core] update .app files" \
|
|
--body "This PR is auto-generated by a GitHub Action to update the .app files." \
|
|
--head pr-update-app-files \
|
|
--base main \
|
|
--label "automated pr"
|
|
env:
|
|
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
|
|
|
|
- name: Approve pull request
|
|
if: env.changed == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
PR_NUMBER=$(gh pr list --head "pr-update-app-files" --json number --jq '.[].number')
|
|
if [ -n "$PR_NUMBER" ]; then
|
|
gh pr review $PR_NUMBER --approve
|
|
fi
|
|
|
|
- name: Approve pull request and merge
|
|
if: env.changed == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.generate-token-merge.outputs.token }}
|
|
run: |
|
|
git config --global user.name "github-actions-automege[bot]"
|
|
git config --global user.email "github-actions-automege[bot]@users.noreply.github.com"
|
|
PR_NUMBER=$(gh pr list --head "${BRANCH_NAME}" --json number --jq '.[].number')
|
|
if [ -n "$PR_NUMBER" ]; then
|
|
gh pr review $PR_NUMBER --approve
|
|
gh pr merge $PR_NUMBER --squash --admin
|
|
fi
|
|
|
|
# Step 8: Output success message when no changes
|
|
- name: No changes detected
|
|
if: env.changed == 'false'
|
|
run: echo "No changes to commit. Workflow completed successfully."
|