Sync SDK repos #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sync SDK repos | |
| # Keeps production and staging on one fast-forward-only history. Optional | |
| # dispatch tokens make the polling loop eager; the scheduled back-sync is the | |
| # safety backstop when those secrets are absent. | |
| on: | |
| schedule: | |
| - cron: '7,37 * * * *' | |
| workflow_dispatch: {} | |
| repository_dispatch: | |
| types: [prod-released] | |
| release: | |
| types: [published] | |
| push: | |
| branches: [main] | |
| jobs: | |
| back-sync: | |
| if: >- | |
| github.repository == 'kernel/kernel-python-sdk-staging' && | |
| (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch') | |
| runs-on: ${{ vars.STLC_RUNNER || 'ubuntu-latest' }} | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: stlc-back-sync | |
| cancel-in-progress: true | |
| steps: | |
| - name: Check out staging | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Fetch production main | |
| run: | | |
| git remote add production "https://github.com/kernel/kernel-python-sdk.git" | |
| git -c "http.https://github.com/.extraheader=" fetch production main | |
| - name: Check whether production has content staging lacks | |
| id: diff | |
| run: | | |
| MERGED=$(git merge-tree --write-tree origin/main production/main) || MERGED=conflict | |
| STAGING_TREE=$(git rev-parse 'origin/main^{tree}') | |
| if [ "$MERGED" = "$STAGING_TREE" ]; then | |
| echo "Staging already has production's content. Nothing to pull back." | |
| echo "behind=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "behind=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Sync production to staging | |
| if: steps.diff.outputs.behind == 'true' | |
| run: | | |
| if ! git merge-base --is-ancestor origin/main production/main; then | |
| echo "::error title=Back-sync blocked::staging main is not an ancestor of production/main." | |
| exit 1 | |
| fi | |
| git push origin production/main:refs/heads/main | |
| notify-back-sync: | |
| if: >- | |
| github.repository == 'kernel/kernel-python-sdk' && | |
| (github.event_name == 'release' || github.event_name == 'workflow_dispatch') | |
| runs-on: ${{ vars.STLC_RUNNER || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Dispatch back-sync to staging | |
| env: | |
| DISPATCH_TOKEN: ${{ secrets.STAGING_DISPATCH_TOKEN }} | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| if [ -z "${DISPATCH_TOKEN:-}" ]; then | |
| echo "::notice::STAGING_DISPATCH_TOKEN not configured; the scheduled back-sync remains active." | |
| exit 0 | |
| fi | |
| payload=$(jq -n --arg ref "$REF_NAME" '{event_type:"prod-released",client_payload:{ref:$ref}}') | |
| curl --fail-with-body -sS -X POST -H "Authorization: Bearer $DISPATCH_TOKEN" -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "https://api.github.com/repos/kernel/kernel-python-sdk-staging/dispatches" -d "$payload" | |
| seal-dispatch: | |
| if: github.repository == 'kernel/kernel-python-sdk-staging' && github.event_name == 'push' | |
| runs-on: ${{ vars.STLC_RUNNER || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: seal-dispatch-${{ github.ref }} | |
| cancel-in-progress: false | |
| steps: | |
| - name: Dispatch tracking sync | |
| env: | |
| DISPATCH_TOKEN: ${{ secrets.CONFIG_DISPATCH_TOKEN }} | |
| HEAD_MSG: ${{ github.event.head_commit.message }} | |
| HEAD_AUTHOR_NAME: ${{ github.event.head_commit.author.name }} | |
| SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| if printf '%s' "$HEAD_MSG" | grep -q 'Stainless-Generated-From' || [ "$HEAD_AUTHOR_NAME" = "stlc-bot" ]; then | |
| echo "Generated commit; skipping tracking dispatch." | |
| exit 0 | |
| fi | |
| if [ -z "${DISPATCH_TOKEN:-}" ]; then | |
| echo "::notice::CONFIG_DISPATCH_TOKEN not configured; the config repo's scheduled sync remains active." | |
| exit 0 | |
| fi | |
| payload=$(jq -n --arg sha "$SHA" --arg repo "${{ github.repository }}" '{event_type:"seal-custom-code",client_payload:{target:"all",sha:$sha,repo:$repo}}') | |
| curl --fail-with-body -sS -X POST -H "Authorization: Bearer $DISPATCH_TOKEN" -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "https://api.github.com/repos/kernel/kernel/dispatches" -d "$payload" |