From 0ecdcbe80482005ccc1356207577dc4361e8bea5 Mon Sep 17 00:00:00 2001 From: Jens Tirsvad Nielsen Date: Sat, 10 Oct 2026 11:15:38 +0800 Subject: [PATCH] Record that scoped delivery is verified across organisations The onboarding guide said delivery to other repositories was not verified. On 2026-10-10 the sync workflow ran without a copy in repositories of four organisations, so a repository needs no copy and each organisation needs its own secrets. Regenerate the Onboarding wiki page and its translations. Task: MIL-002#2 --- guides/onboarding.md | 19 ++++++++++--------- wiki/Onboarding.da.md | 12 +++++------- wiki/Onboarding.md | 19 ++++++++++--------- wiki/Onboarding.ms.md | 12 +++++------- 4 files changed, 30 insertions(+), 32 deletions(-) diff --git a/guides/onboarding.md b/guides/onboarding.md index be2f8b6..1905018 100644 --- a/guides/onboarding.md +++ b/guides/onboarding.md @@ -11,9 +11,9 @@ planned (see the [Project Plan](../docs/project-plan.md)). | --- | --- | | Gitea version | 1.27.3 | | `.gitea/scoped_workflows/sync-github-metadata.yml` runs in this repository | Verified: run 16, `workflow_dispatch`, succeeded | -| The same workflow applies to other repositories automatically | **Not verified.** Confirm how scoped workflows are delivered on the instance (admin or organization settings) before relying on it. | +| The same workflow applies to other repositories automatically | Verified on 2026-10-10: it ran, with no copy in the repository, in repositories of `TirSystem`, `TirSystem-BashScript`, `vl-staal` and `Tirsvad-Udemy-100-days-of-code` (for example `TirSystem/sqa-qc-checklists` and `TirSystem-BashScript/RepoFoundry`). The script it ran changed when this repository's changed. | -Until delivery is verified, onboard a repository by copying the workflow (below). +Delivery is automatic, so a repository needs no copy of the workflow. Secrets are not shared between organisations: each organisation needs its own (step 3). ## Steps @@ -25,15 +25,16 @@ Until delivery is verified, onboard a repository by copying the workflow (below) when there are several GitHub mirrors. With none, it succeeds without syncing anything. 3. **Add the two secrets** in the repository (or organization) settings, - using the scopes in [credentials.md](credentials.md): + using the scopes in [credentials.md](credentials.md). The workflow runs in + every repository of an organization, so store the secrets once per + organization; a repository in another organization does not see them: - `TOKEN_FOR_GITEA` - `PAT_FOR_GITHUB` (the GitHub token only) -4. **Deliver the workflow:** - - *If scoped workflows apply to the repository:* nothing to copy. - - *Otherwise:* copy `.gitea/scoped_workflows/sync-github-metadata.yml` - from this repository to `.gitea/workflows/` in the target repository. - Pin the copy to a reviewed version of this repository and re-copy - when it changes. +4. **Deliver the workflow:** scoped workflows apply to every repository on + this instance, so there is nothing to copy. Only where scoped delivery is + not set up, copy `.gitea/scoped_workflows/sync-github-metadata.yml` from + this repository to `.gitea/workflows/` in the target repository, pin the + copy to a reviewed version and re-copy when it changes. 5. **Set a description and topics** on the Gitea repository, so there is something to sync. 6. **Run it once manually:** Actions, **Sync GitHub mirror metadata**, diff --git a/wiki/Onboarding.da.md b/wiki/Onboarding.da.md index b6c7396..4b8f579 100644 --- a/wiki/Onboarding.da.md +++ b/wiki/Onboarding.da.md @@ -1,4 +1,4 @@ - + > Dette er en oversættelse af [`Onboarding`](Onboarding). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres. @@ -14,20 +14,18 @@ Sådan får en DevOps-professionel et TirSystem-repository til at bruge det fæl | --- | --- | | Gitea-version | 1.27.3 | | `.gitea/scoped_workflows/sync-github-metadata.yml` kører i dette repository | Verificeret: kørsel 16, `workflow_dispatch`, gennemført | -| Samme workflow gælder automatisk for andre repositories | **Ikke verificeret.** Bekræft, hvordan scoped workflows leveres på instansen (admin- eller organisationsindstillinger), før du stoler på det. | +| Samme workflow gælder automatisk for andre repositories | Verificeret 2026-10-10: det kørte, uden en kopi i repositoryet, i repositories i `TirSystem`, `TirSystem-BashScript`, `vl-staal` og `Tirsvad-Udemy-100-days-of-code` (fx `TirSystem/sqa-qc-checklists` og `TirSystem-BashScript/RepoFoundry`). Scriptet, det kørte, ændrede sig, når dette repositorys script ændrede sig. | -Indtil leveringen er verificeret, tilsluttes et repository ved at kopiere workflowet (se nedenfor). +Leveringen er automatisk, så et repository behøver ingen kopi af workflowet. Secrets deles ikke mellem organisationer: hver organisation skal have sine egne (trin 3). ## Trin 1. **Kontroller forudsætningerne** i repositoryet: Actions er aktiveret, og en runner med labelen `ubuntu-latest` og `python3` er online (se [Runners](#runners)). 2. **Konfigurer ét GitHub push-spejl** i repositoryets indstillinger (Settings, Repository, Mirror settings, Push mirror). Workflowet fejler, hvis der er flere GitHub-spejle. Hvis der ingen er, lykkes det uden at synkronisere noget. -3. **Tilføj de to secrets** i repositoryets (eller organisationens) indstillinger med de scopes, der står i [credentials.md](Credentials.da): +3. **Tilføj de to secrets** i repositoryets (eller organisationens) indstillinger med de scopes, der står i [credentials.md](Credentials.da). Workflowet kører i alle organisationens repositories, så gem secrets én gang pr. organisation; et repository i en anden organisation kan ikke se dem: - `TOKEN_FOR_GITEA` - `PAT_FOR_GITHUB` (kun GitHub-tokenet) -4. **Lever workflowet:** - - *Hvis scoped workflows gælder for repositoryet:* der er intet at kopiere. - - *Ellers:* kopier `.gitea/scoped_workflows/sync-github-metadata.yml` fra dette repository til `.gitea/workflows/` i mål-repositoryet. Fastlås kopien til en gennemgået version af dette repository, og kopier igen, når den ændres. +4. **Lever workflowet:** scoped workflows gælder for alle repositories på denne instans, så der er intet at kopiere. Kun hvor scoped levering ikke er sat op, kopieres `.gitea/scoped_workflows/sync-github-metadata.yml` fra dette repository til `.gitea/workflows/` i mål-repositoryet; fastlås kopien til en gennemgået version, og kopier igen, når den ændres. 5. **Angiv en beskrivelse og emner** på Gitea-repositoryet, så der er noget at synkronisere. 6. **Kør det én gang manuelt:** Actions, **Sync GitHub mirror metadata**, Run workflow. Loggen skal slutte med `Synced description and topics to /.`, og GitHub-repositoryet skal vise samme beskrivelse og emner. 7. Hvis det fejler, brug [troubleshooting.md](Troubleshooting.da). diff --git a/wiki/Onboarding.md b/wiki/Onboarding.md index 650e3d1..548a1aa 100644 --- a/wiki/Onboarding.md +++ b/wiki/Onboarding.md @@ -17,9 +17,9 @@ planned (see the [Project Plan](https://git.tirsystem.com/TirSystem/github-actio | --- | --- | | Gitea version | 1.27.3 | | `.gitea/scoped_workflows/sync-github-metadata.yml` runs in this repository | Verified: run 16, `workflow_dispatch`, succeeded | -| The same workflow applies to other repositories automatically | **Not verified.** Confirm how scoped workflows are delivered on the instance (admin or organization settings) before relying on it. | +| The same workflow applies to other repositories automatically | Verified on 2026-10-10: it ran, with no copy in the repository, in repositories of `TirSystem`, `TirSystem-BashScript`, `vl-staal` and `Tirsvad-Udemy-100-days-of-code` (for example `TirSystem/sqa-qc-checklists` and `TirSystem-BashScript/RepoFoundry`). The script it ran changed when this repository's changed. | -Until delivery is verified, onboard a repository by copying the workflow (below). +Delivery is automatic, so a repository needs no copy of the workflow. Secrets are not shared between organisations: each organisation needs its own (step 3). ## Steps @@ -31,15 +31,16 @@ Until delivery is verified, onboard a repository by copying the workflow (below) when there are several GitHub mirrors. With none, it succeeds without syncing anything. 3. **Add the two secrets** in the repository (or organization) settings, - using the scopes in [credentials.md](Credentials): + using the scopes in [credentials.md](Credentials). The workflow runs in + every repository of an organization, so store the secrets once per + organization; a repository in another organization does not see them: - `TOKEN_FOR_GITEA` - `PAT_FOR_GITHUB` (the GitHub token only) -4. **Deliver the workflow:** - - *If scoped workflows apply to the repository:* nothing to copy. - - *Otherwise:* copy `.gitea/scoped_workflows/sync-github-metadata.yml` - from this repository to `.gitea/workflows/` in the target repository. - Pin the copy to a reviewed version of this repository and re-copy - when it changes. +4. **Deliver the workflow:** scoped workflows apply to every repository on + this instance, so there is nothing to copy. Only where scoped delivery is + not set up, copy `.gitea/scoped_workflows/sync-github-metadata.yml` from + this repository to `.gitea/workflows/` in the target repository, pin the + copy to a reviewed version and re-copy when it changes. 5. **Set a description and topics** on the Gitea repository, so there is something to sync. 6. **Run it once manually:** Actions, **Sync GitHub mirror metadata**, diff --git a/wiki/Onboarding.ms.md b/wiki/Onboarding.ms.md index 81a34fb..2ee766a 100644 --- a/wiki/Onboarding.ms.md +++ b/wiki/Onboarding.ms.md @@ -1,4 +1,4 @@ - + > Ini ialah terjemahan [`Onboarding`](Onboarding). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya. @@ -14,20 +14,18 @@ Cara seorang profesional DevOps menjadikan repositori TirSystem menggunakan alir | --- | --- | | Versi Gitea | 1.27.3 | | `.gitea/scoped_workflows/sync-github-metadata.yml` berjalan dalam repositori ini | Disahkan: larian 16, `workflow_dispatch`, berjaya | -| Aliran kerja yang sama terpakai pada repositori lain secara automatik | **Belum disahkan.** Sahkan cara scoped workflow dihantar pada instans (tetapan pentadbir atau organisasi) sebelum bergantung padanya. | +| Aliran kerja yang sama terpakai pada repositori lain secara automatik | Disahkan pada 2026-10-10: ia berjalan, tanpa salinan dalam repositori, dalam repositori `TirSystem`, `TirSystem-BashScript`, `vl-staal` dan `Tirsvad-Udemy-100-days-of-code` (contohnya `TirSystem/sqa-qc-checklists` dan `TirSystem-BashScript/RepoFoundry`). Skrip yang dijalankannya berubah apabila skrip repositori ini berubah. | -Selagi penghantaran belum disahkan, sertakan repositori dengan menyalin aliran kerja (lihat di bawah). +Penghantaran adalah automatik, jadi repositori tidak memerlukan salinan aliran kerja. Rahsia (secret) tidak dikongsi antara organisasi: setiap organisasi memerlukan rahsianya sendiri (langkah 3). ## Langkah 1. **Semak prasyarat** dalam repositori: Actions diaktifkan, dan runner dengan label `ubuntu-latest` dan `python3` berada dalam talian (lihat [Runners](#runners)). 2. **Konfigurasikan satu push mirror GitHub** dalam tetapan repositori (Settings, Repository, Mirror settings, Push mirror). Aliran kerja gagal jika terdapat beberapa cermin GitHub. Jika tiada, ia berjaya tanpa menyegerakkan apa-apa. -3. **Tambah dua rahsia (secret)** dalam tetapan repositori (atau organisasi), dengan skop yang tertera dalam [credentials.md](Credentials.ms): +3. **Tambah dua rahsia (secret)** dalam tetapan repositori (atau organisasi), dengan skop yang tertera dalam [credentials.md](Credentials.ms). Aliran kerja berjalan dalam setiap repositori sesebuah organisasi, jadi simpan rahsia sekali bagi setiap organisasi; repositori dalam organisasi lain tidak melihatnya: - `TOKEN_FOR_GITEA` - `PAT_FOR_GITHUB` (token GitHub sahaja) -4. **Hantar aliran kerja:** - - *Jika scoped workflow terpakai pada repositori:* tiada apa yang perlu disalin. - - *Jika tidak:* salin `.gitea/scoped_workflows/sync-github-metadata.yml` dari repositori ini ke `.gitea/workflows/` dalam repositori sasaran. Sematkan salinan itu pada versi repositori ini yang telah disemak, dan salin semula apabila ia berubah. +4. **Hantar aliran kerja:** scoped workflow terpakai pada setiap repositori dalam instans ini, jadi tiada apa yang perlu disalin. Hanya jika penghantaran scoped tidak disediakan, salin `.gitea/scoped_workflows/sync-github-metadata.yml` dari repositori ini ke `.gitea/workflows/` dalam repositori sasaran, sematkan salinan itu pada versi yang telah disemak dan salin semula apabila ia berubah. 5. **Tetapkan penerangan dan topik** pada repositori Gitea, supaya ada sesuatu untuk disegerakkan. 6. **Jalankan sekali secara manual:** Actions, **Sync GitHub mirror metadata**, Run workflow. Log mesti berakhir dengan `Synced description and topics to /.` dan repositori GitHub mesti menunjukkan penerangan dan topik yang sama. 7. Jika gagal, gunakan [troubleshooting.md](Troubleshooting.ms).