Moves the sync script out of the scoped workflow into a file: the first half of MIL-004 task 6 (issue #69). The publisher follows in a second pull request.
Changes
tools/sync_github_metadata.py: the 221 lines that were embedded in sync-github-metadata.yml, unchanged in behaviour and messages, with a docstring that lists its environment variables.
.gitea/scoped_workflows/sync-github-metadata.yml: 230 lines down to 33. It checks out TirSystem/github-action at main into shared-scripts and runs python3 shared-scripts/tools/sync_github_metadata.py with the same four environment variables. The repository is public, so no token is needed for the checkout.
Tests (189 pass): tests/workflow_source.py imports the script file, with a wrapper so the existing tests of the script are unchanged; tests/test_workflows.py asserts that the workflow embeds no script, checks out this repository and runs the file, and that the script compiles and has a main.
Verified live
From TirSystem-BashScript/RepoFoundry (another organization) with that organization's real secrets, on throwaway branches (deleted): a thin workflow that fetched the script file ran Preflight passed: Gitea and GitHub accepted the credentials. and Synced description and topics to TirSystem-BashScript/RepoFoundry.
Risk, and how to merge it
This changes what repositories in all four organizations run on their next push to main. If the checkout failed there, their sync would fail. The checkout of this repository was already proven from two organizations and the thin workflow ran live, but I would merge this first, watch the first consumer runs, and only then move the publisher.
Two properties to know:
every consumer runs whatever main of this repository holds (the same trust as scoped delivery today); MIL-004 task 1 defines how a consumer pins a tag;
if this repository became private, the checkout would need a token.
Not in this pull request
The publisher (publish-wiki.yml, about 310 lines) still embeds its script.
README and wiki: nothing changes yet; the README still says "the Python embedded in them", which stays true until the publisher moves.
Moves the sync script out of the scoped workflow into a file: the first half of MIL-004 task 6 (issue #69). The publisher follows in a second pull request.
## Changes
- `tools/sync_github_metadata.py`: the 221 lines that were embedded in `sync-github-metadata.yml`, unchanged in behaviour and messages, with a docstring that lists its environment variables.
- `.gitea/scoped_workflows/sync-github-metadata.yml`: 230 lines down to 33. It checks out `TirSystem/github-action` at `main` into `shared-scripts` and runs `python3 shared-scripts/tools/sync_github_metadata.py` with the same four environment variables. The repository is public, so no token is needed for the checkout.
- Tests (189 pass): `tests/workflow_source.py` imports the script file, with a wrapper so the existing tests of the script are unchanged; `tests/test_workflows.py` asserts that the workflow embeds no script, checks out this repository and runs the file, and that the script compiles and has a `main`.
## Verified live
From `TirSystem-BashScript/RepoFoundry` (another organization) with that organization's real secrets, on throwaway branches (deleted): a thin workflow that fetched the script file ran `Preflight passed: Gitea and GitHub accepted the credentials.` and `Synced description and topics to TirSystem-BashScript/RepoFoundry.`
## Risk, and how to merge it
This changes what repositories in all four organizations run on their next push to `main`. If the checkout failed there, their sync would fail. The checkout of this repository was already proven from two organizations and the thin workflow ran live, but I would merge this first, watch the first consumer runs, and only then move the publisher.
Two properties to know:
- every consumer runs whatever `main` of this repository holds (the same trust as scoped delivery today); MIL-004 task 1 defines how a consumer pins a tag;
- if this repository became private, the checkout would need a token.
## Not in this pull request
- The publisher (`publish-wiki.yml`, about 310 lines) still embeds its script.
- README and wiki: nothing changes yet; the README still says "the Python embedded in them", which stays true until the publisher moves.
Refs #69
tools/sync_github_metadata.py holds the 221 lines that were embedded in
sync-github-metadata.yml, unchanged in behaviour and messages. The scoped
workflow now checks out TirSystem/github-action at main and runs the file
(33 lines instead of 230). The tests import the file instead of executing
the YAML. Verified live from TirSystem-BashScript/RepoFoundry with that
organisation's secrets.
Task: MIL-004#6
Tirsvad
merged commit e6db4b56d3 into main2026-10-10 14:31:24 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Moves the sync script out of the scoped workflow into a file: the first half of MIL-004 task 6 (issue #69). The publisher follows in a second pull request.
Changes
tools/sync_github_metadata.py: the 221 lines that were embedded insync-github-metadata.yml, unchanged in behaviour and messages, with a docstring that lists its environment variables..gitea/scoped_workflows/sync-github-metadata.yml: 230 lines down to 33. It checks outTirSystem/github-actionatmainintoshared-scriptsand runspython3 shared-scripts/tools/sync_github_metadata.pywith the same four environment variables. The repository is public, so no token is needed for the checkout.tests/workflow_source.pyimports the script file, with a wrapper so the existing tests of the script are unchanged;tests/test_workflows.pyasserts that the workflow embeds no script, checks out this repository and runs the file, and that the script compiles and has amain.Verified live
From
TirSystem-BashScript/RepoFoundry(another organization) with that organization's real secrets, on throwaway branches (deleted): a thin workflow that fetched the script file ranPreflight passed: Gitea and GitHub accepted the credentials.andSynced description and topics to TirSystem-BashScript/RepoFoundry.Risk, and how to merge it
This changes what repositories in all four organizations run on their next push to
main. If the checkout failed there, their sync would fail. The checkout of this repository was already proven from two organizations and the thin workflow ran live, but I would merge this first, watch the first consumer runs, and only then move the publisher.Two properties to know:
mainof this repository holds (the same trust as scoped delivery today); MIL-004 task 1 defines how a consumer pins a tag;Not in this pull request
publish-wiki.yml, about 310 lines) still embeds its script.Refs #69