86 lines
3.6 KiB
YAML
86 lines
3.6 KiB
YAML
# Publish accepted milestones to the git host.
|
|
#
|
|
# On a push to main that changes docs/milestones/ or docs/sqa/reviews/, this
|
|
# workflow runs `sync-project.sh --accepted-only --apply`: every milestone whose
|
|
# latest Version History row is Accepted and whose latest review record is a Go
|
|
# is created or updated as a Milestone with its tasks as Issues. A Proposed
|
|
# milestone, or one without a Go review, is skipped. Nothing is closed or
|
|
# deleted. Each run updates the issues of every accepted milestone (the sync is
|
|
# idempotent, but the host records the edit).
|
|
#
|
|
# INSTALLING THIS FILE IS THE STANDING AUTHORIZATION TO PUBLISH. A project opts
|
|
# in by copying it; an agent does not install it on its own.
|
|
#
|
|
# Copy it to .gitea/workflows/sync-milestones.yml (Gitea Actions) or
|
|
# .github/workflows/sync-milestones.yml (GitHub Actions). Then:
|
|
# 1. Create a CI secret and put its name in the two `secrets.` lines below
|
|
# (TOKEN_FOR_GITEA_ISSUES is the name the
|
|
# framework uses). Gitea does not accept secret names that
|
|
# start with GITEA_ or GITHUB_.
|
|
# 2. Give the token the smallest scope that works: read and write on issues
|
|
# and milestones. If the framework submodule is a private repository, the
|
|
# token must also be able to read it (it is used to check it out).
|
|
# 3. Run it once by hand from the Actions page with dry_run left on: it prints
|
|
# the plan and creates nothing. Turn dry_run off only for a real run.
|
|
# A runner must be registered for the repository (or its organisation).
|
|
#
|
|
# The steps are one command each: the logic is framework/scripts/ci-publish-milestones.sh,
|
|
# a file that is linted and tested (QC-WF-001 criterion 20).
|
|
|
|
name: Publish accepted milestones
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "docs/milestones/**"
|
|
- "docs/sqa/reviews/**"
|
|
workflow_dispatch:
|
|
inputs:
|
|
dry_run:
|
|
description: "Preview only: print the plan and create nothing"
|
|
type: boolean
|
|
default: true
|
|
|
|
# Two merges in a row queue instead of racing.
|
|
concurrency:
|
|
group: publish-accepted-milestones
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
permissions:
|
|
contents: read
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Check out the project
|
|
uses: actions/checkout@v4.2.2
|
|
with:
|
|
token: ${{ secrets.TOKEN_FOR_GITEA_ISSUES }}
|
|
|
|
# The framework submodule is registered with an SSH address, which the runner
|
|
# cannot use. The address is rewritten to HTTPS for this step only, and the token
|
|
# goes in through the environment, never on a command line. .gitmodules stays.
|
|
- name: Fetch the framework submodule over HTTPS
|
|
env:
|
|
GIT_CONFIG_COUNT: "2"
|
|
GIT_CONFIG_KEY_0: url.https://git.tirsystem.com/.insteadOf
|
|
GIT_CONFIG_VALUE_0: ssh://git@git.tirsystem.com:10022/
|
|
GIT_CONFIG_KEY_1: http.https://git.tirsystem.com/.extraheader
|
|
GIT_CONFIG_VALUE_1: "Authorization: token ${{ secrets.TOKEN_FOR_GITEA_ISSUES }}"
|
|
run: git submodule update --init --recursive
|
|
|
|
- name: Make sure curl and jq are available
|
|
run: bash framework/scripts/ci-publish-milestones.sh ensure-tools
|
|
|
|
- name: Publish accepted milestones
|
|
env:
|
|
# Gitea reads TOKEN_FOR_GITEA_ISSUES, GitHub's gh reads GH_TOKEN; both
|
|
# come from the one secret named above.
|
|
TOKEN_FOR_GITEA_ISSUES: ${{ secrets.TOKEN_FOR_GITEA_ISSUES }}
|
|
GH_TOKEN: ${{ secrets.TOKEN_FOR_GITEA_ISSUES }}
|
|
# Empty on a push (a real run); "true" or "false" on a manual run.
|
|
DRY_RUN: ${{ inputs.dry_run }}
|
|
run: bash framework/scripts/ci-publish-milestones.sh publish
|