Repository navigation
chore(ci): update dependency buildx to v0.38.2 #929
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Homebrew tap sync trigger | |
| # When a packaging-bump PR merges (the Homebrew formula source on `main` has just | |
| # changed), trigger the tap's formula sync IMMEDIATELY instead of waiting for its daily | |
| # ~06:17 UTC cron (#481). Best-effort: a dispatch failure just leaves the cron as the | |
| # safety net, so this never blocks or fails the release path. | |
| # | |
| # WHY this trigger point (not `release: published`): at publish time the bumped formula | |
| # is NOT yet on `main` — knope's packaging-bump opens a PR; it doesn't push main. So we | |
| # fire on the packaging-bump PR MERGE, detected by the head-branch prefix (the same | |
| # signal knope-release.yml keys on), never on publish. | |
| # | |
| # SECURITY / DESIGN: | |
| # * Same-repo, merged `packaging-bump/*` PR only. The same-repo gate means a fork can't | |
| # reach this even by naming its head `packaging-bump/*`; `pull_request` (not _target). | |
| # * Mints a TAP-SCOPED clauster-ci App token — owner schubydoo, repositories | |
| # homebrew-clauster, `actions:write` ONLY (never contents:write) — the minimal | |
| # cross-repo surface, and exactly what `workflow run` (workflow_dispatch) needs. | |
| # Empty-token guard fails loud (the App must be installed on the tap with Actions: | |
| # write). Workflow-level permissions stay read-only. | |
| # * Triggers the tap's EXISTING `workflow_dispatch` on sync-formula.yml. The tap job | |
| # no-ops when the formula is unchanged, so an early/duplicate fire is harmless, and | |
| # the daily cron remains the fallback if this ever fails. | |
| on: | |
| pull_request: | |
| types: [closed] | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| trigger-tap-sync: | |
| name: dispatch the tap formula sync | |
| timeout-minutes: 5 # token mint + one `gh workflow run` — surface a hung runner fast | |
| if: >- | |
| github.event.pull_request.merged == true | |
| && github.event.pull_request.head.repo.full_name == github.repository | |
| && startsWith(github.head_ref, 'packaging-bump/') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Mint a tap-scoped clauster-ci App token | |
| id: app-token | |
| uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 | |
| with: | |
| client-id: ${{ secrets.CLAUSTER_CI_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.CLAUSTER_CI_APP_PRIVATE_KEY }} | |
| owner: schubydoo | |
| repositories: homebrew-clauster | |
| permission-actions: write # only what `gh workflow run` (workflow_dispatch) needs | |
| # Fail loud on an empty mint — the App must be installed on schubydoo/homebrew-clauster | |
| # with Actions: write. Without this, the dispatch below would silently no-op. | |
| - name: Verify the tap token was minted | |
| if: ${{ steps.app-token.outputs.token == '' }} | |
| run: | | |
| echo "::error::clauster-ci App token for the tap was empty; refusing to dispatch. \ | |
| Confirm the clauster-ci App is installed on schubydoo/homebrew-clauster with \ | |
| Actions: write." | |
| exit 1 | |
| # Best-effort: the daily cron in the tap's sync-formula.yml stays the fallback, so a | |
| # dispatch failure must NOT fail this job (and never the release path). | |
| - name: Trigger the tap formula sync | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| gh workflow run sync-formula.yml --repo schubydoo/homebrew-clauster --ref main \ | |
| || echo "::warning::tap sync dispatch failed; the daily cron will still sync the formula." |