| 1 | name: Import campaign |
| 2 | |
| 3 | # Imports a varied set of public GitHub repositories into Diffinery as private test |
| 4 | # repositories (<owner>/campaign-*), optionally runs their push workflows there, and reports what |
| 5 | # came across and what ran (scripts/import-campaign.sh). Started by hand. |
| 6 | # |
| 7 | # Dispatched on GitHub, it starts the same workflow on Diffinery and prints its report; |
| 8 | # on Diffinery it does the work. Imports use the IMPORT_GITHUB_TOKEN secret when it is |
| 9 | # set (a read-only token for public repositories), otherwise GitHub's anonymous rate |
| 10 | # limit applies and large repositories take hours. Set on GitHub, it is copied to |
| 11 | # Diffinery's repository secrets before the run starts (the main sync doesn't copy it). |
| 12 | on: |
| 13 | workflow_dispatch: |
| 14 | inputs: |
| 15 | repos: |
| 16 | description: GitHub repositories to import, separated by spaces |
| 17 | type: string |
| 18 | default: >- |
| 19 | octocat/git-consortium sindresorhus/slugify expressjs/cors spf13/pflag |
| 20 | pallets/markupsafe BurntSushi/walkdir actions/hello-world-javascript-action |
| 21 | actions/hello-world-docker-action jekyll/minima |
| 22 | minutes: |
| 23 | description: How long to wait for imports and workflow runs, in minutes |
| 24 | type: string |
| 25 | default: "300" |
| 26 | run_workflows: |
| 27 | description: Also run the imported repositories' push workflows (third-party code) |
| 28 | type: boolean |
| 29 | default: false |
| 30 | |
| 31 | permissions: |
| 32 | contents: read |
| 33 | |
| 34 | concurrency: |
| 35 | group: import-campaign |
| 36 | cancel-in-progress: false |
| 37 | |
| 38 | jobs: |
| 39 | relay: |
| 40 | name: Start the campaign on Diffinery and print its report |
| 41 | if: ${{ github.server_url == 'https://github.com' }} |
| 42 | runs-on: ubuntu-latest |
| 43 | timeout-minutes: 360 |
| 44 | environment: production |
| 45 | env: |
| 46 | DIFFINERY: https://diffinery.com |
| 47 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 48 | R: codician-team/diffinery |
| 49 | steps: |
| 50 | - name: Copy IMPORT_GITHUB_TOKEN to Diffinery |
| 51 | env: |
| 52 | IMPORT_GITHUB_TOKEN: ${{ secrets.IMPORT_GITHUB_TOKEN }} |
| 53 | run: | |
| 54 | set -euo pipefail |
| 55 | if [ -n "$IMPORT_GITHUB_TOKEN" ]; then |
| 56 | jq -n --arg v "$IMPORT_GITHUB_TOKEN" '{value: $v}' | curl -fsS -o /dev/null -X PUT "$DIFFINERY/api/v3/repos/$R/actions/secrets/IMPORT_GITHUB_TOKEN" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data-binary @- |
| 57 | echo "IMPORT_GITHUB_TOKEN is set on GitHub and was copied to Diffinery" |
| 58 | else |
| 59 | echo "IMPORT_GITHUB_TOKEN is not set on GitHub; Diffinery's own copy is used if it has one" |
| 60 | fi |
| 61 | - name: Dispatch and follow |
| 62 | env: |
| 63 | REPOS: ${{ inputs.repos }} |
| 64 | MINUTES: ${{ inputs.minutes }} |
| 65 | RUN_WORKFLOWS: ${{ inputs.run_workflows }} |
| 66 | run: | |
| 67 | set -euo pipefail |
| 68 | api() { curl -fsS --retry 3 -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } |
| 69 | before=$(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=1" | jq -r '.workflow_runs[0].id // 0') |
| 70 | api POST "/repos/$R/actions/workflows/import-campaign.yml/dispatches" "$(jq -nc --arg r "$REPOS" --arg m "$MINUTES" --arg w "$RUN_WORKFLOWS" '{ref: "main", inputs: {repos: $r, minutes: $m, run_workflows: $w}}')" >/dev/null |
| 71 | for i in $(seq 1 60); do |
| 72 | run=$(api GET "/repos/$R/actions/workflows/import-campaign.yml/runs?per_page=1" | jq -c '.workflow_runs[0] // empty') |
| 73 | [ -n "$run" ] && [ "$(jq -r .id <<<"$run")" != "$before" ] && break |
| 74 | sleep 5 |
| 75 | done |
| 76 | id=$(jq -r .id <<<"$run") |
| 77 | echo "Diffinery run: $(jq -r .html_url <<<"$run")" |
| 78 | while [ "$(api GET "/repos/$R/actions/runs/$id" | jq -r .status)" != completed ]; do sleep 30; done |
| 79 | run=$(api GET "/repos/$R/actions/runs/$id") |
| 80 | for job in $(api GET "/repos/$R/actions/runs/$id/jobs" | jq -r '.jobs[].id'); do |
| 81 | curl -fsS "$DIFFINERY/api/v3/repos/$R/actions/jobs/$job/logs" -H "Authorization: Bearer $TOKEN" | sed -n '/^# Import campaign/,$p' | tee -a "$GITHUB_STEP_SUMMARY" |
| 82 | done |
| 83 | [ "$(jq -r .conclusion <<<"$run")" = success ] || { echo "::error::the campaign run on Diffinery ended $(jq -r .conclusion <<<"$run")"; exit 1; } |
| 84 | |
| 85 | campaign: |
| 86 | name: Import, run and report |
| 87 | if: ${{ github.server_url != 'https://github.com' }} |
| 88 | runs-on: ubuntu-latest |
| 89 | timeout-minutes: 360 |
| 90 | env: |
| 91 | DIFFINERY: ${{ github.server_url }} |
| 92 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 93 | GITHUB_TOKEN_FOR_IMPORT: ${{ secrets.IMPORT_GITHUB_TOKEN }} |
| 94 | steps: |
| 95 | - uses: actions/checkout@v4 |
| 96 | - name: Import and run |
| 97 | env: |
| 98 | REPOS: ${{ inputs.repos }} |
| 99 | MINUTES: ${{ inputs.minutes }} |
| 100 | RUN_WORKFLOWS: ${{ inputs.run_workflows }} |
| 101 | run: | |
| 102 | if [ -n "$GITHUB_TOKEN_FOR_IMPORT" ]; then |
| 103 | echo "::notice::Mode: imports use the IMPORT_GITHUB_TOKEN secret" |
| 104 | else |
| 105 | echo "::warning::Mode: token-free. IMPORT_GITHUB_TOKEN is not set, so imports use GitHub's anonymous rate limit" |
| 106 | fi |
| 107 | # shellcheck disable=SC2086 |
| 108 | REPORT=report.md scripts/import-campaign.sh $REPOS |
| 109 | cat report.md >> "$GITHUB_STEP_SUMMARY" |
| 110 | - uses: actions/upload-artifact@v4 |
| 111 | if: always() |
| 112 | with: |
| 113 | name: import-campaign-report |
| 114 | path: report.md |