| | @@ -5,10 +5,8 @@ |
| 5 | 5 | # came across and what ran (scripts/import-campaign.sh). Started by hand. |
| 6 | 6 | # |
| 7 | 7 | # Dispatched on GitHub, it starts the same workflow on Diffinery and prints its report; |
| 8 | | -# on Diffinery it does the work. Imports use the IMPORT_GITHUB_TOKEN secret when it is |
| 9 | | -# set (a read-only token for public repositories), otherwise GitHub's anonymous rate |
| 10 | | -# limit applies and large repositories take hours. Set on GitHub, it is copied to |
| 11 | | -# Diffinery's repository secrets before the run starts (the main sync doesn't copy it). |
| 8 | +# on Diffinery it does the work. Imports run token-free (Diffinery keeps no GitHub |
| 9 | +# credentials), so GitHub's anonymous rate limit applies and large repositories take hours. |
| 12 | 10 | on: |
| 13 | 11 | workflow_dispatch: |
| 14 | 12 | inputs: |
| | @@ -68,18 +66,6 @@ |
| 68 | 66 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 69 | 67 | R: codician/diffinery |
| 70 | 68 | steps: |
| 71 | | - - name: Copy IMPORT_GITHUB_TOKEN to Diffinery |
| 72 | | - if: ${{ inputs.follow_run == '' && !inputs.peek && inputs.rerun_failed == '' && inputs.inspect_run == '' && inputs.push_test == '' }} |
| 73 | | - env: |
| 74 | | - IMPORT_GITHUB_TOKEN: ${{ secrets.IMPORT_GITHUB_TOKEN }} |
| 75 | | - run: | |
| 76 | | - set -euo pipefail |
| 77 | | - if [ -n "$IMPORT_GITHUB_TOKEN" ]; then |
| 78 | | - jq -n --arg v "$IMPORT_GITHUB_TOKEN" '{value: $v}' | curl -fsS --retry 4 --retry-delay 30 -o /dev/null -X PUT "$DIFFINERY/api/v3/repos/$R/actions/secrets/IMPORT_GITHUB_TOKEN" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data-binary @- |
| 79 | | - echo "IMPORT_GITHUB_TOKEN is set on GitHub and was copied to Diffinery" |
| 80 | | - else |
| 81 | | - echo "IMPORT_GITHUB_TOKEN is not set on GitHub; Diffinery's own copy is used if it has one" |
| 82 | | - fi |
| 83 | 69 | - name: Dispatch and follow |
| 84 | 70 | env: |
| 85 | 71 | REPOS: ${{ inputs.repos }} |
| | @@ -229,12 +215,11 @@ |
| 229 | 215 | if: ${{ github.server_url != 'https://github.com' }} |
| 230 | 216 | runs-on: ubuntu-latest |
| 231 | 217 | timeout-minutes: 360 |
| 232 | | - # DIFFINERY_LIVE_TOKEN and IMPORT_GITHUB_TOKEN are the production environment's. |
| 218 | + # DIFFINERY_LIVE_TOKEN is the production environment's. |
| 233 | 219 | environment: production |
| 234 | 220 | env: |
| 235 | 221 | DIFFINERY: ${{ github.server_url }} |
| 236 | 222 | TOKEN: ${{ secrets.DIFFINERY_LIVE_TOKEN }} |
| 237 | | - GITHUB_TOKEN_FOR_IMPORT: ${{ secrets.IMPORT_GITHUB_TOKEN }} |
| 238 | 223 | steps: |
| 239 | 224 | - uses: actions/checkout@v4 |
| 240 | 225 | - name: Import and run |
| | @@ -243,11 +228,7 @@ |
| 243 | 228 | MINUTES: ${{ inputs.minutes }} |
| 244 | 229 | RUN_WORKFLOWS: ${{ inputs.run_workflows }} |
| 245 | 230 | run: | |
| 246 | | - if [ -n "$GITHUB_TOKEN_FOR_IMPORT" ]; then |
| 247 | | - echo "::notice::Mode: imports use the IMPORT_GITHUB_TOKEN secret" |
| 248 | | - else |
| 249 | | - echo "::warning::Mode: token-free. IMPORT_GITHUB_TOKEN is not set, so imports use GitHub's anonymous rate limit" |
| 250 | | - fi |
| 231 | + echo "::notice::Mode: token-free, so imports use GitHub's anonymous rate limit" |
| 251 | 232 | # shellcheck disable=SC2086 |
| 252 | 233 | REPORT=report.md scripts/import-campaign.sh $REPOS |
| 253 | 234 | cat report.md >> "$GITHUB_STEP_SUMMARY" |