mirror of
https://github.com/twentyhq/twenty.git
synced 2026-09-17 08:31:28 -04:00
Félix Malfait
655277cc63
`twentyhq/ci-privileged` is being renamed to `twentyhq/twenty-factory`. Two things here resolve the repo by name and do not follow GitHub's rename redirect: - `actions/create-github-app-token` validates the `repositories:` input against the App installation, so the token mint returns 422 under the stale name - `gh workflow run --repo` POSTs to the repo API, where relying on a 301 redirect is not safe 8 mint steps and 8 dispatch targets across 7 workflows, plus comments in an 8th. **Merge after the rename, not before.** Until `twentyhq/twenty-factory` exists this branch mints against a repo that is not there. In the window between the rename and this merge, PR comments, AI review, preview envs, website previews, prod-parity e2e and visual regression dispatches all fail at the mint step, so this wants to go in immediately after the rename. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/24196?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
92 lines
3.3 KiB
YAML
92 lines
3.3 KiB
YAML
name: 'Preview Environment Dispatch'
|
|
|
|
permissions: {}
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened, labeled]
|
|
paths:
|
|
- packages/twenty-docker/**
|
|
- packages/twenty-server/**
|
|
- packages/twenty-front/**
|
|
- packages/twenty-apps/examples/**
|
|
- packages/twenty-apps/internal/**
|
|
- packages/twenty-apps/public/**
|
|
- .github/workflows/preview-env-dispatch.yaml
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
trigger-preview:
|
|
if: |
|
|
(github.event.action == 'labeled' && github.event.label.name == 'preview-app') ||
|
|
(
|
|
(
|
|
github.event.pull_request.author_association == 'MEMBER' ||
|
|
github.event.pull_request.author_association == 'OWNER' ||
|
|
github.event.pull_request.author_association == 'COLLABORATOR'
|
|
) && (
|
|
github.event.action == 'opened' ||
|
|
github.event.action == 'synchronize' ||
|
|
github.event.action == 'reopened'
|
|
)
|
|
)
|
|
timeout-minutes: 5
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
steps:
|
|
# Files API, not a checkout: under pull_request_target nothing from the
|
|
# PR head may be checked out here.
|
|
- name: List changed apps
|
|
id: apps
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
run: |
|
|
set -euo pipefail
|
|
changed_files=$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename')
|
|
app_paths=$(printf '%s\n' "$changed_files" \
|
|
| grep -oE '^packages/twenty-apps/(examples|internal|public)/[a-z0-9][a-z0-9-]*' \
|
|
| sort -u || true)
|
|
|
|
echo "Changed apps:"
|
|
printf '%s\n' "${app_paths:-<none>}"
|
|
{
|
|
echo 'app_paths<<APPS_EOF'
|
|
printf '%s\n' "$app_paths"
|
|
echo 'APPS_EOF'
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
# Preview envs run on the PUBLIC ci-public repo so the 5h keepalive job
|
|
# consumes free Actions minutes (private repos bill them). ci-public holds
|
|
# no privileged secret: it starts the tunnel and dispatches the URL back to
|
|
# twenty-factory for the PR comment *before* running any PR-controlled code.
|
|
- name: Mint ci-public dispatch token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: ci-public
|
|
permission-actions: write
|
|
|
|
- name: Dispatch preview-env to ci-public
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
APP_PATHS: ${{ steps.apps.outputs.app_paths }}
|
|
run: |
|
|
gh workflow run preview-env.yaml --repo twentyhq/ci-public --ref main \
|
|
-f pr_number="$PR_NUMBER" \
|
|
-f pr_head_sha="$PR_HEAD_SHA" \
|
|
-f repo="$REPOSITORY" \
|
|
-f app_paths="$APP_PATHS"
|