mirror of
https://github.com/twentyhq/twenty.git
synced 2026-09-17 00:22:48 -04:00
Félix Malfait
655277cc63
`twentyhq/ci-privileged` is being renamed to `twentyhq/twenty-factory`. Two things here resolve the repo by name and do not follow GitHub's rename redirect: - `actions/create-github-app-token` validates the `repositories:` input against the App installation, so the token mint returns 422 under the stale name - `gh workflow run --repo` POSTs to the repo API, where relying on a 301 redirect is not safe 8 mint steps and 8 dispatch targets across 7 workflows, plus comments in an 8th. **Merge after the rename, not before.** Until `twentyhq/twenty-factory` exists this branch mints against a repo that is not there. In the window between the rename and this merge, PR comments, AI review, preview envs, website previews, prod-parity e2e and visual regression dispatches all fail at the mint step, so this wants to go in immediately after the rename. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/24196?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
90 lines
3.5 KiB
YAML
90 lines
3.5 KiB
YAML
name: 'Website Preview Dispatch'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, closed, labeled]
|
|
paths:
|
|
- packages/twenty-website/**
|
|
- .github/workflows/website-preview-dispatch.yaml
|
|
|
|
concurrency:
|
|
# Keyed on PR number so independent PRs don't cancel each other. `github.ref`
|
|
# would resolve to the base branch under pull_request and collide.
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
trigger-build:
|
|
# Same fork PRs from outside the org don't have `secrets.*` so the dispatch
|
|
# call would fail anyway — skip explicitly to avoid noise.
|
|
if: |
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
github.event.action != 'closed' && (
|
|
(github.event.action == 'labeled' && github.event.label.name == 'preview-website') ||
|
|
(
|
|
(
|
|
github.event.pull_request.author_association == 'MEMBER' ||
|
|
github.event.pull_request.author_association == 'OWNER' ||
|
|
github.event.pull_request.author_association == 'COLLABORATOR'
|
|
) && contains(fromJSON('["opened","synchronize","reopened"]'), github.event.action)
|
|
)
|
|
)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Mint twenty-factory dispatch token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: twenty-factory
|
|
permission-actions: write
|
|
|
|
- name: Dispatch website-preview-build to twenty-factory
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
|
|
run: |
|
|
gh workflow run website-preview.yaml --repo twentyhq/twenty-factory --ref main \
|
|
-f action=build \
|
|
-f pr_number="$PR_NUMBER" \
|
|
-f pr_head_sha="$PR_HEAD_SHA" \
|
|
-f pr_head_ref="$PR_HEAD_REF"
|
|
|
|
trigger-cleanup:
|
|
# Covers both merge and close-without-merge — pull_request `closed` fires
|
|
# for both. PRs left open forever are covered by OpenNext's
|
|
# `maxVersionAgeDays: 14` + `maxNumberOfVersions: 50` auto-pruning in
|
|
# open-next.config.ts, so nothing leaks even if cleanup never runs.
|
|
if: |
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
github.event.action == 'closed'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Mint twenty-factory dispatch token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: twenty-factory
|
|
permission-actions: write
|
|
|
|
- name: Dispatch website-preview-cleanup to twenty-factory
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
run: |
|
|
gh workflow run website-preview.yaml --repo twentyhq/twenty-factory --ref main \
|
|
-f action=cleanup \
|
|
-f pr_number="$PR_NUMBER"
|