mirror of
https://github.com/twentyhq/twenty.git
synced 2026-08-02 18:54:43 -04:00
d5c7b735d2
# Introduction Getting rid of the fine grained PAT used to dispatch to internal repositories. Repo dispatch requires the contents write permissions which is too wide for such use Refactored all senders and target to pass through a workflow dispatch instead Creating a centralize app that forges a token with actions: write only provided permissions to mitigate any token exfiltrations
90 lines
3.5 KiB
YAML
90 lines
3.5 KiB
YAML
name: 'Website Preview Dispatch'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, closed, labeled]
|
|
paths:
|
|
- packages/twenty-website/**
|
|
- .github/workflows/website-preview-dispatch.yaml
|
|
|
|
concurrency:
|
|
# Keyed on PR number so independent PRs don't cancel each other. `github.ref`
|
|
# would resolve to the base branch under pull_request and collide.
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
trigger-build:
|
|
# Same fork PRs from outside the org don't have `secrets.*` so the dispatch
|
|
# call would fail anyway — skip explicitly to avoid noise.
|
|
if: |
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
github.event.action != 'closed' && (
|
|
(github.event.action == 'labeled' && github.event.label.name == 'preview-website') ||
|
|
(
|
|
(
|
|
github.event.pull_request.author_association == 'MEMBER' ||
|
|
github.event.pull_request.author_association == 'OWNER' ||
|
|
github.event.pull_request.author_association == 'COLLABORATOR'
|
|
) && contains(fromJSON('["opened","synchronize","reopened"]'), github.event.action)
|
|
)
|
|
)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Mint ci-privileged dispatch token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: ci-privileged
|
|
permission-actions: write
|
|
|
|
- name: Dispatch website-preview-build to ci-privileged
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
|
|
run: |
|
|
gh workflow run website-preview.yaml --repo twentyhq/ci-privileged --ref main \
|
|
-f action=build \
|
|
-f pr_number="$PR_NUMBER" \
|
|
-f pr_head_sha="$PR_HEAD_SHA" \
|
|
-f pr_head_ref="$PR_HEAD_REF"
|
|
|
|
trigger-cleanup:
|
|
# Covers both merge and close-without-merge — pull_request `closed` fires
|
|
# for both. PRs left open forever are covered by OpenNext's
|
|
# `maxVersionAgeDays: 14` + `maxNumberOfVersions: 50` auto-pruning in
|
|
# open-next.config.ts, so nothing leaks even if cleanup never runs.
|
|
if: |
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
github.event.action == 'closed'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Mint ci-privileged dispatch token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: ci-privileged
|
|
permission-actions: write
|
|
|
|
- name: Dispatch website-preview-cleanup to ci-privileged
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
run: |
|
|
gh workflow run website-preview.yaml --repo twentyhq/ci-privileged --ref main \
|
|
-f action=cleanup \
|
|
-f pr_number="$PR_NUMBER"
|