dependabot[bot]
aa06d68ca6
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
44 lines
1.7 KiB
YAML
44 lines
1.7 KiB
YAML
name: Sync to internal repo
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
# The push to the internal repo uses the app token below, not the GITHUB_TOKEN
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
sync:
|
|
runs-on: ubuntu-latest
|
|
if: github.repository == 'bluesky-social/social-app'
|
|
steps:
|
|
- name: ⬇️ Checkout public repo
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
# Don't persist the checkout auth header; the push below authenticates
|
|
# with the app token embedded in the remote URL instead
|
|
persist-credentials: false
|
|
- name: 🔑 Generate GitHub App Token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
|
|
private-key: ${{ secrets.SYNC_INTERNAL_PK }}
|
|
repositories: social-app-internal
|
|
# Scope the token down from the app's full installation permissions;
|
|
# pushing is the only thing this token is used for. The workflows
|
|
# permission is required because the sync includes files under
|
|
# .github/workflows/, which GitHub refuses to push without it.
|
|
permission-contents: write
|
|
permission-workflows: write
|
|
- name: 🚀 Push to internal repo
|
|
env:
|
|
TOKEN: ${{ steps.app-token.outputs.token }}
|
|
run: |
|
|
git config user.name "github-actions"
|
|
git config user.email "test@users.noreply.github.com"
|
|
git remote add internal https://x-access-token:${TOKEN}@github.com/bluesky-social/social-app-internal.git
|
|
git push internal main --force
|