Samuel Newman
41 lines
1.5 KiB
YAML
41 lines
1.5 KiB
YAML
name: Sync to internal repo
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
# The push to the internal repo uses the app token below, not the GITHUB_TOKEN
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
sync:
|
|
runs-on: ubuntu-latest
|
|
if: github.repository == 'bluesky-social/social-app'
|
|
steps:
|
|
- name: Checkout public repo
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
fetch-depth: 0
|
|
# Don't persist the checkout auth header; the push below authenticates
|
|
# with the app token embedded in the remote URL instead
|
|
persist-credentials: false
|
|
- name: Generate GitHub App Token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
|
|
private-key: ${{ secrets.SYNC_INTERNAL_PK }}
|
|
repositories: social-app-internal
|
|
# Scope the token down from the app's full installation permissions;
|
|
# pushing is the only thing this token is used for
|
|
permission-contents: write
|
|
- name: Push to internal repo
|
|
env:
|
|
TOKEN: ${{ steps.app-token.outputs.token }}
|
|
run: |
|
|
git config user.name "github-actions"
|
|
git config user.email "test@users.noreply.github.com"
|
|
git remote add internal https://x-access-token:${TOKEN}@github.com/bluesky-social/social-app-internal.git
|
|
git push internal main --force
|