55 workflow_dispatch :
66 schedule :
77 - cron : ' 20 16 * * 3' # Run every Wednesday at 16:20 UTC / 8:20 PST
8+ pull_request :
9+ paths :
10+ - .github/workflows/alert-changed-branch-protections.yml
11+ - .github/branch_protection_settings/*.json
812
913permissions :
10- contents : read
14+ contents : write
1115
1216jobs :
1317 check-branch-protections :
@@ -29,30 +33,53 @@ jobs:
2933 GH_TOKEN : ${{ secrets.DOCS_BOT_PAT_WORKFLOW }}
3034 run : |
3135 # Fetch branch protections and store them in a file
32- gh api /repos/GitHub/docs-internal/branches/${{ matrix.branch }}/protection > ${{ matrix.branch }}-actual.json
36+ gh api /repos/GitHub/docs-internal/branches/${{ matrix.branch }}/protection \
37+ > .github/branch_protection_settings/${{ matrix.branch }}.json
3338
3439 - name : Format fetched settings with prettier for comparison
3540 id : format
3641 run : |
37- npx prettier --write ${{ matrix.branch }}-actual .json
42+ npx prettier --write .github/branch_protection_settings/ ${{ matrix.branch }}.json
3843
3944 - name : Compare branch protections
4045 id : compare
4146 run : |
42- # Compare the fetched branch protections with the committed ones
43- git diff --no-index .github/branch_protection_settings/${{ matrix.branch }}.json ${{ matrix.branch }}-actual.json || echo "diff_failed=true" >> $GITHUB_ENV
47+ git diff --quiet .github/branch_protection_settings/${{ matrix. branch }}.json \
48+ || echo "diff_failed=true" >> $GITHUB_ENV
4449
45- - name : Set failure message
46- if : env.diff_failed == 'true'
50+ - name : Create a pull request to update branch protection settings
51+ if : ${{ env.diff_failed == 'true' }}
52+ env :
53+ GITHUB_TOKEN : ${{ secrets.DOCS_BOT_PAT_READPUBLICKEY }}
4754 run : |
48- message="Alert due to changes in branch protections for ${{ matrix.branch }}. Please review the changes and ensure they are intentional. If valid, update the branch protection settings in .github/branch_protection_settings/${{ matrix.branch }}.json to match the diff in this workflow."
49- echo "failure_message=$message" >> $GITHUB_ENV
50- echo "$message"
55+ echo "Set git config"
56+ git config --global user.name "docs-bot"
57+ git config --global user.email "[email protected] " 58+
59+ echo "Check out a new branch"
60+ xbranch=update-branch-protection-settings-$(date +%s)
61+ git checkout -b $xbranch
62+
63+ echo "Commit changes"
64+ git commit -am "Update branch protection settings"
65+
66+ echo "Push changes"
67+ git push origin $xbranch
68+
69+ echo "Create pull request"
70+ gh pr create \
71+ --title "Update branch protection settings" \
72+ --body "Branch protections have changed." \
73+ --head $xbranch \
74+ --base main
75+
76+ echo "Define pr_url"
77+ echo "pr_url=$(gh pr view --json url --jq .url)" >> $GITHUB_ENV
5178
5279 - uses : ./.github/actions/slack-alert
53- if : ${{ env.diff_failed == 'true' && github.event_name != 'workflow_dispatch' }}
80+ if : ${{ env.diff_failed == 'true' }}
5481 with :
5582 slack_channel_id : ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
5683 slack_token : ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
57- message : ${{ env.failure_message }}
84+ message : " Branch protections have changed. I've created a pull request to update them. Please review and merge, or revert the change in the GitHub UI. ${{ env.pr_url }}"
5885 color : purple
0 commit comments