TypeScript/.github/workflows/sync-branch.yaml at main · joac/TypeScript · GitHub

Repository navigation

View runs

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

name: Sync release branch with main

on:

workflow_dispatch:

inputs:

branch_name:

description: Release branch to update

required: true

type: string

# Inputs provided by the bot

distinct_id:

description: '(bot) A distinct ID'

required: false

default: ''

source_issue:

description: '(bot) The issue that triggered this workflow'

required: false

default: ''

requesting_user:

description: '(bot) The user who requested this workflow'

required: false

default: ''

status_comment:

description: '(bot) The comment to update with the status of this workflow'

required: false

default: ''

run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0})', inputs.distinct_id) || '' }}

permissions:

contents: read

id-token: write

defaults:

run:

shell: bash

jobs:

sync:

if: github.repository == 'microsoft/TypeScript'

runs-on: ubuntu-latest

environment:

name: azure

deployment: false

steps:

- name: Validate release branch name

env:

BRANCH_NAME: ${{ inputs.branch_name }}

run: |

set -euo pipefail

if ! [[ "$BRANCH_NAME" =~ ^(release-.+|ts[0-9]+-release)$ ]]; then

echo "Release branch name must start with 'release-' or match 'ts<number>-release'." >&2

exit 1

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

ref: ${{ inputs.branch_name }}

filter: blob:none

fetch-depth: 0

persist-credentials: false

- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

with:

node-version: 24

- uses: ./.github/actions/setup-go

- name: Merge main

env:

BRANCH_NAME: ${{ inputs.branch_name }}

run: |

set -euo pipefail

releaseVersion="$(node -e '

const source = require("node:fs").readFileSync("tsc/internal/core/version.go", "utf8");

const match = source.match(/var version = "([^"]+)"/);

if (!match) throw new Error("Unable to read the release version");

process.stdout.write(match[1]);

')"

git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com"

git config user.name "typescript-automation[bot]"

git config core.hooksPath /dev/null

git fetch origin main

git show origin/main:tools/scripts/configure-release.mjs > "$RUNNER_TEMP/configure-release.mjs"

if ! git merge origin/main --no-ff --no-commit; then

mapfile -t conflictedFiles < <(git diff --name-only --diff-filter=U)

allowedConflicts=("Herebyfile.mjs" "tsc/internal/core/version.go")

for conflictedFile in "${conflictedFiles[@]}"; do

if [[ ! " ${allowedConflicts[*]} " =~ " $conflictedFile " ]]; then

echo "Merge conflict requires manual resolution: $conflictedFile" >&2

exit 1

done

if [ "${#conflictedFiles[@]}" -eq 0 ]; then

echo "Merge failed without reporting conflicted files." >&2

exit 1

git checkout --theirs -- "${conflictedFiles[@]}"

node "$RUNNER_TEMP/configure-release.mjs" "$releaseVersion"

git add Herebyfile.mjs tsc/internal/core/version.go

if git rev-parse --verify --quiet MERGE_HEAD >/dev/null; then

git commit --no-edit

elif ! git diff --cached --quiet; then

git commit -m "Restore release configuration after syncing main"

- run: npm ci

- run: npx hereby validate --all

- name: Verify clean merge

run: |

set -euo pipefail

git diff --check

if ! git diff --quiet || ! git diff --cached --quiet; then

echo "Validation modified the worktree; refusing to push the merge." >&2

git status --short

exit 1

- uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0

with:

client-id: ${{ vars.AZURE_CLIENT_ID }}

tenant-id: ${{ vars.AZURE_TENANT_ID }}

subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

- name: Create GitHub App token

id: app-token

uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1

with:

client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}

key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}

owner: microsoft

repositories: TypeScript

permission-contents: write

- name: Configure git for GitHub App token

env:

GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}

run: |

set -euo pipefail

basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')"

echo "::add-mask::$basic_auth"

git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"

- env:

BRANCH_NAME: ${{ inputs.branch_name }}

run: git push origin "HEAD:$BRANCH_NAME"

- uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@08bcbbf253fd6bc533dd8b9ab47a58582be57fbe # master

if: ${{ !cancelled() && inputs.distinct_id }}

with:

success_comment: "I've pulled main into ${{ inputs.branch_name }} for you."

failure_comment: 'I was unable to merge main into ${{ inputs.branch_name }}.'

github_token: ${{ steps.app-token.outputs.token }}

distinct_id: ${{ inputs.distinct_id }}

source_issue: ${{ inputs.source_issue }}

requesting_user: ${{ inputs.requesting_user }}

status_comment: ${{ inputs.status_comment }}

TypeScript/.github/workflows/sync-branch.yaml at main · joac/TypeScript · GitHub

Repository navigation

Expand file tree

Breadcrumbs

sync-branch.yaml

Latest commit

History

Breadcrumbs

sync-branch.yaml

File metadata and controls