houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: migrate cross-repo dispatch senders to workflow_dispatch (actions:write) (#21648)

Browse Source 
# Introduction
Getting rid of the fine grained PAT used to dispatch to internal
repositories.
Repo dispatch requires the contents write permissions which is too wide
for such use
Refactored all senders and target to pass through a workflow dispatch
instead
Creating a centralize app that forges a token with actions: write only
provided permissions to mitigate any token exfiltrations
This commit is contained in:
Paul Rastoin
2026-06-16 15:18:43 +02:00
committed by GitHub
parent 1e8169ca3e
commit d5c7b735d2
15 changed files with 268 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/cd-deploy-main.yaml
+13 -4
View File
@@ -13,9 +13,18 @@ jobs:
timeout-minutes: 3
runs-on: ubuntu-latest
steps:
- name: Repository Dispatch
- name: Mint twenty-infra dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: twenty-infra
permission-actions: write
- name: Trigger twenty-infra deploy
env:
GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
gh api repos/twentyhq/twenty-infra/dispatches \
-f event_type=auto-deploy-main
gh workflow run auto-deploy-main.yaml --repo twentyhq/twenty-infra --ref main
.github/workflows/cd-deploy-tag.yaml
+12 -25
View File
@@ -7,7 +7,6 @@ on:
push:
tags:
- 'twenty/v*'
- 'sdk/v*'
defaults:
run:
@@ -18,31 +17,19 @@ jobs:
timeout-minutes: 3
runs-on: ubuntu-latest
steps:
- name: Resolve dispatch event from tag family
id: target
env:
REF_NAME: ${{ github.ref_name }}
run: |
case "$REF_NAME" in
twenty/v*)
event_type=auto-deploy-twenty
;;
sdk/v*)
event_type=auto-publish-npm
;;
*)
echo "Unsupported tag '$REF_NAME', expected 'twenty/v*' or 'sdk/v*'." >&2
exit 1
;;
esac
printf 'event_type=%s\n' "$event_type" >> "$GITHUB_OUTPUT"
- name: Mint twenty-infra dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: twenty-infra
permission-actions: write
- name: Repository Dispatch
- name: Trigger staging CD
env:
GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
EVENT_TYPE: ${{ steps.target.outputs.event_type }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
REF_NAME: ${{ github.ref_name }}
run: |
gh api repos/twentyhq/twenty-infra/dispatches \
-f "event_type=$EVENT_TYPE" \
-f "client_payload[github][ref_name]=$REF_NAME"
gh workflow run staging-ci.yaml --repo twentyhq/twenty-infra --ref main -f tag="$REF_NAME"
.github/workflows/ci-ai-catalog-sync.yaml
+13 -2
View File
@@ -59,9 +59,20 @@ jobs:
labels: ai, automated
delete-branch: true
- name: Mint twenty-infra dispatch token
id: app-token
if: steps.changes.outputs.changed == 'true'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: twenty-infra
permission-actions: write
- name: Trigger automerge
if: steps.changes.outputs.changed == 'true'
env:
GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
gh api repos/twentyhq/twenty-infra/dispatches -f event_type=automated-pr-ready
gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
.github/workflows/claude.yml
+16 -8
View File
@@ -183,18 +183,26 @@ jobs:
"PG_DATABASE_URL": "postgres://postgres:postgres@localhost:5432/default"
}
}
- name: Mint ci-privileged dispatch token
id: app-token
if: always()
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch response to ci-privileged
if: always()
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
REPO: ${{ steps.prompt.outputs.repo }}
ISSUE_NUMBER: ${{ steps.prompt.outputs.issue_number }}
RUN_ID: ${{ github.run_id }}
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
run: |
gh api repos/twentyhq/ci-privileged/dispatches \
-f event_type=claude-cross-repo-response \
-f "client_payload[repo]=$REPO" \
-f "client_payload[issue_number]=$ISSUE_NUMBER" \
-f "client_payload[run_id]=$RUN_ID" \
-f "client_payload[run_url]=$RUN_URL"
gh workflow run post-claude-response.yaml --repo twentyhq/ci-privileged --ref main \
-f repo="$REPO" \
-f issue_number="$ISSUE_NUMBER" \
-f run_url="$RUN_URL"
.github/workflows/docs-i18n-pull.yaml
+13 -2
View File
@@ -151,9 +151,20 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Mint twenty-infra dispatch token
id: app-token
if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: twenty-infra
permission-actions: write
- name: Trigger i18n automerge
if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true'
env:
GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
.github/workflows/external-contributor-pr-auto-draft.yaml
+13 -6
View File
@@ -16,13 +16,20 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Mint ci-privileged dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch to ci-privileged
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
PR_NUMBER: ${{ github.event.pull_request.number }}
PR_NODE_ID: ${{ github.event.pull_request.node_id }}
run: |
gh api repos/twentyhq/ci-privileged/dispatches \
-f event_type=convert-pr-to-draft \
-f "client_payload[pr_number]=$PR_NUMBER" \
-f "client_payload[pr_node_id]=$PR_NODE_ID"
gh workflow run convert-pr-to-draft.yaml --repo twentyhq/ci-privileged --ref main \
-f pr_number="$PR_NUMBER"
.github/workflows/i18n-pull.yaml
+13 -2
View File
@@ -137,9 +137,20 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Mint twenty-infra dispatch token
id: app-token
if: steps.compile_translations.outputs.changes_detected == 'true'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: twenty-infra
permission-actions: write
- name: Trigger i18n automerge
if: steps.compile_translations.outputs.changes_detected == 'true'
env:
GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
.github/workflows/i18n-push.yaml
+13 -2
View File
@@ -103,9 +103,20 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Mint twenty-infra dispatch token
id: app-token
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: twenty-infra
permission-actions: write
- name: Trigger i18n automerge
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
env:
GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
.github/workflows/post-ci-comments.yaml
+17 -7
View File
@@ -61,18 +61,28 @@ jobs:
core.setOutput('has_pr', 'true');
core.info(`PR #${prNumber}, Run ID: ${runId}`);
- name: Mint ci-privileged dispatch token
id: app-token
if: steps.pr-info.outputs.has_pr == 'true'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch to ci-privileged
if: steps.pr-info.outputs.has_pr == 'true'
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }}
RUN_ID: ${{ steps.pr-info.outputs.run_id }}
REPOSITORY: ${{ github.repository }}
BRANCH_STATE: ${{ github.event.workflow_run.head_branch }}
run: |
gh api repos/twentyhq/ci-privileged/dispatches \
-f event_type=breaking-changes-report \
-f "client_payload[pr_number]=$PR_NUMBER" \
-f "client_payload[run_id]=$RUN_ID" \
-f "client_payload[repo]=$REPOSITORY" \
-f "client_payload[branch_state]=$BRANCH_STATE"
gh workflow run post-breaking-changes-comment.yaml --repo twentyhq/ci-privileged --ref main \
-f pr_number="$PR_NUMBER" \
-f run_id="$RUN_ID" \
-f repo="$REPOSITORY" \
-f branch_state="$BRANCH_STATE"
.github/workflows/pr-auto-review-dispatch.yaml
+13 -4
View File
@@ -16,11 +16,20 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Mint ci-privileged dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch to ci-privileged
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
PR_NUMBER: ${{ github.event.pull_request.number }}
run: |
gh api repos/twentyhq/ci-privileged/dispatches \
-f event_type=pr-review \
-f "client_payload[pr_number]=$PR_NUMBER"
gh workflow run pr-review.yaml --repo twentyhq/ci-privileged --ref main \
-f pr_number="$PR_NUMBER"
.github/workflows/preview-env-dispatch.yaml
+15 -6
View File
@@ -33,15 +33,24 @@ jobs:
timeout-minutes: 5
runs-on: ubuntu-latest
steps:
- name: Mint ci-privileged dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch preview-env to ci-privileged
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
PR_NUMBER: ${{ github.event.pull_request.number }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
REPOSITORY: ${{ github.repository }}
run: |
gh api repos/twentyhq/ci-privileged/dispatches \
-f event_type=preview-environment \
-f "client_payload[pr_number]=$PR_NUMBER" \
-f "client_payload[pr_head_sha]=$PR_HEAD_SHA" \
-f "client_payload[repo]=$REPOSITORY"
gh workflow run preview-env.yaml --repo twentyhq/ci-privileged --ref main \
-f pr_number="$PR_NUMBER" \
-f pr_head_sha="$PR_HEAD_SHA" \
-f repo="$REPOSITORY"
.github/workflows/visual-regression-dispatch.yaml
+61 -36
View File
@@ -4,8 +4,9 @@ name: Visual Regression Dispatch
# Runs in the context of the base repo (not the fork) so it has access to secrets,
# making it work for external contributor PRs.
#
# All dispatches use the same event_type=visual-regression with project/artifact_name
# in the payload. ci-privileged routes to the correct Argos project based on these.
# All paths trigger the same ci-privileged workflow (post-visual-regression-comment.yaml)
# via workflow_dispatch, passing the project as an input. ci-privileged routes to the
# correct Argos project based on it.
on:
workflow_run:
@@ -147,9 +148,19 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Mint ci-privileged dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch to ci-privileged
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
PROJECT: ${{ needs.resolve-context.outputs.project }}
PR_NUMBER: ${{ needs.resolve-context.outputs.pr_number }}
WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
@@ -160,24 +171,22 @@ jobs:
ARTIFACT_NAME: ${{ needs.resolve-context.outputs.artifact_name }}
run: |
ARGS=(
--method POST
-f event_type=visual-regression
-f "client_payload[project]=$PROJECT"
-f "client_payload[artifact_name]=$ARTIFACT_NAME"
-f "client_payload[run_id]=$WORKFLOW_RUN_ID"
-f "client_payload[repo]=$REPOSITORY"
-f "client_payload[branch]=$BRANCH"
-f "client_payload[commit]=$COMMIT"
-f project="$PROJECT"
-f artifact_name="$ARTIFACT_NAME"
-f run_id="$WORKFLOW_RUN_ID"
-f repo="$REPOSITORY"
-f branch="$BRANCH"
-f commit="$COMMIT"
)
if [ -n "$PR_NUMBER" ]; then
ARGS+=(-f "client_payload[pr_number]=$PR_NUMBER")
ARGS+=(-f pr_number="$PR_NUMBER")
fi
if [ -n "$REFERENCE_COMMIT" ]; then
ARGS+=(-f "client_payload[reference_commit]=$REFERENCE_COMMIT")
ARGS+=(-f reference_commit="$REFERENCE_COMMIT")
fi
gh api repos/twentyhq/ci-privileged/dispatches "${ARGS[@]}"
gh workflow run post-visual-regression-comment.yaml --repo twentyhq/ci-privileged --ref main "${ARGS[@]}"
# ── Dispatch: cross-comparison baseline (CI UI on main → twenty-ui-vs-new-ui) ──
dispatch-comparison-baseline:
@@ -190,24 +199,32 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Mint ci-privileged dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch to ci-privileged (comparison baseline)
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
REPOSITORY: ${{ github.repository }}
BRANCH: ${{ github.event.workflow_run.head_branch }}
COMMIT: ${{ github.event.workflow_run.head_sha }}
ARTIFACT_NAME: ${{ needs.resolve-context.outputs.artifact_name }}
run: |
gh api repos/twentyhq/ci-privileged/dispatches \
--method POST \
-f event_type=visual-regression \
-f "client_payload[project]=twenty-ui-vs-new-ui" \
-f "client_payload[artifact_name]=$ARTIFACT_NAME" \
-f "client_payload[run_id]=$WORKFLOW_RUN_ID" \
-f "client_payload[repo]=$REPOSITORY" \
-f "client_payload[branch]=$BRANCH" \
-f "client_payload[commit]=$COMMIT"
gh workflow run post-visual-regression-comment.yaml --repo twentyhq/ci-privileged --ref main \
-f project="twenty-ui-vs-new-ui" \
-f artifact_name="$ARTIFACT_NAME" \
-f run_id="$WORKFLOW_RUN_ID" \
-f repo="$REPOSITORY" \
-f branch="$BRANCH" \
-f commit="$COMMIT"
# ── Dispatch: cross-comparison PR (CI New UI on PRs → twenty-ui-vs-new-ui) ──
dispatch-comparison-pr:
@@ -220,9 +237,19 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Mint ci-privileged dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch to ci-privileged (comparison PR)
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
REPOSITORY: ${{ github.repository }}
BRANCH: ${{ github.event.workflow_run.head_branch }}
@@ -232,19 +259,17 @@ jobs:
ARTIFACT_NAME: ${{ needs.resolve-context.outputs.artifact_name }}
run: |
ARGS=(
--method POST
-f event_type=visual-regression
-f "client_payload[project]=twenty-ui-vs-new-ui"
-f "client_payload[artifact_name]=$ARTIFACT_NAME"
-f "client_payload[run_id]=$WORKFLOW_RUN_ID"
-f "client_payload[repo]=$REPOSITORY"
-f "client_payload[branch]=$BRANCH"
-f "client_payload[commit]=$COMMIT"
-f "client_payload[pr_number]=$PR_NUMBER"
-f project="twenty-ui-vs-new-ui"
-f artifact_name="$ARTIFACT_NAME"
-f run_id="$WORKFLOW_RUN_ID"
-f repo="$REPOSITORY"
-f branch="$BRANCH"
-f commit="$COMMIT"
-f pr_number="$PR_NUMBER"
)
if [ -n "$REFERENCE_COMMIT" ]; then
ARGS+=(-f "client_payload[reference_commit]=$REFERENCE_COMMIT")
ARGS+=(-f reference_commit="$REFERENCE_COMMIT")
fi
gh api repos/twentyhq/ci-privileged/dispatches "${ARGS[@]}"
gh workflow run post-visual-regression-comment.yaml --repo twentyhq/ci-privileged --ref main "${ARGS[@]}"
.github/workflows/website-i18n-pull.yaml
+13 -2
View File
@@ -126,9 +126,20 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Mint twenty-infra dispatch token
id: app-token
if: steps.compile_translations.outputs.changes_detected == 'true'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: twenty-infra
permission-actions: write
- name: Trigger i18n automerge
if: steps.compile_translations.outputs.changes_detected == 'true'
env:
GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
.github/workflows/website-i18n-push.yaml
+13 -2
View File
@@ -102,9 +102,20 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Mint twenty-infra dispatch token
id: app-token
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: twenty-infra
permission-actions: write
- name: Trigger i18n automerge
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
env:
GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready
gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
.github/workflows/website-preview-dispatch.yaml
+30 -10
View File
@@ -35,18 +35,28 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Mint ci-privileged dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch website-preview-build to ci-privileged
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
PR_NUMBER: ${{ github.event.pull_request.number }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
run: |
gh api repos/twentyhq/ci-privileged/dispatches \
-f event_type=website-preview-build \
-f "client_payload[pr_number]=$PR_NUMBER" \
-f "client_payload[pr_head_sha]=$PR_HEAD_SHA" \
-f "client_payload[pr_head_ref]=$PR_HEAD_REF"
gh workflow run website-preview.yaml --repo twentyhq/ci-privileged --ref main \
-f action=build \
-f pr_number="$PR_NUMBER" \
-f pr_head_sha="$PR_HEAD_SHA" \
-f pr_head_ref="$PR_HEAD_REF"
trigger-cleanup:
# Covers both merge and close-without-merge — pull_request `closed` fires
@@ -59,11 +69,21 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Mint ci-privileged dispatch token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
owner: twentyhq
repositories: ci-privileged
permission-actions: write
- name: Dispatch website-preview-cleanup to ci-privileged
env:
GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}
PR_NUMBER: ${{ github.event.pull_request.number }}
run: |
gh api repos/twentyhq/ci-privileged/dispatches \
-f event_type=website-preview-cleanup \
-f "client_payload[pr_number]=$PR_NUMBER"
gh workflow run website-preview.yaml --repo twentyhq/ci-privileged --ref main \
-f action=cleanup \
-f pr_number="$PR_NUMBER"