Sync from production #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This pulls production's commits (release-please version/changelog bumps AND any | |
| # contributions merged on production main) back onto staging main as an | |
| # auto-merging PR, so staging stops drifting behind production. Runs on the | |
| # staging repo, on a schedule; production stays reference-free (staging does the | |
| # pull, reusing the stlc app token the promote workflow already uses). | |
| # | |
| # ── Per-repo substitutions (do this once per target) ──────────────────────── | |
| # <STAGING_REPO> the staging repo this file lives in (e.g. <org>/<api>-python-staging) | |
| # <PRODUCTION_REPO> the matching public production repo (e.g. <org>/<api>-python) | |
| # Each target (python, go, typescript, terraform) gets its own copy with its own | |
| # two values. The stlc app token is the same one promote already needs. | |
| name: Sync from production | |
| on: | |
| schedule: | |
| # A poll, not a release — tune to how often releases/contributions land on | |
| # production. Every few hours is plenty; daily is fine. | |
| - cron: '17 */6 * * *' | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: write # push the back-sync branch on staging | |
| pull-requests: write # open/merge the back-sync PR on staging | |
| concurrency: | |
| group: stlc-sync-from-production | |
| cancel-in-progress: true | |
| jobs: | |
| sync: | |
| runs-on: ubuntu-latest | |
| if: github.repository != 'togethercomputer/together-typescript' | |
| env: | |
| PRODUCTION_REPO: togethercomputer/together-typescript | |
| # The built-in token writes the branch + PR on this (staging) repo. | |
| GH_TOKEN: ${{ github.token }} | |
| steps: | |
| - name: Check out staging | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Mint STLC app token (scoped to SDK staging repos) | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| client-id: ${{ secrets.STLC_WORKFLOW_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.STLC_WORKFLOW_APP_PRIVATE_KEY }} | |
| owner: togethercomputer | |
| repositories: together-typescript | |
| - name: Fetch production main | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| git config --global user.name "stlc-workflow-app[bot]" | |
| git config --global user.email "287504455+stlc-workflow-app[bot]@users.noreply.github.com" | |
| git remote add production \ | |
| "https://x-access-token:${GH_TOKEN}@github.com/${PRODUCTION_REPO}.git" | |
| git fetch production main | |
| - name: Check whether production has content staging lacks | |
| id: diff | |
| run: | | |
| # Inverse of the promote guard, by content not commit SHA: would | |
| # merging production into staging change staging's tree? If not, | |
| # staging already has production's content — nothing to pull back. | |
| MERGED=$(git merge-tree --write-tree origin/main production/main) || MERGED=conflict | |
| STAGING_TREE=$(git rev-parse 'origin/main^{tree}') | |
| if [ "$MERGED" = "$STAGING_TREE" ]; then | |
| echo "Staging already has production's content. Nothing to pull back." | |
| echo "behind=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "behind=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Push production main to the back-sync branch on staging | |
| if: steps.diff.outputs.behind == 'true' | |
| run: git push origin production/main:refs/heads/stlc/from-prod --force | |
| - name: Open or update the back-sync PR on staging | |
| if: steps.diff.outputs.behind == 'true' | |
| run: | | |
| EXISTING_PR=$(gh pr list --head stlc/from-prod --base main --state open --json number --jq '.[0].number') | |
| if [ -z "${EXISTING_PR}" ]; then | |
| gh pr create \ | |
| --base main \ | |
| --head stlc/from-prod \ | |
| --title "Sync release changes from production" \ | |
| --body "Pulls production's release-please commits (and any merged contributions) back onto staging \`main\` so the next \`stlc build\` reseals against the released state. Bot-authored; safe to auto-merge." | |
| fi | |
| # Auto-merge so the loop is hands-off. If auto-merge isn't enabled on | |
| # the repo, the PR is left open for a one-click merge instead. | |
| gh pr merge stlc/from-prod --merge --auto \ | |
| || echo "Auto-merge unavailable — merge the back-sync PR manually." |