Trunk sync lock #2879
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Trunk sync lock | |
| # Posts a `trunk-synced` status to open PRs against staging main — red while staging does | |
| # not contain production (a release isn't back-synced yet), green when it does. Make it a | |
| # required check on staging main to block merges during the release window. It gates PRs | |
| # only; the back-sync pushes staging main directly. | |
| # | |
| # Never route the back-sync through a PR gated by this check or it deadlocks. | |
| # First-run: a check counts as "required" only after it reports once, so trigger this | |
| # workflow once before marking trunk-synced required. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| types: [opened, synchronize, reopened] | |
| workflow_run: | |
| workflows: ['Sync SDK repos'] | |
| types: [completed] | |
| repository_dispatch: | |
| types: [prod-released] | |
| workflow_dispatch: {} | |
| schedule: | |
| - cron: '*/30 * * * *' | |
| permissions: | |
| contents: read | |
| statuses: write | |
| pull-requests: read | |
| jobs: | |
| lock: | |
| runs-on: ${{ vars.STLC_RUNNER || 'ubuntu-latest' }} | |
| if: github.repository == 'privy-io/ruby-sdk-private' | |
| env: | |
| PRODUCTION_REPO: privy-io/ruby-sdk | |
| PRODUCTION_REPO_TOKEN: ${{ secrets.PRODUCTION_REPO_TOKEN }} | |
| GH_TOKEN: ${{ github.token }} | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| # The lock represents staging main, not the event commit. In particular, | |
| # pull_request checks out a synthetic PR merge commit by default. | |
| ref: main | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Evaluate sync state and post status to open main PRs | |
| run: | | |
| set -euo pipefail | |
| # Public production reads with no credential; a private production | |
| # repo needs PRODUCTION_REPO_TOKEN (the same token the promote uses). | |
| if [ -n "${PRODUCTION_REPO_TOKEN:-}" ]; then | |
| git remote add production "https://x-access-token:${PRODUCTION_REPO_TOKEN}@github.com/${PRODUCTION_REPO}.git" | |
| else | |
| git remote add production "https://github.com/${PRODUCTION_REPO}.git" | |
| fi | |
| git fetch --no-tags production main | |
| if git merge-base --is-ancestor production/main origin/main; then | |
| state=success; desc="staging main contains production" | |
| else | |
| state=failure; desc="production is ahead of or diverged from staging — wait for reconciliation" | |
| fi | |
| echo "trunk-synced => $state ($desc)" | |
| shas=$(gh pr list --repo "$GITHUB_REPOSITORY" --base main --state open --json headRefOid --jq '.[].headRefOid') | |
| if [ -z "$shas" ]; then echo "no open PRs targeting main"; exit 0; fi | |
| for sha in $shas; do | |
| gh api -X POST "repos/$GITHUB_REPOSITORY/statuses/$sha" \ | |
| -f state="$state" -f context="trunk-synced" -f description="$desc" >/dev/null | |
| echo "posted trunk-synced=$state to $sha" | |
| done |