Pylon upstream sync #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pylon upstream sync | |
| on: | |
| schedule: | |
| - cron: "17 7 * * *" | |
| workflow_dispatch: | |
| concurrency: | |
| group: pylon-upstream-sync | |
| cancel-in-progress: false | |
| permissions: {} | |
| jobs: | |
| sync: | |
| name: Mirror and prepare merge | |
| if: github.repository == 'pylon-code/prime-agent' && github.ref == 'refs/heads/pylon' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| environment: pylon-upstream-sync | |
| permissions: | |
| actions: read | |
| contents: write | |
| issues: write | |
| pull-requests: read | |
| outputs: | |
| candidate_sha: ${{ steps.sync.outputs.candidate_sha }} | |
| pr_url: ${{ steps.sync.outputs.pr_url }} | |
| steps: | |
| - name: Checkout Pylon product branch | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| - name: Prove the approved exact live revision, then mirror Prime | |
| id: sync | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| test "$GITHUB_REPOSITORY" = "pylon-code/prime-agent" | |
| test "$GITHUB_EVENT_NAME" = "${{ github.event_name }}" | |
| case "$GITHUB_EVENT_NAME" in schedule|workflow_dispatch) ;; *) exit 1 ;; esac | |
| test "$GITHUB_REF" = "refs/heads/pylon" | |
| test "$GITHUB_SHA" = "${{ github.sha }}" | |
| test "$(git rev-parse HEAD)" = "$GITHUB_SHA" | |
| test "$(git rev-parse --show-toplevel)" = "$GITHUB_WORKSPACE" | |
| test "$(gh api repos/pylon-code/prime-agent/git/ref/heads/pylon --jq .object.sha)" = "$GITHUB_SHA" | |
| exec scripts/pylon-sync-upstream.sh | |
| verify: | |
| name: Verify candidate ${{ needs.sync.outputs.candidate_sha }} with trusted fork CI | |
| needs: sync | |
| if: needs.sync.outputs.candidate_sha != '' | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/ci.yml | |
| with: | |
| checkout_ref: ${{ needs.sync.outputs.candidate_sha }} | |
| require_trusted: true |