asephsandClaude Opus 4.8
b199f8ce9d
- lint.yml: remove || echo so lint errors actually fail the workflow - typecheck.yml: remove || echo, switch to Bun, add apps/elysia typecheck - update-submodule.yml: upgrade checkout@v6, add payload validation + push retry - security.yml: add Rust to CodeQL scan targets - docker-build-push.yml: remove stale packages/ path refs - All workflows: add timeout-minutes to prevent stuck jobs Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
81 lines
2.4 KiB
YAML
81 lines
2.4 KiB
YAML
name: Update Submodule Pointer
|
|
on:
|
|
repository_dispatch:
|
|
types: [submodule-updated]
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
update:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Validate payload
|
|
env:
|
|
SERVICE: ${{ github.event.client_payload.service }}
|
|
SHA: ${{ github.event.client_payload.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [ -z "${SERVICE:-}" ]; then
|
|
echo "::error::Missing service in payload"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z "${SHA:-}" ]; then
|
|
echo "::error::Missing sha in payload"
|
|
exit 1
|
|
fi
|
|
|
|
if ! [[ "$SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
|
|
echo "::error::Invalid sha '$SHA'. Expected 40 hex characters."
|
|
exit 1
|
|
fi
|
|
|
|
case "$SERVICE" in
|
|
scraper-api|elysia-api|react-web|rust-auth) ;;
|
|
*)
|
|
echo "::error::Unsupported service '$SERVICE'"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo "Payload validated: $SERVICE → $SHA"
|
|
|
|
- name: Update submodule pointer
|
|
env:
|
|
SERVICE: ${{ github.event.client_payload.service }}
|
|
SHA: ${{ github.event.client_payload.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
echo "Updating ${SERVICE} to ${SHA}"
|
|
git submodule update --init "apps/${SERVICE}"
|
|
cd "apps/${SERVICE}"
|
|
# full fetch so we get tree objects for the target SHA
|
|
git fetch --depth=1 origin master 2>/dev/null || git fetch --depth=1 origin main
|
|
git checkout "${SHA}"
|
|
cd "${GITHUB_WORKSPACE}"
|
|
git add "apps/${SERVICE}"
|
|
git diff --cached --quiet && exit 0
|
|
|
|
git config user.name "monrepo-bot"
|
|
git config user.email "monrepo-bot@users.noreply.github.com"
|
|
git commit -m "chore: update ${SERVICE} to ${SHA:0:12}"
|
|
|
|
for attempt in {1..3}; do
|
|
if git pull --rebase origin main && git push origin main; then
|
|
echo "✅ Push succeeded on attempt $attempt"
|
|
exit 0
|
|
fi
|
|
echo "⚠️ Push attempt $attempt/3 failed; retrying..."
|
|
git rebase --abort 2>/dev/null || true
|
|
sleep 3
|
|
done
|
|
|
|
echo "::error::Failed to push submodule update after 3 attempts"
|
|
exit 1
|