New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Trigger preproduction sync only after merge to main #1170
Trigger preproduction sync only after merge to main #1170
Conversation
|
||
name: Sync Published Ceremony Branch to Main and Preprod | ||
|
||
# Declare default permissions as none. | ||
permissions: {} | ||
|
||
on: | ||
schedule: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@kommendorkapten any reason you think this is needed? i don't see why we need to continually try to sync
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think the idea is to open a PR automatically when the ceremony branch is ready, but I think that's quite unnecessary, it's trivial to open that PR manually so I'm in favour of dropping this.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this is already covered under the push
condition, once the ceremony branch is created and pushed to.
527e053
to
18fce44
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There's a lot of moving parts in this process so hard to say conclusively that it's correct... but I think this works
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks good.
In sigstore#916, we restructured the sync scripts. As part of this, the sync to preprod after a ceremony completed would occur from the ceremony branch. We only allow workload impersonation (which is needed to push to GCS and update the CDN cache) from main, so this breaks. To fix this, we simply split the workflow into two: The first triggers on a push to ceremony and creates a PR to merge to main. After merging from main and updating the root, we sync all contents from the repository directory. I also removed the cron job because I don't think it's needed. Also updated documentation for post-merge steps. Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
b6d2ef5
18fce44
to
b6d2ef5
Compare
Had to rebase, ready to merge |
In #916, we restructured the sync scripts. As part of this, the sync to preprod after a ceremony completed would occur from the ceremony branch. We only allow workload impersonation (which is needed to push to GCS and update the CDN cache) from main, so this breaks.
To fix this, we simply split the workflow into two: The first triggers on a push to ceremony and creates a PR to merge to main. After merging from main and updating the root, we sync all contents from the repository directory.
I also removed the cron job because I don't think it's needed. Also updated documentation for post-merge steps.
Fixes #1165
Summary
Release Note
Documentation