Label-Sync/.github/workflows/01-org-label-sync.yml at 3d05f11155bd0ab13520c4609b235c7c07b3e00f · UltraProdigy/Label-Sync · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: 01 - Org-Label-Sync

on:
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:
    inputs:
      dry_run:
        description: "[TEST MODE] Preview label changes without applying them. Writes a preview changelog to the workflow summary."
        required: false
        type: boolean
        default: false
      delete_missing:
        description: "Delete all other labels that are not present in config"
        required: false
        type: boolean
        default: false
      delete_github_default_labels:
        description: "Delete Github default labels"
        required: false
        type: boolean
        default: true
      repositories:
        description: "[OPTIONAL] Config Override: Run workflow on this set of non-source repositories exclusively. Format: name, name2"
        required: false
        type: string
      label_replacements:
        description: "[OPTIONAL] Label Replacement: Define label replacements before their deletion. Format: old=new, old2=new2"
        required: false
        type: string

permissions:
  contents: write

jobs:
  automatic-settings:
    runs-on: ubuntu-latest
    outputs:
      enabled: ${{ steps.settings.outputs.enabled }}
      delete_missing: ${{ steps.settings.outputs.delete_missing }}
      delete_github_default_labels: ${{ steps.settings.outputs.delete_github_default_labels }}
      label_replacements: ${{ steps.settings.outputs.label_replacements }}

    steps:
      - name: Check out latest default branch
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.repository.default_branch }}

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Load automatic sync settings
        id: settings
        run: node scripts/export-automatic-sync-settings.mjs

  refresh-config:
    needs: automatic-settings
    if: ${{ github.event_name != 'schedule' || needs.automatic-settings.outputs.enabled == 'true' }}
    uses: ./.github/workflows/02-config-label-sync.yml
    secrets: inherit

  sync-org:
    needs: [automatic-settings, refresh-config]
    # refresh-config is skipped on a scheduled run when automatic sync is disabled, and a
    # skipped dependency does not satisfy `needs`. Without this condition sync-org would
    # silently skip along with it, producing no changelog and no failure. Gate on
    # automatic-settings instead, and tolerate refresh-config being skipped.
    if: >-
      ${{
        !cancelled()
        && needs.automatic-settings.result == 'success'
        && needs.refresh-config.result != 'failure'
        && (github.event_name != 'schedule' || needs.automatic-settings.outputs.enabled == 'true')
      }}
    runs-on: ubuntu-latest

    steps:
      - name: Check out latest default branch
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.repository.default_branch }}

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Load properties
        id: properties
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: node scripts/export-properties.mjs

      - name: Resolve PAT auth token
        id: pat_auth
        if: ${{ steps.properties.outputs.auth_mode == 'pat' }}
        env:
          AUTH_MODE: pat
          PAT_TOKEN: ${{ secrets[steps.properties.outputs.pat_token_secret_name] }}
        run: node scripts/create-github-auth-token.mjs

      - name: Resolve GitHub App auth token
        id: app_auth
        if: ${{ steps.properties.outputs.auth_mode == 'githubApp' }}
        env:
          AUTH_MODE: githubApp
          GITHUB_APP_ID: ${{ secrets[steps.properties.outputs.github_app_id_secret_name] }}
          GITHUB_APP_PRIVATE_KEY: ${{ secrets[steps.properties.outputs.github_app_private_key_secret_name] }}
          GITHUB_APP_INSTALLATION_ID: ${{ secrets[steps.properties.outputs.github_app_installation_id_secret_name] }}
        run: node scripts/create-github-auth-token.mjs

      - name: Validate updated config
        env:
          DELETE_GITHUB_DEFAULT_LABELS: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.delete_github_default_labels || inputs.delete_github_default_labels }}
          LABEL_REPLACEMENTS: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.label_replacements || inputs.label_replacements }}
        run: node scripts/sync-labels.mjs --validate-only

      - name: Sync labels across the organization
        env:
          ORG_NAME: ${{ steps.properties.outputs.organization }}
          DRY_RUN: ${{ inputs.dry_run }}
          DELETE_MISSING: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.delete_missing || inputs.delete_missing }}
          DELETE_GITHUB_DEFAULT_LABELS: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.delete_github_default_labels || inputs.delete_github_default_labels }}
          TARGET_REPOSITORIES: ${{ inputs.repositories }}
          LABEL_REPLACEMENTS: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.label_replacements || inputs.label_replacements }}
        run: node scripts/sync-labels.mjs