ci: enhance workflow publication and auto-merge process #108
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| schedule: | |
| - cron: "30 11 * * 1-5" | |
| workflow_dispatch: | |
| inputs: | |
| run_trials: | |
| description: Run published workflows end-to-end to verify they produce results | |
| required: false | |
| default: false | |
| type: boolean | |
| jobs: | |
| compile: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: Set up gh-aw CLI | |
| uses: github/gh-aw-actions/setup-cli@f8495a686e66770ae977f82732f34d7340ee42a4 # setup-cli action pin (installs CLI v0.72.1 below) | |
| with: | |
| version: v0.72.1 | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Compile workflows | |
| run: | | |
| gh aw compile | |
| gh aw compile --dir workflows | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| add: | |
| runs-on: ubuntu-latest | |
| needs: [compile] | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: Set up gh-aw CLI | |
| uses: github/gh-aw-actions/setup-cli@f8495a686e66770ae977f82732f34d7340ee42a4 # setup-cli action pin (installs CLI v0.72.1 below) | |
| with: | |
| version: v0.72.1 | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Test gh aw add from local sources | |
| run: | | |
| TARGET_REPO=$(mktemp -d) | |
| git init "$TARGET_REPO" | |
| cd "$TARGET_REPO" | |
| gh aw add "${{ github.workspace }}/workflows/copilot-token-audit.md" "${{ github.workspace }}/workflows/copilot-token-optimizer.md" | |
| gh aw compile --validate --no-emit | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| publish: | |
| runs-on: ubuntu-latest | |
| needs: [add] | |
| permissions: | |
| contents: read | |
| outputs: | |
| pr_url: ${{ steps.publish.outputs.pr_url }} | |
| auto_merge_enabled: ${{ steps.publish.outputs.auto_merge_enabled }} | |
| if: >- | |
| github.event_name == 'schedule' || | |
| (github.event_name == 'workflow_dispatch' && github.event.inputs.run_trials == 'true') | |
| steps: | |
| - name: Create GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@v1 | |
| with: | |
| app-id: ${{ vars.AGENTIC_OPS_APP_ID }} | |
| private-key: ${{ secrets.AGENTIC_OPS_PRIVATE_KEY }} | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Set up gh-aw CLI | |
| uses: github/gh-aw-actions/setup-cli@f8495a686e66770ae977f82732f34d7340ee42a4 # setup-cli action pin (installs CLI v0.72.1 below) | |
| with: | |
| version: v0.72.1 | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Publish workflows and enable auto-merge | |
| id: publish | |
| run: | | |
| set -euo pipefail | |
| RUN_BRANCH="ci/aw-trials-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" | |
| git switch --create "$RUN_BRANCH" | |
| gh aw add "${{ github.workspace }}/workflows/copilot-token-audit.md" "${{ github.workspace }}/workflows/copilot-token-optimizer.md" | |
| gh aw compile | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add .github/workflows/copilot-token-audit.md .github/workflows/copilot-token-audit.lock.yml | |
| git add .github/workflows/copilot-token-optimizer.md .github/workflows/copilot-token-optimizer.lock.yml | |
| if git diff --cached --quiet; then | |
| echo "No published workflow changes to push." | |
| echo "pr_url=" >> "$GITHUB_OUTPUT" | |
| echo "auto_merge_enabled=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| git commit -m "ci: publish workflows for execution" | |
| git push --set-upstream origin "$RUN_BRANCH" | |
| pr_url=$(gh pr create \ | |
| --base main \ | |
| --head "$RUN_BRANCH" \ | |
| --title "ci: publish workflows for execution" \ | |
| --body "Automated workflow publication from CI.") | |
| gh pr merge "$pr_url" --auto --squash --delete-branch | |
| echo "pr_url=$pr_url" >> "$GITHUB_OUTPUT" | |
| echo "auto_merge_enabled=true" >> "$GITHUB_OUTPUT" | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| - name: Summarize publish result | |
| if: always() | |
| run: | | |
| { | |
| echo "### Publish Result" | |
| if [[ -n "${{ steps.publish.outputs.pr_url }}" ]]; then | |
| echo | |
| echo "- PR: ${{ steps.publish.outputs.pr_url }}" | |
| echo "- Auto-merge enabled: ${{ steps.publish.outputs.auto_merge_enabled }}" | |
| else | |
| echo | |
| echo "- No workflow publication changes were produced." | |
| fi | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| run: | |
| runs-on: ubuntu-latest | |
| needs: [add] | |
| permissions: | |
| actions: write | |
| contents: read | |
| if: >- | |
| (github.event_name == 'push' && github.ref == 'refs/heads/main') || | |
| github.event_name == 'schedule' | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up gh-aw CLI | |
| uses: github/gh-aw-actions/setup-cli@f8495a686e66770ae977f82732f34d7340ee42a4 # setup-cli action pin (installs CLI v0.72.1 below) | |
| with: | |
| version: v0.72.1 | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Verify installed workflows exist on main | |
| run: | | |
| set -euo pipefail | |
| missing=0 | |
| for path in \ | |
| .github/workflows/copilot-token-audit.md \ | |
| .github/workflows/copilot-token-audit.lock.yml \ | |
| .github/workflows/copilot-token-optimizer.md \ | |
| .github/workflows/copilot-token-optimizer.lock.yml; do | |
| if ! git cat-file -e "origin/main:${path}" 2>/dev/null; then | |
| echo "Missing on origin/main: ${path}" | |
| missing=1 | |
| fi | |
| done | |
| if [[ "$missing" -ne 0 ]]; then | |
| echo "Published workflows must be committed to main before CI can trigger real runs." | |
| exit 1 | |
| fi | |
| - name: Run installed workflows from main | |
| run: | | |
| set -euo pipefail | |
| gh aw run copilot-token-audit copilot-token-optimizer --ref main | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |