stdlib/.github/workflows/update_cli_permissions.yml at develop · AadishJ/stdlib · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
#/
# @license Apache-2.0
#
# Copyright (c) 2023 The Stdlib Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#/

# Workflow name:
name: update_cli_permissions

# Workflow triggers:
on:
  schedule:
    # Run the workflow once a week (Sunday at midnight):
    - cron: '0 0 * * 0'

  # Allow the workflow to be manually run:
  workflow_dispatch:

# Global permissions:
permissions:
  # Allow read-only access to the repository contents:
  contents: read

# Workflow jobs:
jobs:

  # Define a job for making CLI scripts executable:
  update:

    # Define a display name:
    name: 'Update CLI Permissions'

    # Ensure the job does not run on forks:
    if: github.repository == 'stdlib-js/stdlib'

    # Define the type of virtual host machine:
    runs-on: ubuntu-latest

    # Define the sequence of job steps...
    steps:

      # Checkout the repository:
      - name: 'Checkout repository'
        # Pin action to full length commit SHA
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          # Specify whether to remove untracked files before checking out the repository:
          clean: true

          # Limit clone depth to the most recent commit:
          fetch-depth: 1

          # Specify whether to download Git-LFS files:
          lfs: false
        timeout-minutes: 10

      # Make CLI scripts executable:
      - name: 'Make CLI scripts executable'
        run: |
          files=$(find lib/node_modules/@stdlib -type d -name 'bin' -exec find {} -type f -name 'cli' \;)

          for file in $files; do
            chmod +x "$file"
          done

      # Disable Git hooks:
      - name: 'Disable Git hooks'
        run: |
          rm -rf .git/hooks

      # Import GPG key to sign commits:
      - name: 'Import GPG key to sign commits'
        # Pin action to full length commit SHA
        uses: crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5 # v6.2.0
        with:
          gpg_private_key: ${{ secrets.STDLIB_BOT_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.STDLIB_BOT_GPG_PASSPHRASE }}
          git_user_signingkey: true
          git_commit_gpgsign: true

      # Create a pull request with the updated files:
      - name: 'Create pull request'
        id: cpr
        # Pin action to full length commit SHA
        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
        with:
          title: 'fix: make CLI scripts executable'
          commit-message: 'fix: make CLI scripts executable'
          committer: 'stdlib-bot <82920195+stdlib-bot@users.noreply.github.com>'
          signoff: true
          body: |
            This PR changes the permissions of project `cli` scripts to be executable.
          token: ${{ secrets.PULL_REQUEST_TOKEN }}
          labels: |
            automated-pr
          team-reviewers: |
            reviewers
          branch: update-cli-permissions
          delete-branch: true