Automate synchronization from the Accelerate upstream

.github/workflows/sync-from-accelerate.yml

@@ -0,0 +1,148 @@
+# SPDX-License-Identifier: MIT
+#
+# Pull-based mirror of the canonical Accelerate upstream.
+# Uses only GitHub-hosted Actions, git and the GitHub CLI. No external service
+# or cross-organisation secret is required.
+#
+# A sync never writes directly to main. It validates the synchronized tree,
+# updates sync/accelerate-main and opens or refreshes a pull request.
+
+name: Sync from Accelerate upstream
+
+on:
+  schedule:
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  statuses: write
+
+concurrency:
+  group: sync-from-accelerate
+  cancel-in-progress: true
+
+env:
+  UPSTREAM_REPOSITORY: Accelerate-GmbH/industry-function-graph
+  SYNC_BRANCH: sync/accelerate-main
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout DIDAS
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Prepare synchronization branch
+        run: git checkout -B "$SYNC_BRANCH" origin/main
+
+      - name: Fetch canonical Accelerate upstream
+        run: |
+          git clone --depth 1 "https://github.com/$UPSTREAM_REPOSITORY.git" "$RUNNER_TEMP/upstream"
+          echo "UPSTREAM_SHA=$(git -C "$RUNNER_TEMP/upstream" rev-parse HEAD)" >> "$GITHUB_ENV"
+
+      - name: Synchronize repository tree
+        run: |
+          rsync -a --delete \
+            --exclude='.git/' \
+            --exclude='.github/deploy-pages.yml.disabled' \
+            --exclude='.github/workflows/deploy-pages.yml' \
+            --exclude='.github/workflows/sync-from-accelerate.yml' \
+            "$RUNNER_TEMP/upstream/" ./
+
+          # DIDAS owns publication and synchronization. Those workflows are
+          # intentionally not mirrored from the Accelerate source repository.
+          git checkout origin/main -- \
+            '.github/workflows/deploy-pages.yml' \
+            '.github/workflows/sync-from-accelerate.yml'
+          rm -f '.github/deploy-pages.yml.disabled'
+
+      - name: Detect drift
+        id: drift
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            git status --short
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "DIDAS already matches Accelerate upstream."
+          fi
+
+      - name: Set up Python
+        if: steps.drift.outputs.changed == 'true'
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Validate synchronized graph
+        if: steps.drift.outputs.changed == 'true'
+        run: |
+          pip install rdflib pyshacl
+          python3 build/validate.py
+          python3 build/queries.py --check
+          python3 build/build.py --check
+
+      - name: Commit synchronized tree
+        if: steps.drift.outputs.changed == 'true'
+        run: |
+          git config user.name "danielsaeuberli"
+          git config user.email "249639066+danielsaeuberli@users.noreply.github.com"
+          git add -A
+          git commit -m "Sync from Accelerate upstream" \
+            -m "Source: https://github.com/$UPSTREAM_REPOSITORY/commit/$UPSTREAM_SHA"
+          git push --force origin "$SYNC_BRANCH"
+          echo "SYNC_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+
+      - name: Record successful synchronization validation
+        if: steps.drift.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api --method POST \
+            "repos/$GITHUB_REPOSITORY/statuses/$SYNC_SHA" \
+            -f state=success \
+            -f context='upstream-sync/validated' \
+            -f description='Accelerate upstream synchronized and repository checks passed'
+
+      - name: Create or refresh synchronization pull request
+        if: steps.drift.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          BODY=$(cat <<EOF
+This pull request synchronizes DIDAS with the canonical Accelerate upstream.
+
+Upstream: https://github.com/$UPSTREAM_REPOSITORY
+Upstream commit: `$UPSTREAM_SHA`
+
+Repository-specific DIDAS publication and synchronization workflows are preserved.
+The synchronized tree passed the repository's validation commands before this PR was created.
+
+This PR is generated by GitHub Actions.
+EOF
+          )
+
+          if NUMBER=$(gh pr view "$SYNC_BRANCH" --json number --jq .number 2>/dev/null); then
+            gh pr edit "$NUMBER" \
+              --title "Sync from Accelerate upstream" \
+              --body "$BODY"
+          else
+            gh pr create \
+              --base main \
+              --head "$SYNC_BRANCH" \
+              --title "Sync from Accelerate upstream" \
+              --body "$BODY"
+          fi
+
+      - name: Close stale synchronization PR when no drift remains
+        if: steps.drift.outputs.changed == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if NUMBER=$(gh pr view "$SYNC_BRANCH" --json number --jq .number 2>/dev/null); then
+            gh pr close "$NUMBER" --comment "No upstream drift remains; closing the synchronization PR."
+          fi