mirror of
https://github.com/pezkuwichain/pezkuwi-wallet-utils.git
synced 2026-08-12 03:31:06 +00:00
6d96f82ceb
* ci: run the gate before the deploy, not after it master is the live branch — every app fetches its config from raw.githubusercontent.com/.../master/... — and the flow was arranged so that content reached it first and was checked afterwards. auto-pr.yml fired on a push to *master* and opened a master → main PR. Code Quality ran on that PR, i.e. on the way into the mirror, long after the config was already being served. A check that reports "the live config is broken" is not a gate. The same inversion made master unwritable by the front door: five required status checks, and no workflow triggering on a PR into master, so the only way to change the live branch was to bypass its own protection. That is not a hypothetical — it was bypassed twice on 2026-08-10, and the second time was to undo the first. Now: work lands on main, Code Quality decides, and promote-to-live moves master to the exact commit that passed. It refuses anything that is not an ancestor of main, and uses --force-with-lease so a master that moved underneath it is a failure rather than a silent overwrite. main already ran Code Quality on push, so no trigger change is needed. Also: each daily sync opened a PR and nothing closed the previous one. Thirty-one branches spanning 2026-02-10 to 2026-08-08 were cleared by hand on 2026-08-11, every one superseded by the next day's run. A sync is a snapshot of upstream, so an older open sync PR is never the right thing to merge — it is noise that hides whether anything is genuinely waiting. The sync now closes what it supersedes. Branch protection still needs moving in the same direction and cannot be done from a commit: main requires no PR, no approvals and no checks, while master carries the five checks that can never run there. The settings change is proposed separately. * ci: require an admin's approval before anything reaches the live branch main is where work lands and where Code Quality decides; promote-to-live then moves master to whatever passed, and every app reads master directly. An approval on main is therefore the last human judgement before a change is served to wallets in the field — and until now main required no review at all. One approval, from either admin. Requiring two would mean two of two, which stalls whenever one of them is the author.
126 lines
4.5 KiB
YAML
126 lines
4.5 KiB
YAML
name: Sync from Nova Base
|
|
|
|
on:
|
|
# Run daily at 6:00 AM UTC
|
|
schedule:
|
|
- cron: '0 6 * * *'
|
|
|
|
# Allow manual trigger
|
|
workflow_dispatch:
|
|
inputs:
|
|
force_update:
|
|
description: 'Force update even if no changes'
|
|
required: false
|
|
default: 'false'
|
|
type: boolean
|
|
|
|
jobs:
|
|
sync:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
submodules: recursive
|
|
fetch-depth: 0
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Update nova-base submodule to latest
|
|
run: |
|
|
cd nova-base
|
|
git fetch origin master
|
|
git checkout origin/master
|
|
cd ..
|
|
echo "NOVA_COMMIT=$(cd nova-base && git rev-parse --short HEAD)" >> $GITHUB_ENV
|
|
|
|
- name: Check for changes in nova-base
|
|
id: check_changes
|
|
run: |
|
|
if git diff --quiet nova-base; then
|
|
echo "has_changes=false" >> $GITHUB_OUTPUT
|
|
echo "No changes in nova-base"
|
|
else
|
|
echo "has_changes=true" >> $GITHUB_OUTPUT
|
|
echo "Changes detected in nova-base"
|
|
fi
|
|
|
|
- name: Set up Python
|
|
if: steps.check_changes.outputs.has_changes == 'true' || inputs.force_update == 'true'
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Run sync script
|
|
if: steps.check_changes.outputs.has_changes == 'true' || inputs.force_update == 'true'
|
|
run: |
|
|
python scripts/sync_from_nova.py
|
|
|
|
- name: Check for output changes
|
|
if: steps.check_changes.outputs.has_changes == 'true' || inputs.force_update == 'true'
|
|
id: check_output
|
|
run: |
|
|
if git diff --quiet chains/ xcm/ icons/; then
|
|
echo "output_changed=false" >> $GITHUB_OUTPUT
|
|
echo "No output changes after sync"
|
|
else
|
|
echo "output_changed=true" >> $GITHUB_OUTPUT
|
|
echo "Output files changed"
|
|
git diff --stat chains/ xcm/ icons/
|
|
fi
|
|
|
|
- name: Create Pull Request
|
|
if: steps.check_output.outputs.output_changed == 'true'
|
|
uses: peter-evans/create-pull-request@v6
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
commit-message: "chore: sync from nova-base (${{ env.NOVA_COMMIT }})"
|
|
title: "🔄 Sync from Nova Base"
|
|
body: |
|
|
## Automated Nova Base Sync
|
|
|
|
This PR syncs the latest changes from [nova-utils](https://github.com/novasamatech/nova-utils).
|
|
|
|
**Nova commit:** `${{ env.NOVA_COMMIT }}`
|
|
|
|
### Changes included:
|
|
- Updated chain configurations
|
|
- Updated XCM transfer configs
|
|
- Updated icons
|
|
|
|
---
|
|
*This PR was automatically created by the sync workflow.*
|
|
branch: sync/nova-base-${{ env.NOVA_COMMIT }}
|
|
delete-branch: true
|
|
labels: |
|
|
automated
|
|
sync
|
|
dependencies
|
|
|
|
# Each daily run opens a new sync PR. Nothing closed the previous one, so they
|
|
# accumulated: 31 branches spanning 2026-02-10 to 2026-08-08 were cleared out by
|
|
# hand on 2026-08-11, every one of them superseded by the next day's run.
|
|
#
|
|
# A sync is a snapshot of upstream. The newest one contains everything the older
|
|
# ones did, so an older open sync PR is never the right thing to merge — it is
|
|
# noise that hides whether anything is genuinely waiting for review.
|
|
- name: Close superseded sync PRs
|
|
if: steps.check_output.outputs.output_changed == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
KEEP: sync/nova-base-${{ env.NOVA_COMMIT }}
|
|
run: |
|
|
gh pr list --repo "$GITHUB_REPOSITORY" --state open --label sync \
|
|
--json number,headRefName --jq '.[] | @base64' | while read -r row; do
|
|
decoded=$(echo "$row" | base64 -d)
|
|
NUM=$(echo "$decoded" | python3 -c 'import json,sys; print(json.load(sys.stdin)["number"])')
|
|
HEAD=$(echo "$decoded" | python3 -c 'import json,sys; print(json.load(sys.stdin)["headRefName"])')
|
|
[ "$HEAD" = "$KEEP" ] && continue
|
|
echo "Closing #$NUM ($HEAD) — superseded by $KEEP"
|
|
gh pr close "$NUM" --repo "$GITHUB_REPOSITORY" --delete-branch \
|
|
--comment "Superseded by \`$KEEP\`. A sync is a snapshot of upstream, so the newer one contains everything this did."
|
|
done
|