|
| 1 | +name: Audit Theme Repositories |
| 2 | + |
| 3 | +on: |
| 4 | + schedule: |
| 5 | + - cron: '17 3 1 * *' |
| 6 | + workflow_dispatch: |
| 7 | + |
| 8 | +permissions: |
| 9 | + contents: write |
| 10 | + pull-requests: write |
| 11 | + |
| 12 | +concurrency: |
| 13 | + group: audit-theme-repositories |
| 14 | + cancel-in-progress: false |
| 15 | + |
| 16 | +jobs: |
| 17 | + audit: |
| 18 | + runs-on: ubuntu-latest |
| 19 | + steps: |
| 20 | + - uses: actions/checkout@v6 |
| 21 | + |
| 22 | + - uses: actions/setup-node@v6 |
| 23 | + with: |
| 24 | + node-version: 24 |
| 25 | + cache: npm |
| 26 | + |
| 27 | + - run: npm ci |
| 28 | + |
| 29 | + - name: Audit published and archived theme repositories |
| 30 | + env: |
| 31 | + GITHUB_TOKEN: ${{ github.token }} |
| 32 | + RETIREMENT_REPORT: theme-repository-audit.md |
| 33 | + run: npm run audit:theme-repos |
| 34 | + |
| 35 | + - run: npm test |
| 36 | + - run: npm run build |
| 37 | + |
| 38 | + - name: Open repository audit review PR |
| 39 | + env: |
| 40 | + GH_TOKEN: ${{ secrets.AUDIT_PR_TOKEN || github.token }} |
| 41 | + shell: bash |
| 42 | + run: | |
| 43 | + if git diff --quiet -- src/content/themes; then |
| 44 | + echo "No theme archive or removal changes proposed." |
| 45 | + exit 0 |
| 46 | + fi |
| 47 | +
|
| 48 | + branch="automation/theme-repository-audit-$(date -u +%Y-%m)" |
| 49 | +
|
| 50 | + git config user.name "github-actions[bot]" |
| 51 | + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" |
| 52 | + git checkout -B "$branch" |
| 53 | + git add src/content/themes |
| 54 | + git commit -m "chore: propose theme repository audit changes" |
| 55 | + git fetch --no-tags --depth=1 origin "$branch:refs/remotes/origin/$branch" || true |
| 56 | + git push --force-with-lease origin "$branch" |
| 57 | +
|
| 58 | + manual_url="https://github.com/${GITHUB_REPOSITORY}/pull/new/${branch}" |
| 59 | + title="Review archived or unavailable theme repositories" |
| 60 | +
|
| 61 | + if pr_url="$(gh pr view "$branch" --json url --jq .url 2>/dev/null)"; then |
| 62 | + gh pr edit "$branch" \ |
| 63 | + --title "$title" \ |
| 64 | + --body-file theme-repository-audit.md |
| 65 | + echo "Updated repository audit PR: ${pr_url}" >> "$GITHUB_STEP_SUMMARY" |
| 66 | + else |
| 67 | + if pr_url="$(gh pr create \ |
| 68 | + --base main \ |
| 69 | + --head "$branch" \ |
| 70 | + --title "$title" \ |
| 71 | + --body-file theme-repository-audit.md 2>pr-create-error.txt)"; then |
| 72 | + echo "Created repository audit PR: ${pr_url}" >> "$GITHUB_STEP_SUMMARY" |
| 73 | + else |
| 74 | + echo "::warning::The audit branch was pushed, but GitHub refused to create the PR automatically." |
| 75 | + cat pr-create-error.txt |
| 76 | + { |
| 77 | + echo "Repository audit changes were pushed to \`${branch}\`, but the workflow token could not create the PR automatically." |
| 78 | + echo "" |
| 79 | + echo "Open it manually: ${manual_url}" |
| 80 | + echo "" |
| 81 | + echo "To allow automatic PR creation, enable **Settings > Actions > General > Workflow permissions > Allow GitHub Actions to create and approve pull requests**, or add an \`AUDIT_PR_TOKEN\` secret with permission to create pull requests." |
| 82 | + } >> "$GITHUB_STEP_SUMMARY" |
| 83 | + fi |
| 84 | + fi |
0 commit comments