Skip to content

Commit fc321d4

Browse files
jrfnljrfnl
committed
GH Actions: split "update-cacert" workflow
GitHub has the annoying habit of disabling workflows with a cron job after two months if the repo doesn't see any activity. As this repo has been semi-dormant over the past year, this may become more regularly the case for this repo and this creates the following problem: * If the same workflow is used for both the cron job as well as the push/pull_request CI checks... * ... and a repo doesn't have any activity in two months time... * ... the workflow gets disabled... * ... which then also means that CI checks will no longer be run for new PRs.... * ... which means new PRs can't be merged as (in most cases) the repo has branch protection in place and requires that the CI checks pass before a PR can be merged. This commit basically changes the original workflow to a reusable workflow and then creates two new workflows, with different `on` targets, which each trigger the reusable workflow. * One workflow will be triggered via `cron`. * One workflow will have all the other triggers (`push`/`pull_request`/`workflow_dispatch`). This way, if the cron job workflow gets disabled, the workflow which is used for the other triggers will continue to function. The downside of this, is that it may go unnoticed that the cron job has stopped running, but so be it.
1 parent 0d25608 commit fc321d4

File tree

3 files changed

+105
-81
lines changed

3 files changed

+105
-81
lines changed

‎.github/workflows/reusable-update-cacert.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Certificates
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
certificate-check:
8+
name: "Check for updated certificate bundle"
9+
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Determine branches to use
13+
id: branches
14+
env:
15+
HEAD_REF: ${{ github.head_ref }}
16+
PR_NUM: ${{ github.event.pull_request.number }}
17+
run: |
18+
if [[ "${{ github.event_name }}" == 'schedule' ]]; then
19+
echo "BASE=develop" >> "$GITHUB_OUTPUT"
20+
echo "PR_BRANCH=feature/auto-update-cacert" >> "$GITHUB_OUTPUT"
21+
elif [[ "${{ github.event_name }}" == 'push' ]]; then
22+
# Pull requests should always go to develop, even when triggered via a push to stable.
23+
echo "BASE=develop" >> "$GITHUB_OUTPUT"
24+
echo "PR_BRANCH=feature/auto-update-cacert" >> "$GITHUB_OUTPUT"
25+
elif [[ $PR_NUM != '' ]]; then # = PR or manual (re-)run for a workflow triggered by a PR.
26+
echo "BASE=$HEAD_REF" >> "$GITHUB_OUTPUT"
27+
echo "PR_BRANCH=feature/auto-update-cacert-$PR_NUM" >> "$GITHUB_OUTPUT"
28+
else # = manual run.
29+
echo "BASE=$HEAD_REF" >> "$GITHUB_OUTPUT"
30+
echo "PR_BRANCH=feature/auto-update-cacert-misc" >> "$GITHUB_OUTPUT"
31+
fi
32+
33+
- name: Checkout code
34+
uses: actions/checkout@v5
35+
36+
- name: Restore etags cache for certificate files
37+
uses: actions/cache@v4
38+
with:
39+
path: certificates/etag-*.txt
40+
key: curl-etag-${{ hashFiles('certificates/cacert.pem') }}-${{ hashFiles('certificates/cacert.pem.sha256') }}
41+
restore-keys: |
42+
curl-etag-
43+
44+
- name: Get current certificate bundle if changed
45+
working-directory: ./certificates
46+
run: curl --etag-compare etag-cert.txt --etag-save etag-cert.txt --remote-name https://curl.se/ca/cacert.pem
47+
48+
- name: Get current SHA256 checksum file for the bundle if changed
49+
working-directory: ./certificates
50+
run: curl --etag-compare etag-sha.txt --etag-save etag-sha.txt --remote-name https://curl.se/ca/cacert.pem.sha256
51+
52+
- name: Verify the checksum of the downloaded bundle
53+
working-directory: ./certificates
54+
run: sha256sum --check cacert.pem.sha256
55+
56+
- name: "Debug info: Show git status"
57+
run: git status -vv --untracked=all
58+
59+
# http://man7.org/linux/man-pages/man1/date.1.html
60+
- name: "Get date"
61+
id: get-date
62+
run: echo "DATE=$(/bin/date -u "+%F")" >> "$GITHUB_OUTPUT"
63+
64+
- name: Create pull request
65+
uses: peter-evans/create-pull-request@v7
66+
with:
67+
base: ${{ steps.branches.outputs.BASE }}
68+
branch: ${{ steps.branches.outputs.PR_BRANCH }}
69+
delete-branch: true
70+
sign-commits: true
71+
commit-message: ":lock_with_ink_pen: Update certificate bundle"
72+
title: ":lock_with_ink_pen: Update certificate bundle"
73+
body: |
74+
Updated certificate bundle, last verified on ${{ steps.get-date.outputs.DATE }}.
75+
76+
Source: https://curl.se/docs/caextract.html
77+
78+
This PR is auto-generated by [create-pull-request](https://github.com/peter-evans/create-pull-request) using the `.github/workflows/update-cacert.yml` workflow.
79+
labels: |
80+
Type: enhancement
81+
reviewers: |
82+
jrfnl
83+
schlessera

‎.github/workflows/update-cacert-cron.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Certificates Cronjob
2+
3+
on:
4+
# Run every day at 4:20.
5+
schedule:
6+
- cron: '20 4 * * *'
7+
8+
# Cancels all previous workflow runs for the same branch that have not yet completed.
9+
concurrency:
10+
# The concurrency group contains the workflow name and the branch name.
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
certificate-check:
16+
# Don't run the cron job on forks.
17+
if: ${{ github.event.repository.fork == false }}
18+
19+
uses: ./.github/workflows/reusable-update-cacert.yml

‎.github/workflows/update-cacert.yml‎

Lines changed: 3 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
name: Certificates
22

33
on:
4-
# Run every day at 4:20.
5-
schedule:
6-
- cron: '20 4 * * *'
74
# Run on every push to `stable` and `develop`.
85
# Not using path selection here as it appears only the files in the last commit from the push are looked at.
96
push:
@@ -14,6 +11,8 @@ on:
1411
pull_request:
1512
paths:
1613
- '.github/workflows/update-cacert.yml'
14+
- '.github/workflows/update-cacert-cron.yml'
15+
- '.github/workflows/reusable-update-cacert.yml'
1716
- 'certificates/cacert.pem'
1817
- 'certificates/cacert.pem.sha256'
1918
# Also allow manually triggering the workflow.
@@ -27,81 +26,4 @@ concurrency:
2726

2827
jobs:
2928
certificate-check:
30-
name: "Check for updated certificate bundle"
31-
# Don't run the cron job on forks.
32-
if: ${{ github.event_name != 'schedule' || github.repository == 'WordPress/Requests' }}
33-
34-
runs-on: ubuntu-latest
35-
steps:
36-
- name: Determine branches to use
37-
id: branches
38-
env:
39-
HEAD_REF: ${{ github.head_ref }}
40-
PR_NUM: ${{ github.event.pull_request.number }}
41-
run: |
42-
if [[ "${{ github.event_name }}" == 'schedule' ]]; then
43-
echo "BASE=develop" >> "$GITHUB_OUTPUT"
44-
echo "PR_BRANCH=feature/auto-update-cacert" >> "$GITHUB_OUTPUT"
45-
elif [[ "${{ github.event_name }}" == 'push' ]]; then
46-
# Pull requests should always go to develop, even when triggered via a push to stable.
47-
echo "BASE=develop" >> "$GITHUB_OUTPUT"
48-
echo "PR_BRANCH=feature/auto-update-cacert" >> "$GITHUB_OUTPUT"
49-
elif [[ $PR_NUM != '' ]]; then # = PR or manual (re-)run for a workflow triggered by a PR.
50-
echo "BASE=$HEAD_REF" >> "$GITHUB_OUTPUT"
51-
echo "PR_BRANCH=feature/auto-update-cacert-$PR_NUM" >> "$GITHUB_OUTPUT"
52-
else # = manual run.
53-
echo "BASE=$HEAD_REF" >> "$GITHUB_OUTPUT"
54-
echo "PR_BRANCH=feature/auto-update-cacert-misc" >> "$GITHUB_OUTPUT"
55-
fi
56-
57-
- name: Checkout code
58-
uses: actions/checkout@v5
59-
60-
- name: Restore etags cache for certificate files
61-
uses: actions/cache@v4
62-
with:
63-
path: certificates/etag-*.txt
64-
key: curl-etag-${{ hashFiles('certificates/cacert.pem') }}-${{ hashFiles('certificates/cacert.pem.sha256') }}
65-
restore-keys: |
66-
curl-etag-
67-
68-
- name: Get current certificate bundle if changed
69-
working-directory: ./certificates
70-
run: curl --etag-compare etag-cert.txt --etag-save etag-cert.txt --remote-name https://curl.se/ca/cacert.pem
71-
72-
- name: Get current SHA256 checksum file for the bundle if changed
73-
working-directory: ./certificates
74-
run: curl --etag-compare etag-sha.txt --etag-save etag-sha.txt --remote-name https://curl.se/ca/cacert.pem.sha256
75-
76-
- name: Verify the checksum of the downloaded bundle
77-
working-directory: ./certificates
78-
run: sha256sum --check cacert.pem.sha256
79-
80-
- name: "Debug info: Show git status"
81-
run: git status -vv --untracked=all
82-
83-
# http://man7.org/linux/man-pages/man1/date.1.html
84-
- name: "Get date"
85-
id: get-date
86-
run: echo "DATE=$(/bin/date -u "+%F")" >> "$GITHUB_OUTPUT"
87-
88-
- name: Create pull request
89-
uses: peter-evans/create-pull-request@v7
90-
with:
91-
base: ${{ steps.branches.outputs.BASE }}
92-
branch: ${{ steps.branches.outputs.PR_BRANCH }}
93-
delete-branch: true
94-
sign-commits: true
95-
commit-message: ":lock_with_ink_pen: Update certificate bundle"
96-
title: ":lock_with_ink_pen: Update certificate bundle"
97-
body: |
98-
Updated certificate bundle, last verified on ${{ steps.get-date.outputs.DATE }}.
99-
100-
Source: https://curl.se/docs/caextract.html
101-
102-
This PR is auto-generated by [create-pull-request](https://github.com/peter-evans/create-pull-request) using the `.github/workflows/update-cacert.yml` workflow.
103-
labels: |
104-
Type: enhancement
105-
reviewers: |
106-
jrfnl
107-
schlessera
29+
uses: ./.github/workflows/reusable-update-cacert.yml

0 commit comments

Comments
 (0)