01 - Org-Label-Sync #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 01 - Org-Label-Sync | |
| on: | |
| schedule: | |
| - cron: "0 0 * * *" | |
| workflow_dispatch: | |
| inputs: | |
| dry_run: | |
| description: "[TEST MODE] Preview label changes without applying them. Writes a preview changelog to the workflow summary." | |
| required: false | |
| type: boolean | |
| default: false | |
| delete_missing: | |
| description: "Delete all other labels that are not present in config" | |
| required: false | |
| type: boolean | |
| default: false | |
| delete_github_default_labels: | |
| description: "Delete Github default labels" | |
| required: false | |
| type: boolean | |
| default: true | |
| repositories: | |
| description: "[OPTIONAL] Config Override: Run workflow on this set of non-source repositories exclusively. Format: name, name2" | |
| required: false | |
| type: string | |
| label_replacements: | |
| description: "[OPTIONAL] Label Replacement: Define label replacements before their deletion. Format: old=new, old2=new2" | |
| required: false | |
| type: string | |
| permissions: | |
| contents: write | |
| jobs: | |
| automatic-settings: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| enabled: ${{ steps.settings.outputs.enabled }} | |
| delete_missing: ${{ steps.settings.outputs.delete_missing }} | |
| delete_github_default_labels: ${{ steps.settings.outputs.delete_github_default_labels }} | |
| label_replacements: ${{ steps.settings.outputs.label_replacements }} | |
| steps: | |
| - name: Check out latest default branch | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.event.repository.default_branch }} | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| - name: Load automatic sync settings | |
| id: settings | |
| run: node scripts/export-automatic-sync-settings.mjs | |
| refresh-config: | |
| needs: automatic-settings | |
| if: ${{ github.event_name != 'schedule' || needs.automatic-settings.outputs.enabled == 'true' }} | |
| uses: ./.github/workflows/02-config-label-sync.yml | |
| secrets: inherit | |
| sync-org: | |
| needs: [automatic-settings, refresh-config] | |
| # refresh-config is skipped on a scheduled run when automatic sync is disabled, and a | |
| # skipped dependency does not satisfy `needs`. Without this condition sync-org would | |
| # silently skip along with it, producing no changelog and no failure. Gate on | |
| # automatic-settings instead, and tolerate refresh-config being skipped. | |
| if: >- | |
| ${{ | |
| !cancelled() | |
| && needs.automatic-settings.result == 'success' | |
| && needs.refresh-config.result != 'failure' | |
| && (github.event_name != 'schedule' || needs.automatic-settings.outputs.enabled == 'true') | |
| }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out latest default branch | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.event.repository.default_branch }} | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| - name: Load properties | |
| id: properties | |
| env: | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| run: node scripts/export-properties.mjs | |
| - name: Resolve PAT auth token | |
| id: pat_auth | |
| if: ${{ steps.properties.outputs.auth_mode == 'pat' }} | |
| env: | |
| AUTH_MODE: pat | |
| PAT_TOKEN: ${{ secrets[steps.properties.outputs.pat_token_secret_name] }} | |
| run: node scripts/create-github-auth-token.mjs | |
| - name: Resolve GitHub App auth token | |
| id: app_auth | |
| if: ${{ steps.properties.outputs.auth_mode == 'githubApp' }} | |
| env: | |
| AUTH_MODE: githubApp | |
| GITHUB_APP_ID: ${{ secrets[steps.properties.outputs.github_app_id_secret_name] }} | |
| GITHUB_APP_PRIVATE_KEY: ${{ secrets[steps.properties.outputs.github_app_private_key_secret_name] }} | |
| GITHUB_APP_INSTALLATION_ID: ${{ secrets[steps.properties.outputs.github_app_installation_id_secret_name] }} | |
| run: node scripts/create-github-auth-token.mjs | |
| - name: Validate updated config | |
| env: | |
| DELETE_GITHUB_DEFAULT_LABELS: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.delete_github_default_labels || inputs.delete_github_default_labels }} | |
| LABEL_REPLACEMENTS: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.label_replacements || inputs.label_replacements }} | |
| run: node scripts/sync-labels.mjs --validate-only | |
| - name: Sync labels across the organization | |
| env: | |
| ORG_NAME: ${{ steps.properties.outputs.organization }} | |
| DRY_RUN: ${{ inputs.dry_run }} | |
| DELETE_MISSING: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.delete_missing || inputs.delete_missing }} | |
| DELETE_GITHUB_DEFAULT_LABELS: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.delete_github_default_labels || inputs.delete_github_default_labels }} | |
| TARGET_REPOSITORIES: ${{ inputs.repositories }} | |
| LABEL_REPLACEMENTS: ${{ github.event_name == 'schedule' && needs.automatic-settings.outputs.label_replacements || inputs.label_replacements }} | |
| run: node scripts/sync-labels.mjs |