mirror of
https://github.com/vercel/next.js.git
synced 2026-09-20 02:25:18 +08:00
Sebastian "Sebbie" Silbermann
4f37c39616
Gets rid of of all usages of the static `GH_TOKEN_PULL_REQUESTS` token that was issued for `vercel-release-bot`. We already create commits with `nextjs-bot`. `nextjs-bot` already had permissions to open PRs which is already being used by React sync.
83 lines
3.2 KiB
YAML
83 lines
3.2 KiB
YAML
name: Update React
|
|
|
|
on:
|
|
schedule:
|
|
# At 40 minutes past 16:00 on Mon, Tue, Wed, Thu, and Fri
|
|
# i.e. 30min past React nightlies: https://github.com/facebook/react/blob/941e1b4a0a81ca3d5f2ac6ef35682e2f8e96dae1/.github/workflows/runtime_prereleases_nightly.yml#L6
|
|
# TODO: automatically trigger on React release
|
|
- cron: 40 16 * * 1,2,3,4,5
|
|
# Allow manual runs
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'The version to update to. Uses latest Canary if omitted.'
|
|
required: false
|
|
|
|
env:
|
|
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
|
|
|
|
jobs:
|
|
create-pull-request:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# The built-in token is only used to read the facebook/react compare API
|
|
# for the changelog. Everything that writes to this repository
|
|
# authenticates as the release app instead.
|
|
contents: read
|
|
steps:
|
|
- name: Create GitHub App token
|
|
id: release-app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.RELEASE_GITHUB_APP_CLIENT_ID }}
|
|
private-key: ${{ secrets.RELEASE_GITHUB_APP_PRIVATE_KEY }}
|
|
owner: ${{ github.repository_owner }}
|
|
repositories: next.js
|
|
permission-contents: write
|
|
permission-pull-requests: write
|
|
|
|
- name: Get GitHub App user ID
|
|
id: release-app-user
|
|
run: |
|
|
user_id="$(gh api "/users/${{ steps.release-app-token.outputs.app-slug }}[bot]" --jq .id)"
|
|
echo "user-id=$user_id" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
GH_TOKEN: ${{ steps.release-app-token.outputs.token }}
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
# Commits made with the default `GITHUB_TOKEN` won't trigger workflows.
|
|
# See: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow
|
|
token: ${{ steps.release-app-token.outputs.token }}
|
|
persist-credentials: false
|
|
|
|
- name: Setup node
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version-file: .node-version
|
|
check-latest: true
|
|
package-manager-cache: false
|
|
|
|
- name: Setup corepack
|
|
run: |
|
|
npm i -g corepack@0.31
|
|
corepack enable
|
|
|
|
- name: Install dependencies
|
|
shell: bash
|
|
# Just need scripts/ but those dependencies are listed in the workspace root.
|
|
run: pnpm install --filter .
|
|
|
|
- name: Create Pull Request
|
|
shell: bash
|
|
run: pnpm sync-react --actor "${{ github.actor }}" --commit --create-pull --version "${{ inputs.version }}"
|
|
env:
|
|
# Only used to authenticate the facebook/react compare API request
|
|
# that builds the changelog, so it doesn't hit anonymous rate limits.
|
|
# The commits, branch, and Pull Request all use the app token below.
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
RELEASE_GITHUB_TOKEN: ${{ steps.release-app-token.outputs.token }}
|
|
RELEASE_GITHUB_APP_SLUG: ${{ steps.release-app-token.outputs.app-slug }}
|
|
RELEASE_GITHUB_APP_USER_ID: ${{ steps.release-app-user.outputs.user-id }}
|