community/.github/workflows/org-management.yml at main · cloudfoundry/community · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: 'Sync Github Organization Settings'
on:
  push:
    branches:
      - 'main'
    paths:
      - 'orgs/*'
      - 'toc/TOC.md'
      - 'toc/working-groups/*.md'
      - '.github/workflows/org-management.yml'
  schedule:
    - cron: '0 */12 * * *'

jobs:
  peribolos:
    runs-on: ubuntu-latest
    concurrency:
      group: peribolos
    services:
      ghproxy:
        image: rkoster/ghproxy
        options: >-
          --mount type=bind,source=/etc/passwd,target=/etc/passwd,readonly
          --mount type=bind,source=/etc/group,target=/etc/group,readonly
        ports:
          - 8888:8888
        volumes:
          - ${{ github.workspace }}/ghproxy-cache:/cache
    steps:
      - name: ghproxy-cache
        uses: actions/cache@v4
        with:
          path: ${{ github.workspace }}/ghproxy-cache
          key: ghproxy-cache-${{ github.run_number }}
          restore-keys: |
            ghproxy-cache-
      - uses: actions/checkout@v5
        with:
          path: community
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version-file: "community/orgs/pyproject.toml"
      - uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
      - name: Generate github org configuration
        working-directory: ./community/orgs
        run: |
          uv run --no-dev python -m org_management -o ../../orgs.out.yml -b ../../branchprotection.out.yml
      - name: write github private key
        run: |
          echo "${GH_PRIVATE_KEY}" > private_key
          echo "${GH_TOKEN}" > token
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          GH_PRIVATE_KEY: ${{ secrets.GH_PRIVATE_KEY }}
      - name: peribolos
        id: peribolos
        uses: docker://gcr.io/k8s-prow/peribolos
        with:
          entrypoint: /ko-app/peribolos
          args: >-
            --confirm=true
            --github-endpoint http://ghproxy:8888
            --required-admins=thelinuxfoundation
            --min-admins=5
            --github-app-id=${{ secrets.GH_APP_ID }}
            --github-app-private-key-path=private_key
            --require-self=false
            --config-path=orgs.out.yml
            --fix-org
            --fix-org-members
            --fix-repos
            --fix-teams
            --fix-team-members
            --fix-team-repos
            --allow-repo-archival
  branchprotector:
    needs: peribolos
    runs-on: ubuntu-latest
    concurrency:
      group: peribolos
    services:
      ghproxy:
        image: rkoster/ghproxy
        options: >-
          --mount type=bind,source=/etc/passwd,target=/etc/passwd,readonly
          --mount type=bind,source=/etc/group,target=/etc/group,readonly
        ports:
          - 8888:8888
        volumes:
          - ${{ github.workspace }}/ghproxy-cache:/cache
    steps:
      - name: ghproxy-cache
        uses: actions/cache@v4
        with:
          path: ${{ github.workspace }}/ghproxy-cache
          key: ghproxy-cache-${{ github.run_number }}
          restore-keys: |
            ghproxy-cache-
      - uses: actions/checkout@v5
        with:
          path: community
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version-file: "community/orgs/pyproject.toml"
      - uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
      - name: Generate github org configuration
        working-directory: ./community/orgs
        run: |
          uv run --no-dev python -m org_management -o ../../orgs.out.yml -b ../../branchprotection.out.yml
      - name: write github private key
        run: |
          echo "${GH_PRIVATE_KEY}" > private_key
          echo "${GH_TOKEN}" > token
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          GH_PRIVATE_KEY: ${{ secrets.GH_PRIVATE_KEY }}
      - name: branchprotector
        id: branchprotector
        uses: docker://gcr.io/k8s-prow/branchprotector
        with:
          args: >-
            --confirm=true
            --github-endpoint http://ghproxy:8888
            --github-app-id=${{ secrets.GH_APP_ID }}
            --github-app-private-key-path=private_key
            --config-path=branchprotection.out.yml