Conversation
…l merged Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| echo "Changes staged for commit:" | ||
| git diff --staged --stat | ||
| echo "" | ||
| BRANCH="sync/gh-aw-${{ steps.resolve-ref.outputs.resolved_ref }}" |
| echo "Changes staged for commit:" | ||
| git diff --staged --stat | ||
| echo "" | ||
| BRANCH="sync/gh-aw-${{ steps.resolve-ref.outputs.resolved_ref }}" |
| git push origin "$BRANCH" | ||
| gh pr create \ | ||
| --title "$COMMIT_MSG" \ | ||
| --body "Automated sync of actions from [gh-aw](https://github.com/github/gh-aw) at \`${{ steps.resolve-ref.outputs.resolved_ref }}\`." \ |
| - name: Poll pull request until merged | ||
| if: steps.create-pr.outputs.changed == 'true' | ||
| run: | | ||
| echo "::group::Polling PR #${{ steps.create-pr.outputs.pr_number }}" |
| if: steps.create-pr.outputs.changed == 'true' | ||
| run: | | ||
| echo "::group::Polling PR #${{ steps.create-pr.outputs.pr_number }}" | ||
| PR_NUMBER="${{ steps.create-pr.outputs.pr_number }}" |
There was a problem hiding this comment.
Pull request overview
This PR changes the sync-actions GitHub Actions workflow to sync action files by opening a pull request (instead of pushing directly to main), allowing review and gating before changes land.
Changes:
- Adds a
workflow_calloutput (pr_number) so callers can link to the created PR (or detect “no changes”). - Creates a new branch, pushes it, opens a PR to
main, and polls until the PR is merged (or times out / is closed). - Updates job permissions to allow PR creation and updates the tag-creation condition to the renamed step id.
Comments suppressed due to low confidence (1)
.github/workflows/sync-actions.yml:332
- After switching to a PR-based flow, the tag is still created from the local checkout in
gh-aw-actions, which at this point is on the PR branch (notmain). If the PR is merged with a merge commit or squash merge, the tag will point to a commit that may not exist onmain. After the PR is merged, fetch/checkoutorigin/main(or tag the PR’smergeCommitSHA viagh pr view) so tags always reference the commit actually landed onmain.
if: steps.resolve-ref.outputs.should_create_tag == 'true' && steps.create-pr.outputs.changed == 'true'
run: |
echo "::group::Creating Tag"
cd gh-aw-actions
TAG="${{ steps.resolve-ref.outputs.raw_ref }}"
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
| echo "Changes staged for commit:" | ||
| git diff --staged --stat | ||
| echo "" | ||
| BRANCH="sync/gh-aw-${{ steps.resolve-ref.outputs.resolved_ref }}" |
There was a problem hiding this comment.
BRANCH is derived from resolved_ref, but when the input is latest, resolved_ref comes from the upstream release tag name (which can contain characters that are not valid/safe in git ref names, e.g. slashes). This can make git checkout -b fail or create surprising branch paths. Consider sanitizing resolved_ref for use in branch names (e.g., replace non [A-Za-z0-9._-] with -), or use a stable safe identifier like the resolved commit SHA in the branch name.
| BRANCH="sync/gh-aw-${{ steps.resolve-ref.outputs.resolved_ref }}" | |
| SAFE_REF="$(printf '%s\n' "${{ steps.resolve-ref.outputs.resolved_ref }}" | sed -E 's/[^A-Za-z0-9._-]+/-/g')" | |
| BRANCH="sync/gh-aw-$SAFE_REF" |
| BRANCH="sync/gh-aw-${{ steps.resolve-ref.outputs.resolved_ref }}" | ||
| git checkout -b "$BRANCH" | ||
| COMMIT_MSG="chore: sync actions from gh-aw@${{ steps.resolve-ref.outputs.resolved_ref }}" | ||
| git commit -m "$COMMIT_MSG" | ||
| git push origin main | ||
| git push origin "$BRANCH" |
There was a problem hiding this comment.
The branch name sync/gh-aw-<resolved_ref> is likely to collide across reruns for the same ref. If the previous remote branch wasn't deleted (or was merged via squash), git push origin "$BRANCH" can be rejected as a non-fast-forward, causing the workflow to fail unexpectedly. Consider making the branch name unique per run (e.g., include ${{ github.run_id }}) or explicitly force-updating / deleting the remote branch before pushing.
sync-actions.ymlwas pushing synced action files directly tomain. This changes the flow to open a PR and block until it merges (or times out), enabling review before changes land.Changes
sync/gh-aw-<resolved_ref>and a PR is opened againstmainviagh pr createpr_numberoutput – exposed as aworkflow_calloutput so callers can reference or link the created PR; empty when there are no changes to syncpull-requests: writeto the jobcreate-pr)