Radius.Security/v0.1.0 #29
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json | |
| --- | |
| name: Notify Radius | |
| # Fires a `repository_dispatch` event to radius-project/radius after a stable | |
| # release, or as an edge fallback for a unit that has no stable release yet. | |
| # | |
| # This is the resource-types-contrib side of the "sync default resource types | |
| # without a fake Go module" design (radius PR #12236), Phase A. It adopts the | |
| # hybrid of Option 3 (pinned git-ref) and Option 6 (automated, Dependabot-like | |
| # PR sync), with the per-unit variant: | |
| # | |
| # * Option 3 (pinned git-ref): the dispatch carries an immutable stable | |
| # release tag, or a pushed commit SHA until the affected unit has its first | |
| # stable release. Radius records that exact revision in | |
| # `deploy/manifest/defaults.yaml`. | |
| # * Option 6 (automated PR sync): Radius's contrib-update-resource-types.yaml | |
| # turns the dispatch into a reviewable `bot/update-resource-types` PR that | |
| # runs `make update-resource-types` / `make update-recipe-packs`, surfacing | |
| # the full YAML diff and the drift check + CI on every bump. | |
| # * Per-unit variant: the payload lists exactly the units this event affected, | |
| # so Radius advances only those instead of re-vendoring everything. The two | |
| # unit kinds match the two pin sections Radius keeps in defaults.yaml | |
| # (radius PR #12567): | |
| # - `namespaces` -> `resourceTypes[]`, the `Radius.<Category>` manifests | |
| # that are copied into the Radius repo. | |
| # - `recipe_packs` -> `recipePacks[]`, the packs under `recipe-packs/`. | |
| # Radius pins these but never vendors them; its deploy | |
| # workflows fetch the pack Bicep from here at deploy | |
| # time, so the pin records which revision they target. | |
| # | |
| # Stable releases are authoritative. Before a namespace or recipe pack has a | |
| # stable release, relevant pushes to `main` keep its Radius pin on edge. Once a | |
| # stable tag exists for that unit, pushes are ignored and only stable releases | |
| # can advance it. Prereleases never notify Radius. | |
| # | |
| # End-to-end flow: | |
| # 1. This workflow computes the per-unit payload and fires | |
| # repository_dispatch (event-type `resource-types-contrib-updated`). | |
| # 2. Radius's contrib-update-resource-types.yaml receives it and opens/refreshes | |
| # a PR that re-runs the manifest copy and the pin rewrite for the pinned ref. | |
| # 3. A maintainer reviews the YAML diff and merges the PR. | |
| # | |
| # Note: Radius only advances entries it already registers -- resource types | |
| # listed in its deploy/manifest/defaults.yaml `defaultRegistration`, and packs | |
| # listed under `recipePacks`. A namespace or pack added here but not registered | |
| # there produces a dispatch with no effective changes and no PR. | |
| # | |
| # See the design note in the radius repo: | |
| # eng/design-notes/extensibility/2026-06-resource-types-sync-without-fake-go-module.md | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "**/*.yaml" | |
| - "**/*.yml" | |
| - "*/*/recipes/**" | |
| - "!.github/**" | |
| - "!docs/**" | |
| - recipe-packs/** | |
| release: | |
| # Unlike `published`, `released` excludes prereleases. | |
| types: | |
| - released | |
| permissions: {} | |
| concurrency: | |
| # Preserve every fallback push and serialize it with release notifications. | |
| # Separate event/ref groups could let an older edge run finish after a stable | |
| # release and overwrite the authoritative release pin. | |
| group: notify-radius | |
| queue: max | |
| jobs: | |
| dispatch: | |
| name: Notify radius-project/radius | |
| # Pushes are admitted only so the payload script can apply the per-unit edge | |
| # fallback. Release events must still be stable. | |
| if: >- | |
| github.repository == 'radius-project/resource-types-contrib' && | |
| ( | |
| github.event_name == 'push' || | |
| github.event.release.prerelease == false | |
| ) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| # Needed for checkout so the payload script can inspect the push diff and | |
| # stable tag series for each affected unit. | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: Compute sync payload | |
| # Stable releases resolve their tagged unit. Pushes resolve changed | |
| # units and retain only those with no stable release tag. | |
| id: payload | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| AFTER_SHA: ${{ github.sha }} | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| RELEASE_PRERELEASE: ${{ github.event.release.prerelease }} | |
| CONTRIB_REPO: ${{ github.repository }} | |
| ACTOR: ${{ github.actor }} | |
| run: ./.github/scripts/compute-radius-sync-payload.sh | |
| - name: Generate App Token | |
| # Uses a GitHub App token instead of a PAT so that the dispatch event | |
| # is sent with scoped, auditable credentials. The app must be installed | |
| # on the target repo (radius-project/radius) with contents:write to | |
| # trigger repository_dispatch. | |
| if: steps.payload.outputs.unit_count != '0' | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.RESOURCE_TYPES_BOT_CLIENT_ID }} | |
| private-key: ${{ secrets.RESOURCE_TYPES_BOT_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| repositories: | | |
| radius | |
| permission-metadata: read | |
| permission-contents: write | |
| - name: Send repository_dispatch to radius-project/radius | |
| # Fires the repository_dispatch event that Radius's | |
| # contrib-update-resource-types.yaml workflow listens for. The per-unit | |
| # client-payload (channel, immutable ref, and the affected namespaces | |
| # and recipe packs) is computed by the previous step. | |
| if: steps.payload.outputs.unit_count != '0' | |
| uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| repository: radius-project/radius | |
| event-type: resource-types-contrib-updated | |
| client-payload: ${{ steps.payload.outputs.payload }} | |
| - name: Summarize | |
| # Write a summary to the GitHub Actions UI for visibility. | |
| run: | | |
| { | |
| echo "## Notify radius-project/radius" | |
| echo "" | |
| echo "* Event: \`${{ github.event_name }}\`" | |
| echo "* Channel: \`${{ steps.payload.outputs.channel }}\`" | |
| echo "* Ref: \`${{ steps.payload.outputs.ref }}\`" | |
| echo "* Affected namespaces (${{ steps.payload.outputs.namespace_count }}): \`${{ steps.payload.outputs.affected }}\`" | |
| echo "* Affected recipe packs (${{ steps.payload.outputs.recipe_pack_count }}): \`${{ steps.payload.outputs.affected_recipe_packs }}\`" | |
| if [ "${{ steps.payload.outputs.unit_count }}" = "0" ]; then | |
| echo "" | |
| echo "_No dispatch sent (reason: \`${{ steps.payload.outputs.reason }}\`)._" | |
| else | |
| echo "* Event type: \`resource-types-contrib-updated\`" | |
| fi | |
| } >> "${GITHUB_STEP_SUMMARY}" |