Skip to content

feat(workflow): implement SDK parity dispatch logic #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
salihdev0 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(workflow): implement SDK parity dispatch logic #26

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 62 additions & 2 deletions .github/workflows/sdk-parity-dispatch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,65 @@ on:

jobs:
parity-dispatch:
uses: tapsilat/tapsilat-sdk-parity/.github/workflows/reusable-sdk-parity-dispatch.yml@v1
secrets: inherit
runs-on: ubuntu-latest
permissions:
contents: read
env:
PARITY_MAIN_REPO: ${{ secrets.PARITY_MAIN_REPO }}
# Replace with an immutable parity release tag once the private composite action is published.
PARITY_MAIN_REF: main
Comment on lines +22 to +24
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PARITY_MAIN_REF is set to main, which is mutable and makes the workflow non-reproducible (and increases supply-chain risk if the parity repo changes unexpectedly). Prefer pinning to an immutable tag or commit SHA once available, and/or require an explicit version input/secret.

Copilot uses AI. Check for mistakes.

steps:
- name: Preflight fork PR gate
id: preflight
shell: bash
run: |
should_skip=false
skip_reason=""

if [[ "${{ github.event_name }}" == "pull_request" ]]; then
if [[ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then
should_skip=true
skip_reason="Fork pull requests do not receive parity secrets, so dispatch is skipped safely."
fi
Comment on lines +34 to +38
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Preflight only skips fork PRs, but Dependabot PRs also do not receive repository secrets by default. This job will likely fail on Dependabot updates when PARITY_APP_ID/PARITY_APP_PRIVATE_KEY are unavailable. Consider extending preflight to skip when github.actor == 'dependabot[bot]' (or more generally when required secrets evaluate to empty) and write the same skip summary.

Copilot uses AI. Check for mistakes.
fi

{
echo "should_skip=$should_skip"
echo "skip_reason=$skip_reason"
} >> "$GITHUB_OUTPUT"

- name: Write skip summary
if: steps.preflight.outputs.should_skip == 'true'
run: |
{
echo "# SDK Parity Dispatch"
echo
echo "- Status: skipped"
echo "- Reason: ${{ steps.preflight.outputs.skip_reason }}"
} >> "$GITHUB_STEP_SUMMARY"

- name: Create GitHub App token
if: steps.preflight.outputs.should_skip != 'true'
id: app_token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ secrets.PARITY_APP_ID }}
private-key: ${{ secrets.PARITY_APP_PRIVATE_KEY }}
owner: ${{ github.repository_owner }}

- name: Checkout parity main repo
if: steps.preflight.outputs.should_skip != 'true'
uses: actions/checkout@v4
with:
token: ${{ steps.app_token.outputs.token }}
repository: ${{ env.PARITY_MAIN_REPO }}
ref: ${{ env.PARITY_MAIN_REF }}
path: parity-main
Comment on lines +66 to +72
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout persists the provided token in the git config by default. Since this uses an App token, set persist-credentials: false (or otherwise ensure credentials are removed) to reduce the chance of the token being reused/exposed by subsequent steps or composite actions.

Copilot uses AI. Check for mistakes.

- name: Dispatch via private parity action
if: steps.preflight.outputs.should_skip != 'true'
uses: ./parity-main/.github/actions/sdk-parity-dispatch
with:
app_token: ${{ steps.app_token.outputs.token }}
parity_repo: ${{ env.PARITY_MAIN_REPO }}
Loading