repo-sync.yml

name: Repo Sync

# Syncs main between github/docs and github/docs-internal so public docs stay current
# and sensitive work stays private. Mechanics: https://github.com/repo-sync/repo-sync#how-it-works

on:
  workflow_dispatch:
  schedule:
    - cron: '20 14-23/3 * * 1-5'

permissions:
  contents: write
  pull-requests: write

jobs:
  repo-sync:
    if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
    name: Repo Sync
    runs-on: ubuntu-latest
    steps:
      - name: Check out repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Sync repo to branch
        env:
          SOURCE_REPO: https://${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}@github.com/github/${{ github.repository == 'github/docs-internal' && 'docs' || 'docs-internal' }}.git
          SOURCE_BRANCH: main
          DESTINATION_BRANCH: repo-sync
          GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}
        run: |
          set -euo pipefail

          : "${GH_TOKEN:?DOCS_BOT_PAT_REPO_SYNC is empty}"
          : "${SOURCE_REPO:?SOURCE_REPO is empty}"
          : "${SOURCE_BRANCH:?SOURCE_BRANCH is empty}"
          : "${DESTINATION_BRANCH:?DESTINATION_BRANCH is empty}"

          git config --unset-all http."https://github.com/".extraheader || true

          git remote remove tmp_upstream 2>/dev/null || true
          trap 'git remote remove tmp_upstream 2>/dev/null || true' EXIT

          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git remote add tmp_upstream "${SOURCE_REPO}"

          git fetch tmp_upstream --quiet
          git push origin "refs/remotes/tmp_upstream/${SOURCE_BRANCH}:refs/heads/${DESTINATION_BRANCH}" --force

      - name: Ship pull request
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
        with:
          github-token: ${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}
          result-encoding: string
          script: |
            const { owner, repo } = context.repo
            const head = 'github:repo-sync'
            const base = 'main'

            async function closePullRequest(prNumber) {
              console.log('Closing pull request', prNumber)
              await github.rest.pulls.update({
                owner,
                repo,
                pull_number: prNumber,
                state: 'closed'
              })
              // Let close failures fail the workflow.
              console.log('Closed pull request', prNumber)
            }

            console.log('Closing any existing pull requests')
            const { data: existingPulls } = await github.rest.pulls.list({ owner, repo, head, base })
            if (existingPulls.length) {
              console.log('Found existing pull requests', existingPulls.map(pull => pull.number))
              for (const pull of existingPulls) {
                await closePullRequest(pull.number)
              }
              console.log('Closed existing pull requests')
            }

            try {
              const { data } = await github.rest.repos.compareCommits({
                owner,
                repo,
                head,
                base,
              })
              const { files } = data
              console.log(`File changes between ${head} and ${base}:`, files)
              if (!files.length) {
                console.log('No files changed, bailing')
                return
              }
            } catch (err) {
              console.error(`Unable to compute the files difference between ${head} and ${base}`, err.message)
            }

            console.log('Creating a new pull request')
            const body = `
            This is an automated pull request to sync changes between the public and private repos.
            Our bot will merge this pull request automatically.
            To preserve continuity across repos, _do not squash_ this pull request.
            `
            let pull, pull_number
            try {
              const response = await github.rest.pulls.create({
                owner,
                repo,
                head,
                base,
                title: 'Repo sync',
                body,
              })
              pull = response.data
              pull_number = pull.number
              console.log('Created pull request successfully', pull.html_url)
            } catch (err) {
              // Don't alert on "No commits" or on the "same head_sha" error from over 100 PRs with one head.
              if (err.message?.includes('No commits') || err.message?.includes('same head_sha')) {
                console.log(err.message)
                return
              }
              throw err
            }

            console.log('Locking conversations to prevent spam')
            try {
              await github.rest.issues.lock({
                ...context.repo,
                issue_number: pull_number,
                lock_reason: 'spam'
              })
              console.log('Locked the pull request to prevent spam')
            } catch (error) {
              console.error('Failed to lock the pull request.', error)
              // Lock failures must not fail the sync.
            }

            console.log('Counting files changed')
            const { data: prFiles } = await github.rest.pulls.listFiles({ owner, repo, pull_number })
            if (prFiles.length) {
              console.log(prFiles.length, 'files have changed')
            } else {
              console.log('No files changed, closing')
              await closePullRequest(pull_number)
              return
            }

            console.log('Checking for merge conflicts')
            if (pull.mergeable_state === 'dirty') {
              console.log('Pull request has a conflict', pull.html_url)
              await closePullRequest(pull_number)
              throw new Error('Pull request has a conflict, please resolve manually')
            }
            console.log('No detected merge conflicts')

            console.log('Merging the pull request')
            // merge_method: merge keeps merge commits; retry each minute for up to 15 minutes for checks.
            const maxAttempts = 15
            const delay = 60_000
            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
              try {
                await github.rest.pulls.merge({
                  owner,
                  repo,
                  pull_number,
                  merge_method: 'merge',
                })
                console.log('Merged the pull request successfully')
                break
              } catch (mergeError) {
                const msg = mergeError.message || mergeError.response?.data?.message || ''
                const isRuleViolation = mergeError.status === 405 &&
                  msg.includes('Repository rule violations')
                if (!isRuleViolation || attempt === maxAttempts) {
                  throw mergeError
                }
                console.log(`Merge blocked by required checks (attempt ${attempt}/${maxAttempts}), retrying in 60s...`)
                await new Promise(resolve => setTimeout(resolve, delay))
              }
            }

      - uses: ./.github/actions/create-workflow-failure-issue
        id: create-failure-issue
        if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
        with:
          token: ${{ secrets.DOCS_BOT_PAT_BASE }}

      - uses: ./.github/actions/slack-alert
        if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
        with:
          slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
          issue_url: ${{ steps.create-failure-issue.outputs.issue_url }}