docs/.github/workflows/sync-audit-logs.yml

name: Sync Audit Log data

# **What it does**: This updates our Audit Logs schema.
# **Why we have it**: We want our Audit Logs up to date.
# **Who does it impact**: Docs engineering, people reading Audit Logs.

on:
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

# **IMPORTANT:** Do not change the FREEZE environment variable set here!
# This workflow runs on a recurring basis. To temporarily disable it (e.g.,
# during a docs deployment freeze), add an Actions Secret to the repo settings
# called `FREEZE` with a value of `true`. To re-enable Audit Logs updates, simply
# delete that Secret from the repo settings. The environment variable here
# will duplicate that Secret's value for later evaluation.
env:
  FREEZE: ${{ secrets.FREEZE }}

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
  cancel-in-progress: true

jobs:
  update_audit_logs_files:
    if: github.repository == 'github/docs-internal'
    runs-on: ubuntu-latest
    steps:
      - if: ${{ env.FREEZE == 'true' }}
        run: |
          echo 'The repo is currently frozen! Exiting this workflow.'
          exit 1 # prevents further steps from running

      - name: Checkout
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab

      - uses: ./.github/actions/node-npm-setup

      - name: Run updater script
        env:
          # need to use a token from a user with access to github/audit-log-allowlists for this step
          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_WRITEORG_PROJECT }}
        run: |
          src/audit-logs/scripts/sync.js

      - name: Check if changes exist
        id: changes-exist
        run: |
          # If nothing to commit, exit now. It's fine. No orphans.
          changes=$(git diff --name-only | wc -l)
          untracked=$(git status --untracked-files --short | wc -l)
          if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then
            echo "There are no changes to commit after running src/audit-logs/scripts/sync.js. Exiting..."
            echo "CHANGES_EXIST=false" >> "$GITHUB_OUTPUT"
            exit 0
          else
            echo "CHANGES_EXIST=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Create pull request
        if: ${{ steps.changes-exist.outputs.CHANGES_EXIST == 'true' }}
        id: create-pull-request
        uses: peter-evans/create-pull-request@5b4a9f6a9e2af26e5f02351490b90d01eb8ec1e5 # pin @v5.0.0
        env:
          # Disable pre-commit hooks; they don't play nicely here
          HUSKY: '0'
        with:
          # Need to use a token with repo and workflow scopes for this step.
          # Token should be a PAT because actions performed with GITHUB_TOKEN
          # don't trigger other workflows and this action force pushes updates
          # from the default branch.
          token: ${{ secrets.DOCS_BOT_PAT_WORKFLOW }}
          commit-message: 'Update Audit Logs data files'
          title: Audit Logs schema update
          body:
            "Hello! Some Audit Logs data in github/audit-log-allowlists was updated recently. This PR
            syncs up the Audit Logs data in this repo.\n\n
            If CI passes, this PR will be auto-merged. :green_heart:\n\n
            If CI does not pass or other problems arise, contact #docs-engineering on slack."
          branch: audit-logs-schema-update

      - name: Enable GitHub auto-merge
        if: ${{ steps.create-pull-request.outputs.pull-request-number }}
        env:
          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_READPUBLICKEY }}
          AUTOMERGE_PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
        run: node .github/actions-scripts/enable-automerge.js

      - if: ${{ failure() && env.FREEZE != 'true'}}
        name: Delete remote branch (if previous steps failed)
        uses: dawidd6/action-delete-branch@47743101a121ad657031e6704086271ca81b1911
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          branches: audit-logs-schema-update

      - if: ${{ steps.create-pull-request.outputs.pull-request-number }}
        name: Approve
        uses: juliangruber/approve-pull-request-action@dcc4effb325c0b503408619918d56e40653dcc91
        with:
          github-token: ${{ secrets.DOCUBOT_REPO_PAT }}
          number: ${{ steps.create-pull-request.outputs.pull-request-number }}

      # - name: Send Slack notification if workflow fails
      #   uses: someimportantcompany/github-actions-slack-message@1d367080235edfa53df415bd8e0bbab480f29bad
      #   if: ${{ failure() && env.FREEZE != 'true' }}
      #   with:
      #     channel: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
      #     bot-token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
      #     color: failure
      #     text: The last sync-audit-logs run for ${{github.repository}} failed. See https://github.com/${{github.repository}}/actions/workflows/sync-audit-logs.yml