Skip to content

ci(cmd-compile): use persist-credentials: false and env indirection #697

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joshtrichards wants to merge 2 commits into
base: master
Choose a base branch
from
+24 −11
Open

ci(cmd-compile): use persist-credentials: false and env indirection #697

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9fdbc74
ci(cmd-compile): use persist-credentials: false and env indirection
joshtrichards Apr 6, 2026
475b5ae
chore(cmd-compil): add suppressor
joshtrichards Apr 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 24 additions & 11 deletions workflow-templates/command-compile.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,8 +105,7 @@ jobs:
- name: Checkout ${{ needs.init.outputs.head_ref }}
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
# Needed to allow force push later
persist-credentials: true
persist-credentials: false
token: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env]
fetch-depth: 0
ref: ${{ needs.init.outputs.head_ref }}
Expand Down Expand Up @@ -134,23 +133,25 @@ jobs:

- name: Rebase to ${{ needs.init.outputs.base_ref }}
if: ${{ contains(needs.init.outputs.arg1, 'rebase') }}
env:
BASE_REF: ${{ needs.init.outputs.base_ref }}
run: |
git fetch origin '${{ needs.init.outputs.base_ref }}:${{ needs.init.outputs.base_ref }}'
git fetch origin "${BASE_REF}:${BASE_REF}"

# Start the rebase
git rebase 'origin/${{ needs.init.outputs.base_ref }}' || {
git rebase "origin/${BASE_REF}" || {
# Handle rebase conflicts in a loop
while [ -d .git/rebase-merge ] || [ -d .git/rebase-apply ]; do
echo "Handling rebase conflict..."

# Remove and checkout /dist and /js folders from the base branch
if [ -d "dist" ]; then
rm -rf dist
git checkout origin/${{ needs.init.outputs.base_ref }} -- dist/ 2>/dev/null || echo "No dist folder in base branch"
git checkout "origin/${BASE_REF}" -- dist/ 2>/dev/null || echo "No dist folder in base branch"
fi
if [ -d "js" ]; then
rm -rf js
git checkout origin/${{ needs.init.outputs.base_ref }} -- js/ 2>/dev/null || echo "No js folder in base branch"
git checkout "origin/${BASE_REF}" -- js/ 2>/dev/null || echo "No js folder in base branch"
fi

# Stage all changes
Expand Down Expand Up @@ -182,20 +183,26 @@ jobs:

- name: Commit default
if: ${{ !contains(needs.init.outputs.arg1, 'fixup') && !contains(needs.init.outputs.arg1, 'amend') }}
env:
GIT_PATH: ${{ needs.init.outputs.git_path }}
run: |
git add '${{ github.workspace }}${{ needs.init.outputs.git_path }}'
git add "${GITHUB_WORKSPACE}${GIT_PATH}"
git commit --signoff -m 'chore(assets): Recompile assets'

- name: Commit fixup
if: ${{ contains(needs.init.outputs.arg1, 'fixup') }}
env:
GIT_PATH: ${{ needs.init.outputs.git_path }}
run: |
git add '${{ github.workspace }}${{ needs.init.outputs.git_path }}'
git add "${GITHUB_WORKSPACE}${GIT_PATH}"
git commit --fixup=HEAD --signoff

- name: Commit amend
if: ${{ contains(needs.init.outputs.arg1, 'amend') }}
env:
GIT_PATH: ${{ needs.init.outputs.git_path }}
run: |
git add '${{ github.workspace }}${{ needs.init.outputs.git_path }}'
git add "${GITHUB_WORKSPACE}${GIT_PATH}"
git commit --amend --no-edit --signoff
# Remove any [skip ci] from the amended commit
git commit --amend -m "$(git log -1 --format='%B' | sed '/\[skip ci\]/d')"
Expand All @@ -204,13 +211,19 @@ jobs:
if: ${{ !contains(needs.init.outputs.arg1, 'rebase') && !contains(needs.init.outputs.arg1, 'amend') }}
env:
HEAD_REF: ${{ needs.init.outputs.head_ref }}
run: git push origin "$HEAD_REF"
BOT_TOKEN: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env]
run: |
git remote set-url origin "https://x-access-token:${BOT_TOKEN}@github.com/${{ github.repository }}.git"
git push origin "$HEAD_REF"

- name: Force push
if: ${{ contains(needs.init.outputs.arg1, 'rebase') || contains(needs.init.outputs.arg1, 'amend') }}
env:
HEAD_REF: ${{ needs.init.outputs.head_ref }}
run: git push --force-with-lease origin "$HEAD_REF"
BOT_TOKEN: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env]
run: |
git remote set-url origin "https://x-access-token:${BOT_TOKEN}@github.com/${{ github.repository }}.git"
git push --force-with-lease origin "$HEAD_REF"

- name: Add reaction on failure
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
Expand Down
Loading