stlc-sync.yml

name: Sync SDK repos

# Keeps the staging and production trunks in sync. Each job self-routes by
# repo + event, so this one file can live in both repos and only the right
# job runs. The notify job is eager-only (the poll covers it) and no-ops when
# its token isn't set. Tracking reseal in warp-server happens on its normal
# triggers (develop builds / manual dispatch of stlc-sync-tracking).
on:
  schedule:
    # back-sync poll: a cheap pure-git check, twice hourly so an unsynced production
    # change can't hold codegen for long.
    - cron: '7,37 * * * *'
  workflow_dispatch: {}
  repository_dispatch:
    types: [prod-released]
  release:
    types: [published]

jobs:
  back-sync:
    # Fast-forward production main back onto staging so the trunks stay identical.
    runs-on: ubuntu-latest
    if: >-
      github.repository == 'warpdotdev/oz-sdk-python-staging' &&
      (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch')
    permissions:
      contents: write
    concurrency:
      group: stlc-back-sync
      cancel-in-progress: true
    env:
      PRODUCTION_REPO: warpdotdev/oz-sdk-python
    steps:
      - name: Check out staging
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Mint app token for production
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.SDK_RELEASE_APP_ID }}
          private-key: ${{ secrets.SDK_RELEASE_APP_PRIVATE_KEY }}
          owner: warpdotdev
          repositories: oz-sdk-python

      - name: Fetch production main
        env:
          PRODUCTION_REPO_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          # Production is private, so the fetch authenticates as the
          # warp-sdk-release app.
          git remote add production "https://x-access-token:${PRODUCTION_REPO_TOKEN}@github.com/${PRODUCTION_REPO}.git"
          # actions/checkout persists this repo's token as an auth header, which
          # outranks the remote URL credential; blank it for this fetch only.
          git -c "http.https://github.com/.extraheader=" fetch production main

      - name: Check whether production has content staging lacks
        id: diff
        run: |
          # Content compare: would merging production into staging change its tree?
          # If not, staging already has production's content (release-please commits).
          MERGED=$(git merge-tree --write-tree origin/main production/main) || MERGED=conflict
          STAGING_TREE=$(git rev-parse 'origin/main^{tree}')
          if [ "$MERGED" = "$STAGING_TREE" ]; then
            echo "Staging already has production's content. Nothing to pull back."
            echo "behind=false" >> "$GITHUB_OUTPUT"
          else
            echo "behind=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Sync production to staging (fast-forward)
        if: steps.diff.outputs.behind == 'true'
        run: |
          # Refuse unless staging is an ancestor of production: otherwise the
          # trunks have forked and a fast-forward would be unsafe.
          if ! git merge-base --is-ancestor origin/main production/main; then
            echo "::error title=Back-sync blocked::staging main is not an ancestor of production/main."
            exit 1
          fi
          git push origin production/main:refs/heads/main
          echo "Fast-forwarded staging/main to production/main."

      - name: Alert on failure
        if: failure()
        env:
          ALERT_WEBHOOK_URL: ${{ secrets.STLC_ALERT_WEBHOOK_URL }}
        run: |
          run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          msg="stlc back-sync (sync from production) failed in ${{ github.repository }}. A stalled back-sync lets custom-code tracking drift, which later builds refuse on — investigate before the next build. Run: $run_url"
          echo "::error title=stlc workflow failed::$msg"
          { echo "### ⚠️ stlc workflow failed"; echo ""; echo "$msg"; } >> "$GITHUB_STEP_SUMMARY"
          if [ -n "${ALERT_WEBHOOK_URL:-}" ]; then
            curl -sS -X POST -H 'Content-Type: application/json' \
              -d "$(jq -n --arg text "$msg" '{text:$text}')" "$ALERT_WEBHOOK_URL" \
              || echo "::warning::Alert webhook POST failed"
          fi

  notify-back-sync:
    # On a published release, tell staging to back-sync now instead of waiting for
    # the poll. Dispatch-only: it cannot write production or staging contents.
    runs-on: ubuntu-latest
    if: >-
      github.repository == 'warpdotdev/oz-sdk-python' &&
      (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
    permissions:
      contents: read
    env:
      STAGING_REPO: warpdotdev/oz-sdk-python-staging
    steps:
      - name: Mint app token for staging
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.SDK_RELEASE_APP_ID }}
          private-key: ${{ secrets.SDK_RELEASE_APP_PRIVATE_KEY }}
          owner: warpdotdev
          repositories: oz-sdk-python-staging

      - name: Dispatch back-sync to staging
        env:
          DISPATCH_TOKEN: ${{ steps.app-token.outputs.token }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          payload=$(jq -n --arg ref "$REF_NAME" '{event_type:"prod-released",client_payload:{ref:$ref}}')
          code=$(curl -sS -o /tmp/dispatch.txt -w '%{http_code}' -X POST \
            -H "Authorization: Bearer ${DISPATCH_TOKEN}" \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            "https://api.github.com/repos/${STAGING_REPO}/dispatches" \
            -d "$payload")
          if [ "$code" = "204" ]; then
            echo "Back-sync dispatched to ${STAGING_REPO}."
          else
            echo "Dispatch failed (HTTP $code)" >&2; cat /tmp/dispatch.txt >&2; exit 1
          fi

      - name: Alert on failure
        if: failure()
        env:
          ALERT_WEBHOOK_URL: ${{ secrets.STLC_ALERT_WEBHOOK_URL }}
        run: |
          run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          msg="stlc release back-sync trigger failed in ${{ github.repository }} — the staging repo was NOT notified to back-sync this release (check the warp-sdk-release app secrets/installation). Staging catches up on its next poll. Run: $run_url"
          echo "::error title=stlc workflow failed::$msg"
          { echo "### ⚠️ stlc workflow failed"; echo ""; echo "$msg"; } >> "$GITHUB_STEP_SUMMARY"
          if [ -n "${ALERT_WEBHOOK_URL:-}" ]; then
            curl -sS -X POST -H 'Content-Type: application/json' \
              -d "$(jq -n --arg text "$msg" '{text:$text}')" "$ALERT_WEBHOOK_URL" \
              || echo "::warning::Alert webhook POST failed"
          fi