44# from the selected Leo ref.
55# - Pushes changes to the fixed automation branch `automation/sync-leo-release`.
66# - Opens or updates a reviewable PR; it does not publish the extension.
7- # - Requires `LEO_REPO_READ_TOKEN` (`contents: read`) for cross-repo access to
8- # `ProvableHQ/leo`.
7+ # - Reads `ProvableHQ/leo` via the auto-issued `GITHUB_TOKEN` (sufficient because
8+ # `ProvableHQ/leo` is public). `LEO_REPO_READ_TOKEN` is honored when present
9+ # for higher API rate limits or future private-repo support.
910
1011name : Watch Leo Tags
1112
@@ -42,24 +43,10 @@ jobs:
4243 with :
4344 node-version : 20
4445
45- - name : Check Leo source token availability
46- id : auth
47- env :
48- LEO_REPO_READ_TOKEN : ${{ secrets.LEO_REPO_READ_TOKEN }}
49- run : |
50- if [ -z "$LEO_REPO_READ_TOKEN" ]; then
51- echo "enabled=false" >>"$GITHUB_OUTPUT"
52- echo "LEO_REPO_READ_TOKEN is not configured. Skipping Leo sync."
53- exit 0
54- fi
55-
56- echo "enabled=true" >>"$GITHUB_OUTPUT"
57-
5846 - name : Resolve Leo sync target
5947 id : target
60- if : steps.auth.outputs.enabled == 'true'
6148 env :
62- GH_TOKEN : ${{ secrets.LEO_REPO_READ_TOKEN }}
49+ GH_TOKEN : ${{ secrets.LEO_REPO_READ_TOKEN || github.token }}
6350 run : |
6451 set -euo pipefail
6552
@@ -77,11 +64,11 @@ jobs:
7764 "${args[@]}"
7865
7966 - name : Stop when no sync is needed
80- if : steps.auth.outputs.enabled == 'true' && steps. target.outputs.should_sync != 'true'
67+ if : steps.target.outputs.should_sync != 'true'
8168 run : echo "No new Leo release tag needs syncing."
8269
8370 - name : Check whether the automation branch already targets this ref
84- if : steps.auth.outputs.enabled == 'true' && steps. target.outputs.should_sync == 'true'
71+ if : steps.target.outputs.should_sync == 'true'
8572 id : branch_state
8673 env :
8774 SYNC_BRANCH : ${{ steps.target.outputs.sync_branch }}
@@ -105,26 +92,26 @@ jobs:
10592 echo "already_prepared=false" >>"$GITHUB_OUTPUT"
10693
10794 - name : Stop when the automation branch is already up to date
108- if : steps.auth.outputs.enabled == 'true' && steps. target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared == 'true'
95+ if : steps.target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared == 'true'
10996 run : echo "An automation branch already exists for this Leo release ref."
11097
11198 - name : Checkout Leo repo
112- if : steps.auth.outputs.enabled == 'true' && steps. target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true'
99+ if : steps.target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true'
113100 uses : actions/checkout@v5
114101 with :
115102 repository : ProvableHQ/leo
116103 path : leo
117104 fetch-depth : 0
118- token : ${{ secrets.LEO_REPO_READ_TOKEN }}
105+ token : ${{ secrets.LEO_REPO_READ_TOKEN || github.token }}
119106
120107 - name : Configure git author
121- if : steps.auth.outputs.enabled == 'true' && steps. target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true'
108+ if : steps.target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true'
122109 run : |
123110 git config user.name "github-actions[bot]"
124111 git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
125112
126113 - name : Sync syntax artifacts from the selected Leo ref
127- if : steps.auth.outputs.enabled == 'true' && steps. target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true'
114+ if : steps.target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true'
128115 id : sync
129116 env :
130117 DEFAULT_BRANCH : ${{ github.event.repository.default_branch }}
@@ -155,11 +142,11 @@ jobs:
155142 echo "has_changes=true" >>"$GITHUB_OUTPUT"
156143
157144 - name : Stop when the selected Leo ref produces no repo changes
158- if : steps.auth.outputs.enabled == 'true' && steps. target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true' && steps.sync.outputs.has_changes != 'true'
145+ if : steps.target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true' && steps.sync.outputs.has_changes != 'true'
159146 run : echo "Sync completed but produced no changes to commit."
160147
161148 - name : Create or update the sync pull request
162- if : steps.auth.outputs.enabled == 'true' && steps. target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true' && steps.sync.outputs.has_changes == 'true'
149+ if : steps.target.outputs.should_sync == 'true' && steps.branch_state.outputs.already_prepared != 'true' && steps.sync.outputs.has_changes == 'true'
163150 env :
164151 DEFAULT_BRANCH : ${{ github.event.repository.default_branch }}
165152 GH_TOKEN : ${{ github.token }}
0 commit comments