fix: harden consumer sync across organizations

actions/sync-workflows/sync.py

@@ -132,6 +132,10 @@ def sync(
 
     source_by_name = {path.name: path for path in workflow_files(source)}
 
+    stale_entries = sorted(set(entries) - set(source_by_name))
+    for name in stale_entries:
+        del entries[name]
+
     for name in sorted(entries):
         if name in source_by_name:
             target_file = target / ".github/workflows" / name
@@ -206,7 +210,7 @@ def sync(
         if not patch_ok:
             failed.append(name)
 
-    lock_changed = bool(updated or adopted)
+    lock_changed = bool(updated or adopted or stale_entries)
     if lock_changed:
         write_lock(lock_path, entries)
 
@@ -221,6 +225,7 @@ def sync(
         "failed": failed,
         "diverged": diverged,
         "details": details,
+        "removed_from_lock": stale_entries,
     }
 
 

patches/nextcloud/sync-workflow-templates.yml.patch

@@ -28,7 +28,7 @@
 +        with:
 +          app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
 +          private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
-+          owner: LibreCodeCoop
++          owner: ${{ github.repository_owner }}
 +          repositories: ${{ github.event.repository.name }}
 +          permission-contents: write
 +          permission-pull-requests: write

tests/test_sync_workflows_action.py

@@ -196,6 +196,43 @@ def test_broken_patch_sets_draft_signal_and_keeps_catalog_lock(self) -> None:
                 sync_module.md5(source_file),
             )
 
+    def test_removes_lock_entries_missing_from_catalog(self) -> None:
+        temporary, source, target = self.fixture()
+        with temporary:
+            current = source / "lint.yml"
+            current.write_text("name: Current\n", encoding="utf-8")
+            (target / ".github/workflows/lint.yml").write_text(
+                "name: Current\n", encoding="utf-8"
+            )
+            stale = target / ".github/workflows/old.yml"
+            stale.write_text("name: Local old workflow\n", encoding="utf-8")
+
+            sync_module.write_lock(
+                target / ".github/actions-lock.txt",
+                {
+                    "lint.yml": sync_module.md5(current),
+                    "old.yml": hashlib.md5(
+                        b"name: Old catalog workflow\n",
+                        usedforsecurity=False,
+                    ).hexdigest(),
+                },
+            )
+
+            report = sync_module.sync(
+                source, target, target / ".github/actions-lock.txt"
+            )
+
+            self.assertTrue(report["changed"])
+            self.assertEqual(report["removed_from_lock"], ["old.yml"])
+            self.assertEqual(
+                sync_module.parse_lock(target / ".github/actions-lock.txt"),
+                {"lint.yml": sync_module.md5(current)},
+            )
+            self.assertEqual(
+                stale.read_text(encoding="utf-8"),
+                "name: Local old workflow\n",
+            )
+
     def test_writes_single_line_github_output(self) -> None:
         with tempfile.TemporaryDirectory() as directory:
             output = Path(directory) / "output"

workflow-templates/sync-workflow-templates.yml

@@ -45,7 +45,7 @@ jobs:
         with:
           app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
           private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
-          owner: LibreCodeCoop
+          owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}
           permission-contents: write
           permission-pull-requests: write