configure-github.yml

# @format

name: 'Configure GitHub'

on:
  schedule:
    - cron: '0 4 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  configure-github:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # Secrets cannot be tested in an `if`, but an env var set from one can, at step level.
    env:
      KLICKSPLIT_CLIENT_ID: ${{ secrets.KLICKSPLIT_CLIENT_ID }}
    steps:
      - name: Skip notice
        if: ${{ env.KLICKSPLIT_CLIENT_ID == '' }}
        run: echo "::notice::KLICKSPLIT_CLIENT_ID is not set, skipping the GitHub configuration."

      - name: Generate a token
        if: ${{ env.KLICKSPLIT_CLIENT_ID != '' }}
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.KLICKSPLIT_CLIENT_ID }}
          private-key: ${{ secrets.KLICKSPLIT_APP_KEY }}

      - name: Restrict main to GitHub bot
        if: ${{ env.KLICKSPLIT_CLIENT_ID != '' }}
        uses: actions/github-script@v9
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            await github.rest.repos.updateBranchProtection({
              owner: context.repo.owner,
              repo: context.repo.repo,
              branch: 'main',
              restrictions: {
                users: [],
                teams: [],
                apps: ['github-actions'],
              },
              required_status_checks: null,
              enforce_admins: true,
              required_pull_request_reviews: null,
              allow_force_pushes: false,
              allow_deletions: false,
            });

      - name: Require the Tests green check on develop
        if: ${{ env.KLICKSPLIT_CLIENT_ID != '' }}
        uses: actions/github-script@v9
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            const args = {
              owner: context.repo.owner,
              repo: context.repo.repo,
              branch: 'develop',
            };
            try {
              // Adds to the existing required checks, keeps the other settings.
              await github.rest.repos.addStatusChecksContexts({
                ...args,
                contexts: ['Tests green'],
              });
            } catch (e) {
              if (e.status !== 404) throw e;
              // No protection on develop yet: create the minimal one.
              await github.rest.repos.updateBranchProtection({
                ...args,
                required_status_checks: { strict: false, contexts: ['Tests green'] },
                enforce_admins: false,
                required_pull_request_reviews: null,
                restrictions: null,
              });
            }