[Workflow] Run the repository sync script from GH.

[thieta]

Summary

Also various fixes to the script to work correctly
in GH actions.

[kwk]

LGTM

.github/workflows/sync-release-repo.yml

6

This is good practice! I'm glad you've pointed it out.

llvm/utils/git/sync-release-repo.sh

28

Just to be sure: The fact that you've written GH_TOKEN: ${{ secrets.GH_TOKEN }} in the workflow file will hide or mask the token here, when looking at the output, right?

[thieta]

llvm/utils/git/sync-release-repo.sh

28

Yeah. It searchs the output for the string that's in the value of the column to mask it.

[asl]

.github/workflows/sync-release-repo.yml

9

We tend to use more descriptive names for tokens to ensure they are unique "per task".

[thieta]

.github/workflows/sync-release-repo.yml

9

Feel free to add the secret with a better name and I'll adapt the script to that name tomorrow.

.github/workflows/sync-release-repo.yml

+name: Sync Release Repositories
+permissions:
+  contents: write
+on:
+  workflow_dispatch
+env:
+  RELEASE_BRANCH: release/17.x
+  GH_TOKEN: ${{ secrets.RELEASE_WORKFLOW_PUSH_SECRET }}
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch LLVM sources
+        uses: actions/checkout@v3
+      - name: Run Sync Script
+        run: |
+          llvm/utils/git/sync-release-repo.sh

llvm/utils/git/sync-release-repo.sh

 # We will add two remotes here:
 #  main - which will point to the main llvm-project repo
 #  release - which will point to the release-prs repo
 # The remotes will use random strings to avoid
 # collisions
 MAIN_REMOTE=$(uuidgen)
 RELEASE_REMOTE=$(uuidgen)
 CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
+# depth here must make sure to fetch enough history to make a merge,
+# it's an arbritary value at this point. Consider using --shallow-since=
+FETCH_OPTIONS="--prune --no-tags --progress --depth=100"
 
 git remote add $MAIN_REMOTE "https://github.com/llvm/llvm-project"
-git remote add $RELEASE_REMOTE "https://github.com/llvm/llvm-project-release-prs"
+git remote add $RELEASE_REMOTE "https://token:$[e-mail]/llvm/llvm-project-release-prs"
 
 # Make sure we are up to date on all our repos first
-git fetch $MAIN_REMOTE
-git fetch $RELEASE_REMOTE
+git fetch $FETCH_OPTIONS $MAIN_REMOTE $RELEASE_BRANCH
+git fetch $FETCH_OPTIONS $RELEASE_REMOTE $RELEASE_BRANCH
 
 # Create our sync branch. Starting with the main
 # repo first since it's important to get those
 # changes
 MERGE_BRANCH=$(uuidgen)
 git switch -c $MERGE_BRANCH $MAIN_REMOTE/$RELEASE_BRANCH
 
 # Merge changes from the release repo
 git merge --ff-only $RELEASE_REMOTE/$RELEASE_BRANCH
 
 if ! git diff-index --quiet $MAIN_REMOTE/$RELEASE_BRANCH; then
   echo "Changes in the release remote - pushing to main remote"
   git push $MAIN_REMOTE $MERGE_BRANCH:$RELEASE_BRANCH
 fi
 
 # Before we merge back into the release repo
 # let's update to make sure nothing has been
 # pushed to either repo while we do this work.
 # Most of the time this won't do anything, and
 # the real solution would instead be to fetch
 # in a loop if pushing fails. But that's a very
 # tiny edge-case, so let's not complicate this.
-git fetch $MAIN_REMOTE
-git fetch $RELEASE_REMOTE
+git fetch $FETCH_OPTIONS $MAIN_REMOTE $RELEASE_BRANCH
+git fetch $FETCH_OPTIONS $RELEASE_REMOTE $RELEASE_BRANCH
 
 # And merge all the new data to the current branch
 git merge --ff-only $MAIN_REMOTE/$RELEASE_BRANCH
 
 # If anything changed let's merge it
 if ! git diff-index --quiet $RELEASE_REMOTE/$RELEASE_BRANCH; then
   echo "Changes in main - pushing to release"
+  # Remove the token stored by GH Actions, otherwise it
+  # won't use our own token in $GH_TOKEN
+  git config --unset-all http.https://github.com/.extraheader
   git push $RELEASE_REMOTE $MERGE_BRANCH:$RELEASE_BRANCH
 fi
 
 # Cleanup - enable for debug
 if false; then
   git remote remove $RELEASE_REMOTE
   git remote remove $MAIN_REMOTE
 
   git switch $CURRENT_BRANCH
   git branch -D $MERGE_BRANCH
 fi