Automatically update submodules when other repos push to `master`

[stevepiercy]

Plone Documentation versions affected

• [ ] 5.x
• [X] 6.x

Description

Currently whenever there is a push to master for either repo plone/volto or plone/plone.restapi, we manually need to remember to update the submodule. See https://6.docs.plone.org/contributing/index.html#editing-external-package-documentation, Step 7.

cd ../..

# For plone.restapi
git add submodules/plone.restapi
git commit -m "Update submodules/plone.restapi tip"

# For volto
git add submodules/volto
git commit -m "Update submodules/volto tip"

git push

It would be great to handle this automatically in GitHub Actions.

[stevepiercy]

Apparently GitHub Actions does not support cross-repository workflows directly. However, here is an article that works around it using curl and secrets to trigger a cross-repository workflow.

https://utensils.io/articles/trigger-github-actions-from-another-repo

See also:

https://github.com/orgs/community/discussions/26323

First we need to create a workflow in this repository that will update the git submodule.

Then we need to work with the Volto team to add secrets to their repo which the Docs Team can provide, create a new workflow that runs only on pushes to master that calls the other workflow, and update .github/workflows/docs.yml to call the new workflow on success. Something like this, I think:

docs.yml success → call-remote-documentation.yml → update-submodule.yml

[stevepiercy]

@ericof how should secrets be generated and stored for the Plone organization? I can do the work, except for that bit.

[stevepiercy]

Reopening per https://github.com/plone/documentation/pull/1346#issuecomment-1283013996

[esteele]

@stevepiercy Thanks for your patience. I've updated the workflow so that it now correctly updates submodules. Pushing those changes is proving to be the difficulty right now. If you look at the results of this run, you can see it's found and committed updates to plone.restapi and volto, but can't push them back to 6-dev because of the branch rules.

I'll keep looking to see what I can find for that. If you have any ideas, I'd welcome them.

[stevepiercy]

What user attempts to make the push to 6-dev? I can add that user to the authorized members who can do that.

[stevepiercy]

For example, I added @esteele to the people who can bypass required pull requests.

It looks you are not a member of the AI team or Documentation team, so you do not have power to change the repo settings. I can add you as an individual. Please let me know.

[davisagli]

It looks like bypassing branch protection here may be tricky. There's some discussion at https://github.com/community/community/discussions/13836

[stevepiercy]

Please visit https://github.com/orgs/community/discussions/13836, upvote and subscribe to that issue.

[fredvd]

@esteele Steve pointed me to this issue because we had an expiring key on the plone organisation account from October last year. Apparently on that discussion in the previous comment are some interesting pointers to what people are using nowadays.

@stevepiercy If this is still something you want to automate (updating the tips of the submodules) it seem we can do this with a dedication github action that allows you to use a separate Personal Access Token with the right permissions:

https://github.com/ad-m/github-push-action

[stevepiercy]

@fredvd yes, this is definitely still wanted.

This post might also be helpful.

https://github.com/orgs/community/discussions/26323