Skip to content

Alert Changed Branch Protections #19

Alert Changed Branch Protections

Alert Changed Branch Protections #19

name: Alert Changed Branch Protections
on:
branch_protection_rule:
workflow_dispatch:
schedule:
- cron: '20 16 * * 3' # Run every Wednesday at 16:30 UTC / 8:30 PST
permissions:
contents: read
jobs:
check-branch-protections:
runs-on: ubuntu-latest
if: github.repository == 'github/docs-internal'
strategy:
matrix:
# List of branches we want to monitor for protection changes
branch: [main]
steps:
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Fetch branch protections
id: fetch
env:
GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_WORKFLOW }}
run: |
# Fetch branch protections and store them in a file
gh api /repos/GitHub/docs-internal/branches/${{ matrix.branch }}/protection > ${{ matrix.branch }}-actual.json
- name: Format fetched settings with prettier for comparison
id: format
run: |
npx prettier --write ${{ matrix.branch }}-actual.json
- name: Compare branch protections
id: compare
run: |
# Compare the fetched branch protections with the committed ones
git diff --no-index .github/branch_protection_settings/${{ matrix.branch }}.json ${{ matrix.branch }}-actual.json || echo "diff_failed=true" >> $GITHUB_ENV
- name: Set failure message
if: env.diff_failed == 'true'
run: |
message="Alert due to changes in branch protections for ${{ matrix.branch }}. Please review the changes and ensure they are intentional. If valid, update the branch protection settings in .github/branch_protection_settings/${{ matrix.branch }}.json to match the diff in this workflow."
echo "failure_message=$message" >> $GITHUB_ENV
echo "$message"
- uses: ./.github/actions/slack-alert
if: ${{ env.diff_failed == 'true' && github.event_name != 'workflow_dispatch' }}
with:
slack_channel_id: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
message: ${{ env.failure_message }}
color: purple