From 17a13dbb97f1c2c745ab95074d27d1ab5220dbfb Mon Sep 17 00:00:00 2001 From: Caspar van Leeuwen Date: Tue, 11 Aug 2026 16:21:16 +0200 Subject: [PATCH 1/2] Add CI to send a trigger to EESSI/software-layer whenever the tip of EESSI/software-layer-scripts' main branch changes --- .../dispatch_software_layer_update.yml | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/workflows/dispatch_software_layer_update.yml diff --git a/.github/workflows/dispatch_software_layer_update.yml b/.github/workflows/dispatch_software_layer_update.yml new file mode 100644 index 00000000..1820eefd --- /dev/null +++ b/.github/workflows/dispatch_software_layer_update.yml @@ -0,0 +1,34 @@ +# IMPORTANT: This workflow belongs in EESSI/software-layer-scripts, NOT in EESSI/software-layer. +# Move this file to EESSI/software-layer-scripts/.github/workflows/ (e.g. as +# .github/workflows/dispatch_software_layer_update.yml). It fires whenever +# software-layer-scripts/main gets a new commit and asks EESSI/software-layer to +# re-evaluate bot/software_layer_scripts_commit. +# +# One-time setup: +# 1. Create a fine-grained PAT (https://github.com/settings/personal-access-tokens): +# - Repository access: Only select repositories -> EESSI/software-layer +# - Repository permissions -> Actions: Read and write (NOT contents!) +# This token can only start/stop/inspect CI runs in software-layer; it cannot +# push code, modify files, or open pull requests. +# 2. Add it as a repository secret named SOFTWARE_LAYER_ACTIONS_TOKEN in +# EESSI/software-layer-scripts. +# +# The triggered workflow (update_software_layer_scripts_commit.yml) in EESSI/software-layer +# does the actual branch push + PR using its own ephemeral GITHUB_TOKEN. +name: Notify software-layer of new scripts commit +on: + push: + branches: [main] +permissions: + contents: read +jobs: + dispatch: + runs-on: ubuntu-24.04 + steps: + - name: Trigger update workflow in EESSI/software-layer + env: + GH_TOKEN: ${{ secrets.SOFTWARE_LAYER_ACTIONS_TOKEN }} + run: | + gh api -X POST \ + repos/EESSI/software-layer/actions/workflows/update_software_layer_scripts_commit.yml/dispatches \ + -f ref=main From aff1d0b5e2a488a930a05e28b240392866d837db Mon Sep 17 00:00:00 2001 From: Caspar van Leeuwen Date: Tue, 11 Aug 2026 16:28:32 +0200 Subject: [PATCH 2/2] Update description --- .github/workflows/dispatch_software_layer_update.yml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/dispatch_software_layer_update.yml b/.github/workflows/dispatch_software_layer_update.yml index 1820eefd..8b81b39a 100644 --- a/.github/workflows/dispatch_software_layer_update.yml +++ b/.github/workflows/dispatch_software_layer_update.yml @@ -1,15 +1,13 @@ -# IMPORTANT: This workflow belongs in EESSI/software-layer-scripts, NOT in EESSI/software-layer. -# Move this file to EESSI/software-layer-scripts/.github/workflows/ (e.g. as -# .github/workflows/dispatch_software_layer_update.yml). It fires whenever -# software-layer-scripts/main gets a new commit and asks EESSI/software-layer to -# re-evaluate bot/software_layer_scripts_commit. +# This action is triggered whenever software-layer-scripts/main gets a new commit and +# asks EESSI/software-layer to re-evaluate bot/software_layer_scripts_commit. # # One-time setup: # 1. Create a fine-grained PAT (https://github.com/settings/personal-access-tokens): # - Repository access: Only select repositories -> EESSI/software-layer # - Repository permissions -> Actions: Read and write (NOT contents!) -# This token can only start/stop/inspect CI runs in software-layer; it cannot -# push code, modify files, or open pull requests. +# This token can only start/stop/inspect CI runs, enable/disable CI and remove CI aftefacts +# in software-layer. That means the security impact is non-zero, but limited. +# It cannot push code, modify files, or open pull requests. # 2. Add it as a repository secret named SOFTWARE_LAYER_ACTIONS_TOKEN in # EESSI/software-layer-scripts. #