Skip to content

Update sync configuration #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joselsegura merged 1 commit into from
Apr 16, 2026
Merged

Update sync configuration #69

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
108 changes: 108 additions & 0 deletions .github/sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,26 +1,74 @@
RedHatInsights/ccx-notification-service:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml
Comment on lines +3 to +7
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Verify prerequisites for repos listed in .github/sync.yml:
# 1) default branch is main/master (for push trigger coverage in linters workflow)
# 2) required secrets exist for bots auto-merge workflow

repos=$(awk '/^RedHatInsights\// {gsub(":", "", $1); print $1}' .github/sync.yml)

printf "repo,default_branch,push_trigger_covered,has_client_id_secret,has_private_key_secret\n"

for repo in $repos; do
  default_branch=$(gh api "repos/$repo" --jq '.default_branch' 2>/dev/null || echo "UNKNOWN")

  if [[ "$default_branch" == "main" || "$default_branch" == "master" ]]; then
    covered="yes"
  else
    covered="no"
  fi

  secret_names=$(gh api "repos/$repo/actions/secrets?per_page=100" --jq '.secrets[].name' 2>/dev/null || true)

  if printf "%s\n" "$secret_names" | grep -qx 'OBSINT_PROCESSING_APP_CLIENT_ID'; then
    has_client_id="yes"
  else
    has_client_id="no"
  fi

  if printf "%s\n" "$secret_names" | grep -qx 'OBSINT_PROCESSING_APP_PRIVATE_KEY'; then
    has_private_key="yes"
  else
    has_private_key="no"
  fi

  printf "%s,%s,%s,%s,%s\n" "$repo" "$default_branch" "$covered" "$has_client_id" "$has_private_key"
done

Repository: RedHatInsights/processing-tools

Length of output: 1378

Syncing workflows_examples/bots-auto-merge.yaml will fail in all target repos—required secrets are missing.

The verification shows all 21 target repos lack the required secrets OBSINT_PROCESSING_APP_CLIENT_ID and OBSINT_PROCESSING_APP_PRIVATE_KEY. The bots-auto-merge.yaml workflow will fail at runtime in every repo. Either provision these secrets to all target repos first, or exclude this workflow from the sync until prerequisites are met.

The workflows_examples/linters.yaml workflow is compatible (all repos use main or master as default branch).

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/sync.yml around lines 3 - 7, The sync currently includes the
workflow bots-auto-merge.yaml but all target repos lack the required secrets
OBSINT_PROCESSING_APP_CLIENT_ID and OBSINT_PROCESSING_APP_PRIVATE_KEY, so either
provision those two secrets to every target repo before syncing or
remove/exclude bots-auto-merge.yaml from the sync config and keep linters.yaml;
update the sync configuration to remove the source entry for
bots-auto-merge.yaml (or add an exclusion) so only compatible workflows (e.g.,
linters.yaml) are synced until the secrets are provisioned.


RedHatInsights/ccx-notification-writer:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/ccx-upgrades-data-eng:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/ccx-upgrades-inference:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/content-service:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/data-pipeline:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-ccx-messaging:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-content-template-renderer:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-core-messaging:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml
Comment on lines +65 to +71
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Verify the new repository exists and check its default branch
repo="RedHatInsights/insights-core-messaging"

echo "Checking repository: $repo"

# Get repo info
repo_info=$(gh api "repos/$repo" 2>/dev/null || echo "NOT_FOUND")

if [[ "$repo_info" == "NOT_FOUND" ]]; then
  echo "ERROR: Repository $repo does not exist or is not accessible"
  exit 1
fi

default_branch=$(echo "$repo_info" | jq -r '.default_branch')
echo "Default branch: $default_branch"

if [[ "$default_branch" == "main" || "$default_branch" == "master" ]]; then
  echo "✓ Default branch is compatible with linters.yaml push trigger"
else
  echo "⚠ Default branch '$default_branch' may not be covered by linters.yaml push trigger (expects main or master)"
fi

# Check for required secrets (will likely show 'no' until provisioned)
echo ""
echo "Checking secrets (expected to be missing until provisioned):"
secret_names=$(gh api "repos/$repo/actions/secrets?per_page=100" --jq '.secrets[].name' 2>/dev/null || echo "")

for secret in OBSINT_PROCESSING_APP_CLIENT_ID OBSINT_PROCESSING_APP_PRIVATE_KEY; do
  if printf "%s\n" "$secret_names" | grep -qx "$secret"; then
    echo "✓ $secret: present"
  else
    echo "✗ $secret: missing"
  fi
done

Repository: RedHatInsights/processing-tools

Length of output: 369

Provision required secrets for the new sync target before deployment.

The new sync target RedHatInsights/insights-core-messaging exists with a compatible default branch (master). However, the required secrets for the bots-auto-merge.yaml workflow are currently missing:

  • OBSINT_PROCESSING_APP_CLIENT_ID
  • OBSINT_PROCESSING_APP_PRIVATE_KEY

These secrets must be provisioned in the repository before the synced workflow can function.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/sync.yml around lines 65 - 71, The new sync target
RedHatInsights/insights-core-messaging adds a synced workflow file
bots-auto-merge.yaml but the required secrets OBSINT_PROCESSING_APP_CLIENT_ID
and OBSINT_PROCESSING_APP_PRIVATE_KEY are missing; provision these two secrets
in the target repository's GitHub settings (Repository > Settings > Secrets)
before deploying the sync so bots-auto-merge.yaml can access them, and verify
the secret names exactly match OBSINT_PROCESSING_APP_CLIENT_ID and
OBSINT_PROCESSING_APP_PRIVATE_KEY used by the workflow.


# RedHatInsights/insights-data-schemas:
# - CODEOWNERS
Expand All @@ -30,42 +78,102 @@ RedHatInsights/insights-content-template-renderer:

RedHatInsights/insights-operator-gathering-conditions:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-operator-gathering-conditions-service:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-operator-utils:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-results-aggregator:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-results-aggregator-cleaner:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

# RedHatInsights/insights-results-aggregator-data:
# - CODEOWNERS

RedHatInsights/insights-results-aggregator-exporter:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-results-aggregator-mock:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-results-aggregator-utils:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

# RedHatInsights/insights-results-mcp:
# - CODEOWNERS

RedHatInsights/insights-results-smart-proxy:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/obsint-mocks:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/parquet-factory:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml

RedHatInsights/insights-behavioral-spec:
- CODEOWNERS
- renovate.json
- source: workflows_examples/linters.yaml
dest: .github/workflows/linters.yaml
- source: workflows_examples/bots-auto-merge.yaml
dest: .github/workflows/bots-auto-merge.yaml
2 changes: 2 additions & 0 deletions CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
# This file is synced from RedHatInsights/processing-tools automatically; do not edit in downstream repos.

* @RedHatInsights/obsint-processing

# Auto-merge codeowners
Expand Down
1 change: 1 addition & 0 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"description": "This file is synced from RedHatInsights/processing-tools automatically; do not edit in downstream repos.",
"packageRules": [
{
"matchDatasources": ["pypi"],
Expand Down
2 changes: 2 additions & 0 deletions workflows_examples/bots-auto-merge.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
# This workflow is synced from RedHatInsights/processing-tools automatically; do not edit in downstream repos.

name: Enable auto-merge for bots

on:
Expand Down
2 changes: 2 additions & 0 deletions workflows_examples/linters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
# This workflow is synced from RedHatInsights/processing-tools automatically; do not edit in downstream repos.

name: Linters

on:
Expand Down
Loading