Yicong-Huang commented on code in PR #6948:
URL: https://github.com/apache/texera/pull/6948#discussion_r3741373069
##########
.github/workflows/create-release-candidate.yml:
##########
@@ -461,3 +461,25 @@ jobs:
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
cat "$GITHUB_WORKSPACE/vote-email.txt" >> $GITHUB_STEP_SUMMARY
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+
+ # After an RC is published, tell the website to rebuild. The site pulls docs
+ # straight from the release branches, so this is just a "go" signal; the
+ # site's daily schedule is the safety net if this never fires. A
+ # repository_dispatch needs Contents:write on the target repo, so the token's
+ # fine-grained scope must include apache/incubator-texera-site (add that repo
+ # to AUTO_MERGE_TOKEN if it isn't already covered).
+ notify-website:
+ needs: [create-rc, upload-rc]
+ if: github.repository == 'apache/texera'
+ runs-on: ubuntu-latest
+ steps:
+ - name: Trigger website rebuild
+ continue-on-error: true # never fail the release over a website ping
+ env:
+ GH_TOKEN: ${{ secrets.AUTO_MERGE_TOKEN }}
+ run: |
+ # Pass the tag and its resolved commit sha.
+ gh api repos/apache/incubator-texera-site/dispatches \
+ -f event_type=docs-updated \
+ -f "client_payload[tag]=${{ github.event.inputs.tag }}" \
+ -f "client_payload[sha]=${{ needs.create-rc.outputs.commit_hash }}"
Review Comment:
@Yicong-Huang asked on line 483 how the exact RC SHA reaches the site. The
other side says it does not: a paginated sweep of
apache/incubator-texera-site#68 finds no `client_payload`, and its build runs
`pull-release-docs.sh` against `release/vX.Y` branch tips.
Honoring it later would create a new problem. Dispatch builds would pin an
RC sha while the daily cron builds the branch tip, so docs would flip between
two sources. Suggest dropping the payload and keeping the pure "go" signal.
```suggestion
gh api repos/apache/incubator-texera-site/dispatches \
-f event_type=docs-updated
```
##########
.github/workflows/create-release-candidate.yml:
##########
@@ -461,3 +461,25 @@ jobs:
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
cat "$GITHUB_WORKSPACE/vote-email.txt" >> $GITHUB_STEP_SUMMARY
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+
+ # After an RC is published, tell the website to rebuild. The site pulls docs
+ # straight from the release branches, so this is just a "go" signal; the
+ # site's daily schedule is the safety net if this never fires. A
+ # repository_dispatch needs Contents:write on the target repo, so the token's
+ # fine-grained scope must include apache/incubator-texera-site (add that repo
+ # to AUTO_MERGE_TOKEN if it isn't already covered).
+ notify-website:
+ needs: [create-rc, upload-rc]
+ if: github.repository == 'apache/texera'
+ runs-on: ubuntu-latest
+ steps:
+ - name: Trigger website rebuild
+ continue-on-error: true # never fail the release over a website ping
Review Comment:
`continue-on-error: true` with no annotation means a 403 — the exact failure
mode #6949 exists to fix — produces a green release run. Advisory rather than a
defect: the RC workflow is hand-launched and watched, and #68's daily cron caps
the staleness at ~24h.
Wrapping the call as `if ! gh api …; then echo "::warning::…"; fi` surfaces
the miss and keeps the release green, making `continue-on-error` unnecessary.
##########
.github/workflows/create-release-candidate.yml:
##########
@@ -461,3 +461,25 @@ jobs:
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
cat "$GITHUB_WORKSPACE/vote-email.txt" >> $GITHUB_STEP_SUMMARY
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+
+ # After an RC is published, tell the website to rebuild. The site pulls docs
+ # straight from the release branches, so this is just a "go" signal; the
+ # site's daily schedule is the safety net if this never fires. A
+ # repository_dispatch needs Contents:write on the target repo, so the token's
+ # fine-grained scope must include apache/incubator-texera-site (add that repo
+ # to AUTO_MERGE_TOKEN if it isn't already covered).
+ notify-website:
+ needs: [create-rc, upload-rc]
+ if: github.repository == 'apache/texera'
+ runs-on: ubuntu-latest
+ steps:
+ - name: Trigger website rebuild
+ continue-on-error: true # never fail the release over a website ping
+ env:
+ GH_TOKEN: ${{ secrets.AUTO_MERGE_TOKEN }}
Review Comment:
This borrows `AUTO_MERGE_TOKEN`, shared with the backport workflows, and the
job comment notes its scope must be broadened first. The deleted workflow did
the same job through a purpose-scoped `SITE_SYNC_TOKEN` with a narrow
`permissions:` block — a step back from what the repo already had.
This PR frees the `SITE_SYNC_TOKEN` name. Pointing the job at it is the same
one-time INFRA request, without widening what the backport workflows carry.
That request gates either option, so this is not a merge blocker. Worth adding
a `permissions:` block too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
