From c746dd3c544601a6fc3946743ebb44b48e510e8e Mon Sep 17 00:00:00 2001 From: rory Date: Thu, 18 Jun 2026 16:55:02 -0700 Subject: [PATCH] Add setup-packages composite action Centralize apt-mirror setup from Web-Expensify so consumers can reference a shared action with a fixed GPG install path. Co-authored-by: Cursor --- README.md | 24 ++++++++++++++++++------ setup-packages/README.md | 24 ++++++++++++++++++++++++ setup-packages/action.yml | 21 +++++++++++++++++++++ setup-packages/aptly-public.gpg | Bin 0 -> 687 bytes 4 files changed, 63 insertions(+), 6 deletions(-) create mode 100644 setup-packages/README.md create mode 100644 setup-packages/action.yml create mode 100644 setup-packages/aptly-public.gpg diff --git a/README.md b/README.md index fd85a3d..e969d54 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# Expensify Shared GitHub Actions workflows 🔄 +# Expensify Shared GitHub Actions workflows 🔄 ## What is the repository used for? @@ -18,7 +18,7 @@ jobs: with: # Repository name with owner. For example, Expensify/eslint-config-expensify # Required, String, default: ${{ github.repository }} - repository: '' + repository: "" # True if we should run npm run build for the package # Optional, Boolean, default: false @@ -37,13 +37,25 @@ jobs: secrets: inherit ``` +### `setup-packages` + +Installs the Expensify aptly GPG key, configures internal apt-mirror sources, and runs `apt-get update`. See [setup-packages/README.md](./setup-packages/README.md) for details. + +```yml +- name: Provision and use our internal apt-mirror + uses: Expensify/GitHub-Actions/setup-packages@main + with: + APT_PASSWORD: ${{ secrets.TRAVIS_APT_PASSWORD }} +``` + ## Rulesets + GitHub [org-level rulesets](https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#require-workflows-to-pass-before-merging) can be configured to run a workflow check against pull requests in all repos in the org. This is a very powerful feature, but there are some caveats and best practices to be aware of when enabling a ruleset. - Supported Event Triggers are documented [here](https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#supported-event-triggers). However: - - When a workflow runs in response to a ruleset, some configs such as `branches`, `paths`, `paths-ignore`, that would normally be valid in a workflow are ignored. - - The default activity types for each event will be used. This means that something like `pull_request:comment` will not work - the `pull_request` event will always be triggered for the default activity types listed in the documentation. - - If you need to target or exclude specific branches, that can be configured in the ruleset settings. - - If you need to target or exclude specific paths, that must be implemented manually in the workflow itself. + - When a workflow runs in response to a ruleset, some configs such as `branches`, `paths`, `paths-ignore`, that would normally be valid in a workflow are ignored. + - The default activity types for each event will be used. This means that something like `pull_request:comment` will not work - the `pull_request` event will always be triggered for the default activity types listed in the documentation. + - If you need to target or exclude specific branches, that can be configured in the ruleset settings. + - If you need to target or exclude specific paths, that must be implemented manually in the workflow itself. - Due to a GitHub :bug:, PRs that are open when the rule is enabled will get stuck with a pending check that will never get picked up. The easiest way to fix that is to close and reopen the PR. Consider writing a script to close and reopen all open PRs across the org after the check is enabled. - It is less disruptive to [configure the ruleset to `Evaluate` first](https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#using-evaluate-mode-for-ruleset-workflows), then `Active` once the kinks are worked out. diff --git a/setup-packages/README.md b/setup-packages/README.md new file mode 100644 index 0000000..d6f9bb8 --- /dev/null +++ b/setup-packages/README.md @@ -0,0 +1,24 @@ +# setup-packages + +Composite action that installs the Expensify aptly GPG key, configures internal apt-mirror sources, and runs `apt-get update`. + +## Usage + +```yaml +- name: Provision and use our internal apt-mirror + uses: Expensify/GitHub-Actions/setup-packages@main + with: + APT_PASSWORD: ${{ secrets.TRAVIS_APT_PASSWORD }} +``` + +## Inputs + +| Input | Required | Description | +| -------------- | -------- | ------------------------------------------------------------------- | +| `APT_PASSWORD` | Yes | Password for the internal apt-mirror (`TRAVIS_APT_PASSWORD` secret) | + +## What it does + +1. Installs `aptly-public.gpg` from the action directory into `/etc/apt/trusted.gpg.d/aptly.gpg`. +2. Adds Expensify apt-mirror sources for `ubuntu-toolchain-noble` and `php-ppa-noble`. +3. Runs `apt-get update` to refresh package indexes. diff --git a/setup-packages/action.yml b/setup-packages/action.yml new file mode 100644 index 0000000..e68f65b --- /dev/null +++ b/setup-packages/action.yml @@ -0,0 +1,21 @@ +name: Set up Apt Mirror + Packages +description: Set up Apt Mirror + Packages + +inputs: + APT_PASSWORD: + description: "The mirror password" + required: true + +runs: + using: composite + steps: + - name: Sets package mirrors to the sources + run: | + sudo install -o root -g root -m 644 "${{ github.action_path }}/aptly-public.gpg" /etc/apt/trusted.gpg.d/aptly.gpg + echo "deb [arch=amd64] https://travis:${{ inputs.APT_PASSWORD }}@apt-mirror.expensify.com:843/apt/production ubuntu-toolchain-noble main" | sudo tee -a /etc/apt/sources.list + echo "deb [arch=amd64] https://travis:${{ inputs.APT_PASSWORD }}@apt-mirror.expensify.com:843/apt/production php-ppa-noble main" | sudo tee -a /etc/apt/sources.list + shell: bash + + - name: Install latest packages from our mirror + run: sudo apt-get update -y + shell: bash diff --git a/setup-packages/aptly-public.gpg b/setup-packages/aptly-public.gpg new file mode 100644 index 0000000000000000000000000000000000000000..b7054c9e5b0db0786fb45477cf30ac3c8fc11ac6 GIT binary patch literal 687 zcmV;g0#N;#0SyFca}qoO2msa1LN4}^m8rGFbP$9lyrMoqM+f$9?D9K{?%_X?`V%tQ z?rLeU)Wj_1EeAuXq6!M0HZ$vg;yS~J61hqvLm9vKhDL2pPsVo{n6uJ0X%{X(V&L+AvvS+kV4o=dR#6j!8~ zz&R1Q`}T)AN(~h1(Y7?@n4?B#ak0m(4)4^5t_dwiz>T?AGSjVq`vA&th%Cao-`~3S z`av1Iwtz|H%go&iLc;(N0RRECNkw>YWo~n6W_ch`a&KgHV{~b6ZXjWBbZmJbO=)s+ zZ*m}0X=iR}Zf77%WqBYxX>Mk6VJl&9bZmJ*Wq5F9ZgXj7c`jpbZ9a(sQ3MkK3IID6 zAq3Hf^A^L&#kqJ6y-3)2F*)7i#kvIoX>$@h0viJb3ke7Z0s005 zwA#*+`Cu!W65A&@v74WIPx0HfmX5N#Bx`iK{sv{KRFDgYa3=vCjsI&~Yv;<3mqB@p z(ffj!0z=0P~^{>6?Dtqg%!cfeVurcM7zAI-ab+=2OR*c1u&s8;7sI V3$tD?H!&37f~Qrpl;2Cw!vhu^JgWcz literal 0 HcmV?d00001