carbon-lang/.github/workflows/sync_repos.yaml

# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
# Exceptions. See /LICENSE for license information.
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

name: Sync repos

on:
  push:
    branches: [trunk]
    paths:
      # Minimize where we run this to changes to the top-level files and
      # specific trees that we sync to other repositories.
      - '*'
      - 'utils/**'
      # Also run if the action itself is updated.
      - '.github/workflows/sync_repos.yaml'
      - 'scripts/sync_repos.sh'

# Note the sync script has its own token.
permissions:
  contents: read # For actions/checkout.

jobs:
  sync-repos:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      # Checkout our main repository.
      - name: Checkout the main repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Run the sync script.
      - name: Sync to other repositories
        env:
          API_TOKEN_GITHUB: ${{ secrets.SYNC_REPOS_API_TOKEN_GITHUB }}
        run: ./scripts/sync_repos.sh