feat: cache apk downloads at the edge #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: GitHub mirror | |
| # Publishes master to a public github.com repository without Discord's files. The whole history is | |
| # rewritten with .github/mirror-exclude.txt; regenerate that with scripts/mirror_exclude.py after | |
| # importing resources. The rewrite is deterministic, so each run produces the same commits for the | |
| # same input and the push only adds new ones. | |
| # | |
| # Needs, in this repository's settings: | |
| # - secret MIRROR_TOKEN: a fine-grained github.com token with Contents read/write on the mirror | |
| # repository only; | |
| # - variable MIRROR_REPOSITORY: the mirror as owner/name, e.g. an organization's empty repository. | |
| on: | |
| push: | |
| branches: [master] | |
| workflow_dispatch: | |
| concurrency: | |
| group: github-mirror | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| mirror: | |
| runs-on: | |
| group: "enterprise/Default" | |
| labels: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Install git-filter-repo | |
| run: | | |
| python3 -m venv "$RUNNER_TEMP/filter-repo" | |
| "$RUNNER_TEMP/filter-repo/bin/pip" install --quiet git-filter-repo==2.47.0 | |
| - name: Rewrite history without Discord's files | |
| run: | | |
| cp .github/mirror-exclude.txt "$RUNNER_TEMP/mirror-exclude.txt" | |
| "$RUNNER_TEMP/filter-repo/bin/git-filter-repo" --force --refs refs/heads/master \ | |
| --invert-paths --paths-from-file "$RUNNER_TEMP/mirror-exclude.txt" | |
| - name: Refuse to publish anything that slipped through | |
| run: | | |
| leaks=$(git log master --name-only --format= | sort -u \ | |
| | grep -E '\.(so|keystore|jks|png|webp|jpe?g|gif|mp3|ogg|wav|ttf|otf|kw|thw)$|(^|/)jniLibs/|^app/src/main/assets/|google-services\.json$' \ | |
| | grep -vE '^app/src/main/res/mipmap-|^app/src/main/ic_launcher-playstore\.png$' || true) | |
| if [ -n "$leaks" ]; then | |
| echo "$leaks" | |
| echo "::error::Files that must not be mirrored are still in the history; update scripts/mirror_exclude.py" | |
| exit 1 | |
| fi | |
| - name: Push | |
| env: | |
| MIRROR_TOKEN: ${{ secrets.MIRROR_TOKEN }} | |
| MIRROR_REPOSITORY: ${{ vars.MIRROR_REPOSITORY }} | |
| run: | | |
| if [ -z "$MIRROR_TOKEN" ] || [ -z "$MIRROR_REPOSITORY" ]; then | |
| echo "::error::Set the MIRROR_TOKEN secret and the MIRROR_REPOSITORY variable" | |
| exit 1 | |
| fi | |
| git push --force "https://x-access-token:${MIRROR_TOKEN}@github.com/${MIRROR_REPOSITORY}.git" \ | |
| refs/heads/master:refs/heads/master |