From 4132ad4801917b265fd9829feb996cf3b228469c Mon Sep 17 00:00:00 2001 From: nick Date: Tue, 13 Oct 2026 17:59:12 +0800 Subject: [PATCH] ci: limit Discord notifications to ARK and arknet --- README.md | 2 +- docs/discord.md | 30 +++++------------ docs/discord_CN.md | 22 ++++--------- scripts/install-notifications.mjs | 55 ------------------------------- 4 files changed, 15 insertions(+), 94 deletions(-) delete mode 100644 scripts/install-notifications.mjs diff --git a/README.md b/README.md index 8b831d9..1617226 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,6 @@ Shared configuration for OpenArkStudio repositories. -- GitHub Actions results are summarized in Discord after each workflow completes. +- ARK and arknet summarize GitHub Actions results in Discord after each workflow completes. - The Webhook is stored in the organization Actions secret `DISCORD_WEBHOOK_URL`. - [Notification setup](docs/discord.md) | [中文说明](docs/discord_CN.md) diff --git a/docs/discord.md b/docs/discord.md index e2e574e..a12262e 100644 --- a/docs/discord.md +++ b/docs/discord.md @@ -2,7 +2,7 @@ [English](discord.md) | [中文](discord_CN.md) -Each repository has `.github/workflows/notify-discord.yml`, which calls the shared +Only ARK and arknet have `.github/workflows/notify-discord.yml`, which calls the shared `discord-summary.yml` workflow in this repository. It reads only the completed workflow's metadata and job results. It does not execute the triggering commit or download its artifacts. A matrix produces one summary per workflow attempt. @@ -15,36 +15,22 @@ rate limits are retried twice; other delivery errors fail the notification job. ## Webhook configuration The organization Actions secret `DISCORD_WEBHOOK_URL` has visibility set to all -repositories. GitHub Free does not provide organization secrets to private -repositories, so TARDIS also has a repository secret with the same name. To move -notifications to another Discord channel, replace the organization secret and -private repository copies. Repository or environment secrets with the same name +repositories. A Secret alone does not enable notifications; the caller workflow +must also exist. To move notifications to another Discord channel, replace the +organization secret. Repository or environment secrets with the same name override the organization secret. Store the incoming Webhook URL without a `/github` suffix. Never commit it. ## Workflow selection -The completion trigger names the source workflows explicitly. The installed -selection covers all existing OpenArkStudio workflows and common names for -repositories that do not yet have Actions. Add new workflow names to the +The completion trigger names the source workflows explicitly. Add new workflow names to the `workflow_run.workflows` list when creating or renaming them. Keep `Discord Notifications` out of that list to prevent notification recursion. Adding this file does not enable existing disabled workflows or add build tests. -For new repositories, copy the notification file from an existing repository. -The organization secret is available to public repositories. Private repositories -on GitHub Free need a repository secret containing the same Webhook URL. - -An organization administrator can also install or synchronize the notification -file across active repositories from this checkout: - -```sh -node scripts/install-notifications.mjs -``` - -This requires Node.js and an authenticated GitHub CLI with repository and -`workflow` permissions. It updates only the notification file on each default -branch, skips archived repositories and verifies each uploaded file. +Other OpenArkStudio repositories do not install a caller. Enabling notifications +for another repository requires an explicit decision and a pull request adding +the caller. Keep changes to ARK and arknet's callers in their own pull requests. ## Resend a completed result diff --git a/docs/discord_CN.md b/docs/discord_CN.md index 879441c..7de9b11 100644 --- a/docs/discord_CN.md +++ b/docs/discord_CN.md @@ -2,7 +2,7 @@ [English](discord.md) | [中文](discord_CN.md) -各仓库的 `.github/workflows/notify-discord.yml` 调用本仓库统一维护的 +仅 ARK 与 arknet 的 `.github/workflows/notify-discord.yml` 调用本仓库统一维护的 `discord-summary.yml`。通知只读取已完成工作流的元数据和任务结果， 不执行触发通知的提交，也不下载其产物。矩阵任务按一次工作流执行汇总为一条消息。 @@ -13,29 +13,19 @@ ## Webhook 配置 组织级 Actions Secret `DISCORD_WEBHOOK_URL` 的可见范围设为所有仓库。 -GitHub Free 不向私有仓库提供组织 Secret，因此 TARDIS 另外配置了同名仓库 Secret。 -切换 Discord 频道时，需要同时修改组织 Secret 和私有仓库中的副本。 +Secret 本身不会启用通知，仓库还需要有通知入口工作流。 +切换 Discord 频道时，修改组织 Secret。 仓库或环境中同名的 Secret 会覆盖组织配置。保存原始 Webhook URL， 不添加 `/github` 后缀，不将地址提交到仓库。 ## 工作流选择 -完成事件显式列出需要通知的工作流名称。已安装的列表覆盖 OpenArkStudio 现有工作流， -并为尚未使用 Actions 的仓库保留常用名称。新增或重命名工作流时，将名称加入 +完成事件显式列出需要通知的工作流名称。新增或重命名工作流时，将名称加入 `workflow_run.workflows`。不要将 `Discord Notifications` 加入列表，避免通知递归。 添加通知文件不会启用已有的停用工作流，也不会增加构建测试。 -新增仓库时，从已有仓库复制通知文件。公共仓库可以使用组织 Secret； -GitHub Free 下的私有仓库需要另外配置同名仓库 Secret，使用同一个 Webhook URL。 - -组织管理员也可以在本仓库中统一安装或同步各活跃仓库的通知文件： - -```sh -node scripts/install-notifications.mjs -``` - -需要 Node.js，以及已登录并具备仓库和 `workflow` 权限的 GitHub CLI。 -脚本只更新各仓库默认分支上的通知文件，跳过归档仓库，并验证每次写入的内容。 +其他 OpenArkStudio 仓库不安装通知入口。需要为其他仓库开启通知时，先明确范围， +再通过 PR 添加入口文件。ARK 和 arknet 的通知配置也通过各自仓库的 PR 修改。 ## 重新发送已完成结果 diff --git a/scripts/install-notifications.mjs b/scripts/install-notifications.mjs deleted file mode 100644 index 447a6b2..0000000 --- a/scripts/install-notifications.mjs +++ /dev/null @@ -1,55 +0,0 @@ -import { readFileSync } from 'node:fs'; -import { spawnSync } from 'node:child_process'; - -const organization = 'OpenArkStudio'; -const path = '.github/workflows/notify-discord.yml'; -const content = readFileSync(new URL('../.github/workflows/notify-discord.yml', import.meta.url), 'utf8'); - -function api(endpoint, body) { - const args = ['api', endpoint]; - if (body) args.push('--method', 'PUT', '--input', '-'); - const result = spawnSync('gh', args, { - encoding: 'utf8', input: body ? JSON.stringify(body) : undefined, - }); - if (result.status !== 0) { - if (!body && result.stderr.includes('(HTTP 404)')) return null; - throw new Error(`GitHub request failed for ${endpoint}`); - } - return JSON.parse(result.stdout); -} - -let failures = 0; -for (let page = 1; ; page++) { - const repos = api(`orgs/${organization}/repos?per_page=100&page=${page}`); - if (!Array.isArray(repos)) throw new Error('Could not read organization repositories'); - for (const repo of repos) { - if (repo.archived) { - console.log(`${repo.full_name}: archived, skipped`); - continue; - } - try { - const endpoint = `repos/${repo.full_name}/contents/${path}`; - const existing = api(`${endpoint}?ref=${encodeURIComponent(repo.default_branch)}`); - if (existing && Buffer.from(existing.content, 'base64').toString('utf8') === content) { - console.log(`${repo.full_name}: already configured`); - continue; - } - const result = api(endpoint, { - message: 'ci: notify Discord when workflows complete', - branch: repo.default_branch, - content: Buffer.from(content).toString('base64'), - ...(existing ? { sha: existing.sha } : {}), - }); - const installed = api(`${endpoint}?ref=${encodeURIComponent(repo.default_branch)}`); - if (Buffer.from(installed.content, 'base64').toString('utf8') !== content) { - throw new Error(`Notification file verification failed for ${repo.full_name}`); - } - console.log(`${repo.full_name}: configured, commit ${result.commit.sha}`); - } catch (error) { - failures++; - console.error(error.message); - } - } - if (repos.length < 100) break; -} -if (failures) process.exitCode = 1;