instant-sync.yml

# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
# Instant Forge Sync - Triggers propagation to all forges on push/release
name: "⚙ Auto: Instant sync"
on:
  # Automatic propagation stays off until FARM_DISPATCH_TOKEN and a canary
  # dispatch have been verified. This prevents one push becoming fleet fan-out.
  workflow_dispatch:
permissions:
  contents: read
jobs:
  dispatch:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      # Secrets are only readable in step-level env (a job-level `if:` on
      # secrets is a parse-time startup_failure), so gate here.
      - name: Gate on FARM_DISPATCH_TOKEN presence
        id: gate
        env:
          FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
        run: |
          if [ -z "$FARM_DISPATCH_TOKEN" ]; then
            echo "::notice::FARM_DISPATCH_TOKEN not configured; skipping dispatch"
            echo "present=false" >> "$GITHUB_OUTPUT"
          else
            echo "present=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Trigger Propagation
        if: steps.gate.outputs.present == 'true'
        uses: peter-evans/repository-dispatch@v4.0.1
        with:
          token: ${{ secrets.FARM_DISPATCH_TOKEN }}
          repository: hyperpolymath/.git-private-farm
          event-type: propagate
          client-payload: |-
            {
              "repo": "${{ github.event.repository.name }}",
              "ref": "${{ github.ref }}",
              "sha": "${{ github.sha }}",
              "forges": ""
            }
      - name: Confirm
        env:
          REPO_NAME: ${{ github.event.repository.name }}
        run: echo "::notice::Propagation triggered for ${REPO_NAME}"