instant-sync.yml

# SPDX-License-Identifier: MPL-2.0
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <jonathan.jewell@open.ac.uk>
# Instant Forge Sync - Triggers propagation to all forges on push/release
name: Instant Sync
env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
on:
  push:
    branches: [main, master]
  release:
    types: [published]
permissions:
  actions: read
  contents: read
jobs:
  dispatch:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Surface the token as an env var so the step below can test for its
    # presence. ⚠ The `secrets` context is NOT available in a job-level `if:`
    # — a workflow that tries it is REJECTED BEFORE ANY JOB IS CREATED,
    # producing a `startup_failure` with no log and no check run. That fault
    # silently killed CI in 51 estate repositories, so the gate is written as
    # a step-level test against `env`, which is valid.
    env:
      FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
    steps:
      - name: Trigger Propagation
        # Without this the action runs with an empty token and fails with an
        # opaque auth error on every fork and every repo where the secret is
        # not configured. Hypatia's
        # workflow_audit/secret_action_without_presence_gate reports it.
        if: env.FARM_DISPATCH_TOKEN != ''
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
        with:
          token: ${{ secrets.FARM_DISPATCH_TOKEN }}
          repository: hyperpolymath/.git-private-farm
          event-type: propagate
          client-payload: |-
            {
              "repo": "${{ github.event.repository.name }}",
              "ref": "${{ github.ref }}",
              "sha": "${{ github.sha }}",
              "forges": ""
            }
      - name: Confirm
        run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"