sync.yml

name: Sync workflow
on:
  workflow_dispatch:
    inputs:
      upstream:
        type: choice
        description: Upstream php-src repository
        options:
        - remicollet/php-src-security
        - oerdnj/php-src-security
        - microsoft/php-src
        default: remicollet/php-src-security
        required: true
      run_build:
        type: choice
        description: Trigger workflow_dispatch for shivammathur/php tap
        options:
        - 'true'
        - 'false'
        default: 'true'
        required: true
jobs:
  sync:
    name: sync
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Update tags and branches
        run: |
          push_ref() {
            ref=$1
            git push -f https://${{ github.repository_owner }}:${{ secrets.TOKEN }}@github.com/${{ github.repository }}.git "$ref" || true
          }
          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"
          git remote add up https://github.com/${{ github.event.inputs.upstream }}
          git remote add php https://github.com/php/php-src
          mapfile -t branches < <(git branch -r | sed 's/ *origin\///g')
          mapfile -t tags < <(git tag --sort=-refname | awk 'match($0, /^[0-9]+\.[0-9]+\.[0-9]+/)')
          cp -r patches /tmp
          for branch in "${branches[@]}"; do
            echo "---- $branch ----"
            if [ "$branch" = "main" ]; then
              continue
            fi
            git checkout "$branch"
            git fetch up "$branch"
            git reset --hard up/"$branch"
            tag="$(echo $branch | cut -d '-' -f 2)"
            if [ -e /tmp/patches/"$tag" ]; then
              while read patch; do
                git am < /tmp/patches/"$patch"
              done < /tmp/patches/"$tag"
            fi
            push_ref "$branch"
          done
          for tag in "${tags[@]}"; do
            echo "---- $tag ----"
            git checkout "$tag"
            suffix=""
            [ "${tag%.*}" = "5.6" ] && suffix="openssl11"
            git reset --hard "$(echo "${branches[@]}" | grep -Po "PHP-${tag%.*}-[a-zA-Z-]+$suffix" | head -n 1)"
            git tag -fa "$tag" -m "Update $tag tag"
            push_ref "$tag"
          done
          if [ '${{ github.event.inputs.run_build }}' = 'true' ]; then
            GITHUB_TOKEN=${{ secrets.TOKEN }} gh workflow run build.yml -R shivammathur/homebrew-php
          fi