From 2ccdd43066a2c256b93ff32732c6d7b3cdc73708 Mon Sep 17 00:00:00 2001 From: Antonio Ceppellini Date: Tue, 25 Aug 2026 17:35:58 +0200 Subject: [PATCH 1/4] new graphify update workflow --- .github/workflows/graphify.yaml | 157 ++++++++++++++++++++++++++++++++ 1 file changed, 157 insertions(+) create mode 100644 .github/workflows/graphify.yaml diff --git a/.github/workflows/graphify.yaml b/.github/workflows/graphify.yaml new file mode 100644 index 00000000..d532af3e --- /dev/null +++ b/.github/workflows/graphify.yaml @@ -0,0 +1,157 @@ +# Copyright 2026 Zaphiro Technologies +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +name: Update Graphify Code Graph + +on: + workflow_call: + secrets: + APP_ID: + required: true + APP_SECRET: + required: true + +permissions: + contents: read + +concurrency: + group: ${{ github.repository }}-${{ github.event.pull_request.number }}-graphify + cancel-in-progress: true + +jobs: + update-graph: + name: Update Graphify code graph + runs-on: ubuntu-latest + + # We need write access to the PR branch, so fork PRs are intentionally skipped. + if: ${{ github.event.pull_request.head.repo.full_name == github.repository }} + + env: + GRAPHIFY_OUT: .graphify + GRAPHIFY_VERSION: "0.9.48" + + steps: + - name: Generate GitHub App token + uses: actions/create-github-app-token@v3 + id: generate-token + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_SECRET }} + repositories: ${{ github.event.repository.name }} + permission-contents: write + + - name: Checkout PR branch + uses: actions/checkout@v7.0.1 + with: + ref: ${{ github.event.pull_request.head.ref }} + token: ${{ steps.generate-token.outputs.token }} + fetch-depth: 0 + + # A Graphify commit triggers a new synchronize event because we use + # a GitHub App token. Skip that run to avoid updating the graph twice. + - name: Check for Graphify-generated commit + id: guard + shell: bash + run: | + if git log -1 --pretty=%B | grep -Fq '[graphify skip]'; then + echo "Graphify-generated commit detected. Skipping." + echo "skip=true" >> "$GITHUB_OUTPUT" + else + echo "skip=false" >> "$GITHUB_OUTPUT" + fi + + - name: Set up Python + if: steps.guard.outputs.skip != 'true' + id: setup-python + uses: actions/setup-python@v7.0.0 + with: + python-version: "3.12" + + - name: Install Graphify + if: steps.guard.outputs.skip != 'true' + env: + PIPX_DEFAULT_PYTHON: ${{ steps.setup-python.outputs.python-path }} + run: pipx install "graphifyy==${GRAPHIFY_VERSION}" + + - name: Verify Graphify graph + if: steps.guard.outputs.skip != 'true' + shell: bash + run: | + test -f "${GRAPHIFY_OUT}/graph.json" || { + echo "::error::${GRAPHIFY_OUT}/graph.json does not exist" + exit 1 + } + + test -f "${GRAPHIFY_OUT}/manifest.json" || { + echo "::error::${GRAPHIFY_OUT}/manifest.json does not exist" + exit 1 + } + + - name: Update Graphify graph + if: steps.guard.outputs.skip != 'true' + run: graphify update . + + - name: Check Graphify changes + if: steps.guard.outputs.skip != 'true' + id: changes + shell: bash + run: | + if git diff --quiet -- \ + "${GRAPHIFY_OUT}/graph.json" \ + "${GRAPHIFY_OUT}/manifest.json"; then + echo "Graph is already up to date." + echo "changed=false" >> "$GITHUB_OUTPUT" + else + echo "Graph changes detected." + echo "changed=true" >> "$GITHUB_OUTPUT" + fi + + # Other workflows in the repository may also modify the PR branch + # (for example automated lint fixes). Never commit a graph generated + # from an outdated PR head. + - name: Check PR branch is still current + if: steps.changes.outputs.changed == 'true' + id: freshness + shell: bash + env: + BRANCH: ${{ github.event.pull_request.head.ref }} + run: | + git fetch origin "$BRANCH" + + LOCAL_SHA="$(git rev-parse HEAD)" + REMOTE_SHA="$(git rev-parse "origin/$BRANCH")" + + if [ "$LOCAL_SHA" != "$REMOTE_SHA" ]; then + echo "PR branch changed while Graphify was running." + echo "A new synchronize event will update the graph." + echo "current=false" >> "$GITHUB_OUTPUT" + else + echo "current=true" >> "$GITHUB_OUTPUT" + fi + + - name: Commit Graphify graph + if: | + steps.changes.outputs.changed == 'true' && + steps.freshness.outputs.current == 'true' + shell: bash + run: | + git config --global user.name 'Bot' + git config --global user.email 'bot@zaphiro.ch' + + git add \ + "${GRAPHIFY_OUT}/graph.json" \ + "${GRAPHIFY_OUT}/manifest.json" + + git commit -m "chore: update Graphify code graph [graphify skip]" + git push From 0852c45adf466542f96169434a1d5a1a9a7676cf Mon Sep 17 00:00:00 2001 From: Antonio Ceppellini Date: Wed, 26 Aug 2026 09:41:53 +0200 Subject: [PATCH 2/4] updating graphify workflow --- .github/workflows/graphify.yaml | 47 ++++++++++++++++++++++++--------- 1 file changed, 35 insertions(+), 12 deletions(-) diff --git a/.github/workflows/graphify.yaml b/.github/workflows/graphify.yaml index d532af3e..e2132626 100644 --- a/.github/workflows/graphify.yaml +++ b/.github/workflows/graphify.yaml @@ -58,8 +58,7 @@ jobs: token: ${{ steps.generate-token.outputs.token }} fetch-depth: 0 - # A Graphify commit triggers a new synchronize event because we use - # a GitHub App token. Skip that run to avoid updating the graph twice. + # A Graphify commit triggers another synchronize event. - name: Check for Graphify-generated commit id: guard shell: bash @@ -98,6 +97,13 @@ jobs: exit 1 } + - name: Save Graphify outputs + if: steps.guard.outputs.skip != 'true' + shell: bash + run: | + cp "${GRAPHIFY_OUT}/graph.json" /tmp/graphify-graph-before.json + cp "${GRAPHIFY_OUT}/manifest.json" /tmp/graphify-manifest-before.json + - name: Update Graphify graph if: steps.guard.outputs.skip != 'true' run: graphify update . @@ -107,19 +113,36 @@ jobs: id: changes shell: bash run: | - if git diff --quiet -- \ - "${GRAPHIFY_OUT}/graph.json" \ - "${GRAPHIFY_OUT}/manifest.json"; then - echo "Graph is already up to date." - echo "changed=false" >> "$GITHUB_OUTPUT" - else - echo "Graph changes detected." + jq 'with_entries(.value |= del(.mtime, .seen))' \ + /tmp/graphify-manifest-before.json > /tmp/graphify-manifest-before-normalized.json + jq 'with_entries(.value |= del(.mtime, .seen))' \ + "${GRAPHIFY_OUT}/manifest.json" > /tmp/graphify-manifest-after-normalized.json + + graph_changed=false + if ! git diff --quiet -- "${GRAPHIFY_OUT}/graph.json"; then + graph_changed=true + fi + + manifest_changed=false + if ! cmp -s /tmp/graphify-manifest-before-normalized.json \ + /tmp/graphify-manifest-after-normalized.json; then + manifest_changed=true + fi + + if [ "$graph_changed" = "true" ] || [ "$manifest_changed" = "true" ]; then + echo "Meaningful Graphify changes detected." echo "changed=true" >> "$GITHUB_OUTPUT" + else + echo "Only volatile manifest metadata changed; restoring outputs." + cp /tmp/graphify-graph-before.json "${GRAPHIFY_OUT}/graph.json" + cp /tmp/graphify-manifest-before.json "${GRAPHIFY_OUT}/manifest.json" + git diff --quiet -- \ + "${GRAPHIFY_OUT}/graph.json" \ + "${GRAPHIFY_OUT}/manifest.json" + echo "changed=false" >> "$GITHUB_OUTPUT" fi - # Other workflows in the repository may also modify the PR branch - # (for example automated lint fixes). Never commit a graph generated - # from an outdated PR head. + # Never commit a graph generated from an outdated PR head. - name: Check PR branch is still current if: steps.changes.outputs.changed == 'true' id: freshness From fdbf4e24f6a032bcf1110552403cb1a8cece409b Mon Sep 17 00:00:00 2001 From: Antonio Ceppellini Date: Thu, 27 Aug 2026 15:42:39 +0200 Subject: [PATCH 3/4] fixed lint --- .github/workflows/graphify.yaml | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/.github/workflows/graphify.yaml b/.github/workflows/graphify.yaml index e2132626..0df3e920 100644 --- a/.github/workflows/graphify.yaml +++ b/.github/workflows/graphify.yaml @@ -1,16 +1,28 @@ # Copyright 2026 Zaphiro Technologies + # -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. + +# Licensed under the Apache License, Version 2.0 (the "License") + +# you may not use this file except in compliance with the License + # You may obtain a copy of the License at + # -# http://www.apache.org/licenses/LICENSE-2.0 + +# + # + # Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + +# distributed under the License is distributed on an "AS IS" BASIS + +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied + # See the License for the specific language governing permissions and -# limitations under the License. + +# limitations under the License name: Update Graphify Code Graph @@ -26,7 +38,8 @@ permissions: contents: read concurrency: - group: ${{ github.repository }}-${{ github.event.pull_request.number }}-graphify + group: + ${{ github.repository }}-${{ github.event.pull_request.number }}-graphify cancel-in-progress: true jobs: @@ -35,7 +48,8 @@ jobs: runs-on: ubuntu-latest # We need write access to the PR branch, so fork PRs are intentionally skipped. - if: ${{ github.event.pull_request.head.repo.full_name == github.repository }} + if: + ${{ github.event.pull_request.head.repo.full_name == github.repository }} env: GRAPHIFY_OUT: .graphify From f38383af76f9d3faca988367936d8baf9c9249ca Mon Sep 17 00:00:00 2001 From: Bot Date: Thu, 27 Aug 2026 13:43:43 +0000 Subject: [PATCH 4/4] Automated yaml-lint fixes [dependabot skip] --- .github/workflows/graphify.yaml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/graphify.yaml b/.github/workflows/graphify.yaml index 0df3e920..4ee9fe3f 100644 --- a/.github/workflows/graphify.yaml +++ b/.github/workflows/graphify.yaml @@ -38,8 +38,7 @@ permissions: contents: read concurrency: - group: - ${{ github.repository }}-${{ github.event.pull_request.number }}-graphify + group: ${{ github.repository }}-${{ github.event.pull_request.number }}-graphify cancel-in-progress: true jobs: @@ -48,8 +47,7 @@ jobs: runs-on: ubuntu-latest # We need write access to the PR branch, so fork PRs are intentionally skipped. - if: - ${{ github.event.pull_request.head.repo.full_name == github.repository }} + if: ${{ github.event.pull_request.head.repo.full_name == github.repository }} env: GRAPHIFY_OUT: .graphify