wordpress-develop/.github/workflows/failed-workflow.yml
John Blackbourn 3bfc6611ad Build/Test Tools: Restrict the permissions granted to jobs on GitHub Actions
The `permissions` key in a job declares the GitHub permissions that are granted to the token that's used by the job. Restricting the permissions reduces the impact that a vulnerability in the CI system can have.

Props desrosj, johnbillion

See #57865


git-svn-id: https://develop.svn.wordpress.org/trunk@55715 602fd350-edb4-49c9-b593-d223f7449a82
2023-05-03 22:15:27 +00:00

55 lines
1.6 KiB
YAML

##
# Performs follow-up tasks when a workflow fails or is cancelled.
##
name: Failed Workflow
on:
workflow_dispatch:
inputs:
run_id:
description: 'ID of the GitHub Action workflow run to rerun'
required: true
type: 'string'
# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
permissions: {}
jobs:
# Attempts to rerun a workflow.
#
# Performs the following steps:
# - Retrieves the workflow run that dispatched this workflow.
# - Restarts all failed jobs when the workflow fails or is cancelled for the first time.
failed-workflow:
name: Rerun a workflow
runs-on: ubuntu-latest
permissions:
actions: write
timeout-minutes: 5
steps:
- name: Rerun a workflow
uses: actions/github-script@98814c53be79b1d30f795b907e553d8679345975 # v6.4.0
with:
retries: 2
retry-exempt-status-codes: 418
script: |
const workflow_run = await github.rest.actions.getWorkflowRun({
owner: context.repo.owner,
repo: context.repo.repo,
run_id: ${{ inputs.run_id }},
});
// Only rerun after the first run attempt.
if ( workflow_run.data.run_attempt > 1 ) {
return;
}
const rerun = await github.rest.actions.reRunWorkflowFailedJobs({
owner: context.repo.owner,
repo: context.repo.repo,
run_id: ${{ inputs.run_id }},
enable_debug_logging: true
});