Generalize NSC promotion workflow

AnastaZIuk · AnastaZIuk · commit 52795a97f65c · 2026-03-15T16:02:58.000+01:00
diff --git a/.github/workflows/promote-nsc-channel.yml b/.github/workflows/promote-nsc-channel.yml
@@ -6,10 +6,26 @@ on:
       run_id:
         description: "Workflow run id that produced the NSC payload and manifests artifacts"
         required: true
+      source_repo:
+        description: "Repository that owns the source workflow run"
+        required: true
+        default: "Devsh-Graphics-Programming/Nabla"
+      source_branch:
+        description: "Expected source branch for the workflow run"
+        required: true
+        default: "master"
+      target_repo:
+        description: "Repository that should receive the manifest update PR"
+        required: true
+        default: "Devsh-Graphics-Programming/Nabla"
       target_branch:
         description: "Nabla branch that should receive the manifest update PR"
         required: true
         default: "master"
+      asset_repo:
+        description: "Repository that stores the promoted NSC channel releases"
+        required: true
+        default: "Devsh-Graphics-Programming/Nabla-Asset-Manifests"
       channel:
         description: "NSC manifest channel to promote"
         required: true
@@ -23,8 +39,12 @@ jobs:
   promote:
     runs-on: ubuntu-latest
     env:
-      SOURCE_REPO: ${{ github.repository }}
-      ASSET_REPO: Devsh-Graphics-Programming/Nabla-Asset-Manifests
+      SOURCE_REPO: ${{ inputs.source_repo }}
+      SOURCE_BRANCH: ${{ inputs.source_branch }}
+      TARGET_REPO: ${{ inputs.target_repo }}
+      ASSET_REPO: ${{ inputs.asset_repo }}
+      HEAD_REPO: ${{ github.repository }}
+      HEAD_OWNER: ${{ github.repository_owner }}
       CHANNEL: ${{ inputs.channel }}
       TARGET_BRANCH: ${{ inputs.target_branch }}
       RUN_ID: ${{ inputs.run_id }}
@@ -33,8 +53,10 @@ jobs:
       - name: Checkout target branch
         uses: actions/checkout@v4
         with:
+          repository: ${{ inputs.target_repo }}
           ref: ${{ inputs.target_branch }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Resolve source run metadata
         id: source-run
@@ -55,6 +77,10 @@ jobs:
             echo "Run ${RUN_ID} is not promotable: status=${status} conclusion=${conclusion}" >&2
             exit 1
           fi
+          if [[ "${head_branch}" != "${SOURCE_BRANCH}" ]]; then
+            echo "Run ${RUN_ID} head branch ${head_branch} does not match expected ${SOURCE_BRANCH}" >&2
+            exit 1
+          fi
 
           release_tag="${CHANNEL}-${head_sha}"
           target_branch_slug="$(printf '%s' "${TARGET_BRANCH}" | tr '/._' '-' | tr -cd '[:alnum:]-')"
@@ -76,7 +102,7 @@ jobs:
           name: ${{ inputs.channel }}-payload
           path: ${{ runner.temp }}/nsc-payload
           github-token: ${{ secrets.READ_PAT }}
-          repository: ${{ github.repository }}
+          repository: ${{ inputs.source_repo }}
 
       - name: Download NSC manifests artifact
         uses: actions/download-artifact@v4
@@ -85,7 +111,7 @@ jobs:
           name: ${{ inputs.channel }}-manifests
           path: ${{ runner.temp }}/nsc-manifests
           github-token: ${{ secrets.READ_PAT }}
-          repository: ${{ github.repository }}
+          repository: ${{ inputs.source_repo }}
 
       - name: Publish release to manifest backend
         env:
@@ -178,6 +204,8 @@ jobs:
 
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote rename origin upstream
+          git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${HEAD_REPO}.git"
           git checkout -B "${PR_BRANCH}"
           git add tools/nsc/manifests
           git commit -m "Promote NSC channel ${SOURCE_SHA}"
@@ -187,18 +215,31 @@ jobs:
         if: steps.manifest-diff.outputs.has_changes == 'true'
         id: pr
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_BUILTIN_TOKEN: ${{ github.token }}
+          PR_PAT: ${{ secrets.PR_PAT }}
           PR_BRANCH: ${{ steps.source-run.outputs.pr_branch }}
           RELEASE_TAG: ${{ steps.source-run.outputs.release_tag }}
           SOURCE_SHA: ${{ steps.source-run.outputs.source_sha }}
           RUN_URL: ${{ steps.source-run.outputs.run_url }}
         run: |
           set -euo pipefail
 
+          if [[ "${TARGET_REPO}" == "${HEAD_REPO}" ]]; then
+            export GH_TOKEN="${GH_BUILTIN_TOKEN}"
+            pr_head="${PR_BRANCH}"
+          else
+            if [[ -z "${PR_PAT}" ]]; then
+              echo "PR_PAT secret is required when opening a PR from ${HEAD_REPO} to ${TARGET_REPO}" >&2
+              exit 1
+            fi
+            export GH_TOKEN="${PR_PAT}"
+            pr_head="${HEAD_OWNER}:${PR_BRANCH}"
+          fi
+
           existing_pr="$(gh pr list \
-            --repo "${SOURCE_REPO}" \
+            --repo "${TARGET_REPO}" \
             --base "${TARGET_BRANCH}" \
-            --head "${PR_BRANCH}" \
+            --head "${pr_head}" \
             --json url \
             --jq '.[0].url')"
 
@@ -217,9 +258,9 @@ jobs:
           EOF
 
           pr_url="$(gh pr create \
-            --repo "${SOURCE_REPO}" \
+            --repo "${TARGET_REPO}" \
             --base "${TARGET_BRANCH}" \
-            --head "${PR_BRANCH}" \
+            --head "${pr_head}" \
             --title "Promote NSC channel to ${SOURCE_SHA}" \
             --body-file "${body_file}")"
 
@@ -231,9 +272,11 @@ jobs:
             echo "## NSC promotion summary"
             echo
             echo "- channel: \`${CHANNEL}\`"
+            echo "- source repo: \`${SOURCE_REPO}\`"
             echo "- source run: \`${RUN_ID}\`"
             echo "- source commit: \`${{ steps.source-run.outputs.source_sha }}\`"
             echo "- release tag: \`${{ steps.source-run.outputs.release_tag }}\`"
+            echo "- target repo: \`${TARGET_REPO}\`"
             echo "- target branch: \`${TARGET_BRANCH}\`"
             if [[ "${{ steps.manifest-diff.outputs.has_changes }}" == "true" ]]; then
               echo "- PR: ${{ steps.pr.outputs.url }}"
diff --git a/docs/nsc-channel-promotion.md b/docs/nsc-channel-promotion.md
@@ -65,8 +65,16 @@ Inputs:
 
 - `run_id`
   - workflow run that produced the source artifacts
+- `source_repo`
+  - repo that owns the source workflow run
+- `source_branch`
+  - expected branch for the source workflow run
+- `target_repo`
+  - repo that should receive the manifest update PR
 - `target_branch`
   - Nabla branch that should receive the manifest update PR
+- `asset_repo`
+  - repo that stores the promoted channel releases
 - `channel`
   - manifest channel to promote
 
@@ -77,5 +85,12 @@ The workflow does four things:
 3. updates the committed `.dvc` tree and `<channel>.tag`
 4. opens a PR against the requested `target_branch`
 
-For production use the expected target is `master`.
-For smoke tests the same workflow can target a branch such as `nsc-channel`.
+For production use the defaults are:
+
+- `source_repo=Devsh-Graphics-Programming/Nabla`
+- `source_branch=master`
+- `target_repo=Devsh-Graphics-Programming/Nabla`
+- `target_branch=master`
+- `asset_repo=Devsh-Graphics-Programming/Nabla-Asset-Manifests`
+
+For fork-hosted smoke tests the same workflow can run from a fork repository, read artifacts from an official branch such as `nsc-channel`, publish the release to `Nabla-Asset-Manifests`, and open a PR from the fork back to the requested upstream branch.
