[WIP] Ensure updates are pushing to other orgs and repos

.github/workflows/auto-merge.yml

@@ -0,0 +1,132 @@
+# Auto-merge PRs after CI passes
+# Automatically merges approved PRs to main once all checks pass
+
+name: Auto Merge
+
+on:
+  pull_request_review:
+    types: [submitted]
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+jobs:
+  auto-merge:
+    name: Auto Merge PR
+    runs-on: ubuntu-latest
+
+    # Only run on approved PRs targeting main
+    if: |
+      (github.event_name == 'pull_request_review' && github.event.review.state == 'approved') ||
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
+
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get PR info
+        id: pr
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Get PR number from the event
+          if [ "${{ github.event_name }}" == "pull_request_review" ]; then
+            PR_NUMBER="${{ github.event.pull_request.number }}"
+          elif [ "${{ github.event_name }}" == "workflow_run" ]; then
+            # Extract PR number from workflow run
+            PR_NUMBER=$(gh pr list --json number,headRefName --jq '.[] | select(.headRefName=="${{ github.event.workflow_run.head_branch }}") | .number' | head -1)
+          else
+            echo "No PR found for event type: ${{ github.event_name }}"
+            exit 1
+          fi
+
+          if [ -z "$PR_NUMBER" ]; then
+            echo "No PR number found for event ${{ github.event_name }}"
+            exit 1
+          fi
+
+          echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+
+          # Get PR details
+          PR_DATA=$(gh pr view $PR_NUMBER --json number,title,state,mergeable,reviewDecision,statusCheckRollup)
+
+          echo "$PR_DATA" | jq .
+
+          STATE=$(echo "$PR_DATA" | jq -r .state)
+          MERGEABLE=$(echo "$PR_DATA" | jq -r .mergeable)
+          REVIEW_DECISION=$(echo "$PR_DATA" | jq -r .reviewDecision)
+
+          echo "state=$STATE" >> $GITHUB_OUTPUT
+          echo "mergeable=$MERGEABLE" >> $GITHUB_OUTPUT
+          echo "review_decision=$REVIEW_DECISION" >> $GITHUB_OUTPUT
+
+      - name: Check merge conditions
+        id: check
+        run: |
+          STATE="${{ steps.pr.outputs.state }}"
+          MERGEABLE="${{ steps.pr.outputs.mergeable }}"
+          REVIEW_DECISION="${{ steps.pr.outputs.review_decision }}"
+
+          echo "PR State: $STATE"
+          echo "Mergeable: $MERGEABLE"
+          echo "Review Decision: $REVIEW_DECISION"
+
+          # Check conditions
+          CAN_MERGE=false
+
+          if [ "$STATE" == "OPEN" ] && \
+             [ "$MERGEABLE" == "MERGEABLE" ] && \
+             [ "$REVIEW_DECISION" == "APPROVED" ]; then
+            CAN_MERGE=true
+          fi
+
+          echo "can_merge=$CAN_MERGE" >> $GITHUB_OUTPUT
+
+          if [ "$CAN_MERGE" == "true" ]; then
+            echo "✓ All conditions met for auto-merge"
+          else
+            echo "⚠️  Conditions not met:"
+            [ "$STATE" != "OPEN" ] && echo "  - PR is not open"
+            [ "$MERGEABLE" != "MERGEABLE" ] && echo "  - PR has conflicts or is not mergeable"
+            [ "$REVIEW_DECISION" != "APPROVED" ] && echo "  - PR is not approved"
+          fi
+
+      - name: Auto-merge PR
+        if: steps.check.outputs.can_merge == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER="${{ steps.pr.outputs.pr_number }}"
+
+          echo "🚀 Auto-merging PR #$PR_NUMBER to main..."
+
+          # Enable auto-merge with squash, with explicit error handling
+          if ! gh pr merge "$PR_NUMBER" --auto --squash --delete-branch; then
+            echo "❌ Failed to enable auto-merge for PR #$PR_NUMBER. Please check the PR status, required approvals, branch protection rules, and GitHub API availability."
+            exit 1
+          fi
+
+          echo "✓ Auto-merge enabled"
+
+      - name: Comment on PR
+        if: steps.check.outputs.can_merge == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER="${{ steps.pr.outputs.pr_number }}"
+
+          gh pr comment $PR_NUMBER --body "🤖 Auto-merge enabled. This PR will be merged automatically once all status checks pass."
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "🎯 Auto-merge Summary"
+          echo ""
+          echo "PR: #${{ steps.pr.outputs.pr_number }}"
+          echo "State: ${{ steps.pr.outputs.state }}"
+          echo "Can merge: ${{ steps.check.outputs.can_merge }}"
+          echo "Status: ${{ job.status }}"

.github/workflows/ci.yml

@@ -179,12 +179,40 @@ jobs:
           print(f'✓ registry.yaml: {len(reg[\"orgs\"])} orgs, {len(reg[\"rules\"])} rules')
           "
 
+  # Test sync functionality
+  test-sync:
+    name: Test Sync
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install dependencies
+        run: pip install pyyaml
+
+      - name: Run sync tests
+        run: |
+          chmod +x tests/test_sync.py
+          python tests/test_sync.py
+
   # Signal summary job
   summary:
     name: CI Summary
     runs-on: ubuntu-latest
-    needs: [lint, test-operator, test-dispatcher, test-webhooks, validate-config]
+    needs: [lint, test-operator, test-dispatcher, test-webhooks, validate-config, test-sync]
     if: always()
+
+    permissions:
+      contents: read
+
     steps:
       - name: Check results
         run: |
@@ -196,3 +224,4 @@ jobs:
           echo "  Dispatcher: ${{ needs.test-dispatcher.result }}"
           echo "  Webhooks:   ${{ needs.test-webhooks.result }}"
           echo "  Config:     ${{ needs.validate-config.result }}"
+          echo "  Sync:       ${{ needs.test-sync.result }}"

.github/workflows/sync-to-orgs.yml

@@ -0,0 +1,197 @@
+# Sync shared workflows and configs to other org repos
+# This workflow pushes templates and shared files to target organizations
+
+name: Sync to Orgs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'templates/**'
+      - '.github/workflows/**'
+      - '!.github/workflows/sync-to-orgs.yml'
+      - 'routes/registry.yaml'
+  workflow_dispatch:
+    inputs:
+      target_orgs:
+        description: 'Target orgs (comma-separated, or "all")'
+        required: false
+        default: 'all'
+        type: string
+      dry_run:
+        description: 'Dry run (test without pushing)'
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  sync:
+    name: Sync to Organizations
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: pip install pyyaml requests
+
+      - name: Load registry
+        id: registry
+        run: |
+          python -c "
+          import yaml
+          import json
+
+          with open('routes/registry.yaml') as f:
+              registry = yaml.safe_load(f)
+
+          # Extract active orgs
+          orgs = []
+          for code, org in registry.get('orgs', {}).items():
+              if org.get('status') == 'active':
+                  orgs.append({
+                      'code': code,
+                      'name': org['name'],
+                      'github': org['github'],
+                      'repos': org.get('repos', [])
+                  })
+
+          print(f'Found {len(orgs)} active orgs')
+          for org in orgs:
+              print(f'  - {org[\"code\"]}: {org[\"name\"]}')
+
+          # Output for next steps
+          with open('$GITHUB_OUTPUT', 'a') as f:
+              f.write(f'orgs={json.dumps(orgs)}\\n')
+          "
+
+      - name: Dispatch to target orgs
+        env:
+          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN || secrets.GITHUB_TOKEN }}
+          TARGET_ORGS: ${{ inputs.target_orgs || 'all' }}
+          DRY_RUN: ${{ inputs.dry_run || 'false' }}
+          ORGS_JSON: ${{ steps.registry.outputs.orgs }}
+        run: |
+          echo "🎯 Dispatching sync to organizations..."
+          echo ""
+
+          python -c "
+          import os
+          import json
+          import requests
+
+          token = os.environ.get('GITHUB_TOKEN')
+          target_input = os.environ.get('TARGET_ORGS', 'all')
+          dry_run = os.environ.get('DRY_RUN', 'false').lower() == 'true'
+          orgs = json.loads(os.environ.get('ORGS_JSON', '[]'))
+
+          # Parse target orgs
+          if target_input == 'all':
+              target_codes = [org['code'] for org in orgs]
+          else:
+              target_codes = [c.strip() for c in target_input.split(',')]
+
+          print(f'Target orgs: {target_codes}')
+          print(f'Dry run: {dry_run}')
+          print('')
+
+          # Track failures
+          failures = []
+
+          # Dispatch to each target org
+          for org in orgs:
+              if org['code'] not in target_codes:
+                  continue
+
+              print(f'📡 {org[\"code\"]}: {org[\"name\"]}')
+
+              # For each repo in the org, dispatch a workflow
+              for repo in org.get('repos', []):
+                  repo_url = repo['url']
+
+                  # Extract owner/repo from URL
+                  parts = repo_url.replace('https://github.com/', '').split('/')
+                  if len(parts) < 2:
+                      continue
+
+                  owner = parts[0]
+                  repo_slug = parts[1]
+
+                  print(f'  -> {owner}/{repo_slug}')
+
+                  if dry_run:
+                      print(f'     [DRY RUN] Would dispatch to {owner}/{repo_slug}')
+                      continue
+
+                  # Send repository_dispatch event
+                  url = f'https://api.github.com/repos/{owner}/{repo_slug}/dispatches'
+                  headers = {
+                      'Authorization': f'token {token}',
+                      'Accept': 'application/vnd.github.v3+json'
+                  }
+                  # Derive head commit timestamp from the GitHub event payload
+                  head_commit_timestamp = None
+                  event_path = os.environ.get('GITHUB_EVENT_PATH')
+                  if event_path:
+                      try:
+                          with open(event_path, 'r', encoding='utf-8') as f:
+                              event = json.load(f)
+                          head_commit = event.get('head_commit') or {}
+                          head_commit_timestamp = head_commit.get('timestamp')
+                      except Exception:
+                          head_commit_timestamp = None
+                  payload = {
+                      'event_type': 'sync_from_bridge',
+                      'client_payload': {
+                          'source': 'BlackRoad-OS/.github',
+                          'ref': os.environ.get('GITHUB_SHA', 'main'),
+                          'timestamp': head_commit_timestamp
+                      }
+                  }
+
+                  try:
+                      resp = requests.post(url, json=payload, headers=headers, timeout=30)
+                      if resp.status_code == 204:
+                          print(f'     ✓ Dispatched')
+                      elif resp.status_code == 404:
+                          msg = f'{owner}/{repo_slug}: Repo not found or no dispatch workflow'
+                          print(f'     ⚠️  {msg}')
+                          failures.append(msg)
+                      else:
+                          msg = f'{owner}/{repo_slug}: HTTP {resp.status_code}'
+                          print(f'     ❌ {msg}')
+                          failures.append(msg)
+                  except Exception as e:
+                      msg = f'{owner}/{repo_slug}: {e}'
+                      print(f'     ❌ {msg}')
+                      failures.append(msg)
+
+          print('')
+          if failures:
+              print(f'⚠️  {len(failures)} dispatch(es) failed:')
+              for failure in failures:
+                  print(f'  - {failure}')
+              print('')
+              print('Note: 404 errors are expected if target repos have not set up dispatch workflows yet.')
+          else:
+              print('✓ All dispatches successful')
+          "
+
+      - name: Summary
+        run: |
+          echo "📡 Sync Summary"
+          echo ""
+          echo "Status: ${{ job.status }}"
+          echo "Trigger: ${{ github.event_name }}"
+          echo "Branch: ${{ github.ref_name }}"
+          echo "Commit: ${{ github.sha }}"