kjnb,nb

.github/workflows/check_staging_merge.yaml

@@ -0,0 +1,14 @@
+name: Staging into main
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  check_staging_to_main:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if source is staging
+        if: github.head_ref == 'staging' or github.head_ref == 'prod-promotion'
+        run: echo "PR is from staging to main"

.github/workflows/codeql.yml

@@ -13,9 +13,13 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ "main" ]
+    branches:
+      - "staging"
+      - "main"
   pull_request:
-    branches: [ "main" ]
+    branches:
+      - "staging"
+      - "main"
   schedule:
     - cron: '23 12 * * 3'
 

.github/workflows/promote-to-master.yaml

@@ -0,0 +1,57 @@
+name: Open PR from staging to master
+on:
+  schedule:
+    - cron: "0 12 * * 3" # Wednesday at 12pm UTC
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+env:
+  author: "${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>"
+  committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
+
+jobs:
+  prod-promotion:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup Github Token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 #v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+
+      - name: Reset staging branch
+        run: |
+          git fetch origin staging:staging
+          git reset --hard staging
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Set branch and PR names
+        id: env-vars
+        run: |
+          echo "pr_title=Promote Staging to Master - ${{ steps.date.outputs.date }}" >> $GITHUB_OUTPUT
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 #v8.1.1
+        with:
+          branch: prod-promotion
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: Update dependencies
+          title: ${{ steps.env-vars.outputs.pr_title }}
+          author: ${{ env.author }}
+          committer: ${{ env.committer }}
+          body: |
+            Automated promotion PR to copy contents from `staging` to `master`.
+
+            This PR was automatically created by the environment promotion workflow.
+          labels: |
+            automated
+            environment-promotion

config.schema.yaml

@@ -6,7 +6,7 @@ smtp_accounts:
   items:
     type: "object"
     required: true
-    properties:
+    properties:m,.n,mn
       name:
         description: "Name of the account"
         type: "string"