Some remarks on the GitHub Actions workflow

[bedroesb]

Hello, I had some comments when going through the workflow file. I think it can be shortened a lot.

• I see that @sahar-frikha you are using a personal GitHub token, I don't think this is future proof, what if you go out of the project? Either we make use of the default GitHub token, or we create a new user account that is neutral.

•     - name: Checkout Spec Repo and Retreive the Preceding Commit
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
  
      - name: Get Changed Files
        id: changed-files
        uses: tj-actions/changed-files@v21
  
      - name: List Changed Files
        run: |
          for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
            echo "$file was changed"
          done
  
  

  Why is the preceding commit taken and the differences displayed I guess you just want to work with the latest state of the repo?

•     - name: Checkout the DDE repo
        env:
          GITHUB_TOKEN: ${{ secrets.Sahar_Workflows_Token }}
        run: | 
          git clone https://user:[email protected]/BioSchemas/bioschemas-dde
          cd bioschemas-dde 
          git checkout main
          ls
  

  This can easily be replaced by

      - name: Checkout the DDE repo
        uses: actions/checkout@v3
        with:
          repository: BioSchemas/bioschemas-dde
          path: bioschemas-dde
          ref: main
  

  This saves a lot of time since it gets mounted. Same for the Checkout the Website repo step
• I would use this action: https://github.com/marketplace/actions/git-auto-commit to create your commits, it can create also the new branch, this will reduce the code a lot. You can than also specify from which repo you make this commit.

[bedroesb]

These are some suggestions of course, feel free to ignore them!

[sahar-frikha]

Hello @bedroesb, I'll respond in the order:

• The default Token (github-actions one) cannot be used to commit or push in an external repository ( In my case the github action is in the specifications repository and it will generate a profile.html file that will be pushed in the website repository ).
  It should be a token added as secret in the organization. I looked into how to create an unassigned/neutral token before, I tried things but with no success. If you have an idea please ping me in slack.
• I'm not sure I understand your comment; please correct me if am wrong. This code retrieves the names of the changed files in the commit that fired the workflow. This list of names is one of the arguments of my python script (That will generate the profile). The display (echo) is just to facilitate the debug in case of problems.
• Thank you for your last two suggestions. I'll test them out and get back to you if I run into any problems.

Thank you so much for reviewing my work; I sincerely appreciate it. Of course, suggestions are always welcome.

[bedroesb]

• I understand. Than it might still be recommended to create a biochemas account where the token is created from.
  "Tip: Personal accounts are intended for humans, but you can create accounts to automate activity on GitHub. This type of account is called a machine user. For example, you can create a machine user account to automate continuous integration (CI) workflows."

• I'm not sure I understand your comment; please correct me if am wrong. This code retrieves the names of the changed files in the commit that fired the workflow. This list of names is one of the arguments of my python script (That will generate the profile). The display (echo) is just to facilitate the debug in case of problems.

  Oh I understand now! This probably reduces the time since not all the files need to be converted.

These automations are such a game changer, and will make a big difference for the editorial process of BioSchemas! Keep up to good work!