Some remarks on the GitHub Actions workflow

[bedroesb]

Hello, I had some comments when going through the workflow file. I think it can be shortened a lot.

• I see that @sahar-frikha you are using a personal GitHub token, I don't think this is future proof, what if you go out of the project? Either we make use of the default GitHub token, or we create a new user account that is neutral.

•   - name: Checkout Spec Repo and Retreive the Preceding Commit
      uses: actions/checkout@v3
      with:
        fetch-depth: 0
  
    - name: Get Changed Files
      id: changed-files
      uses: tj-actions/changed-files@v21
  
    - name: List Changed Files
      run: |
        for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
          echo "$file was changed"
        done
  

  Why is the preceding commit taken and the differences displayed I guess you just want to work with the latest state of the repo?

•   - name: Checkout the DDE repo
      env:
        GITHUB_TOKEN: ${{ secrets.Sahar_Workflows_Token }}
      run: | 
        git clone https://user:$GITHUB_TOKEN@github.com/BioSchemas/bioschemas-dde
        cd bioschemas-dde 
        git checkout main
        ls

  This can easily be replaced by

    - name: Checkout the DDE repo
      uses: actions/checkout@v3
      with:
        repository: BioSchemas/bioschemas-dde
        path: bioschemas-dde
        ref: main

  This saves a lot of time since it gets mounted. Same for the Checkout the Website repo step

• I would use this action: https://github.com/marketplace/actions/git-auto-commit to create your commits, it can create also the new branch, this will reduce the code a lot. You can than also specify from which repo you make this commit.

[bedroesb]

These are some suggestions of course, feel free to ignore them!

[sahar-frikha]

Hello @bedroesb, I'll respond in the order:

• The default Token (github-actions one) cannot be used to commit or push in an external repository ( In my case the github action is in the specifications repository and it will generate a profile.html file that will be pushed in the website repository ). It should be a token added as secret in the organization. I looked into how to create an unassigned/neutral token before, I tried things but with no success. If you have an idea please ping me in slack.
• I'm not sure I understand your comment; please correct me if am wrong. This code retrieves the names of the changed files in the commit that fired the workflow. This list of names is one of the arguments of my python script (That will generate the profile). The display (echo) is just to facilitate the debug in case of problems.
• Thank you for your last two suggestions. I'll test them out and get back to you if I run into any problems.

Thank you so much for reviewing my work; I sincerely appreciate it. Of course, suggestions are always welcome.

[bedroesb]

• I understand. Than it might still be recommended to create a biochemas account where the token is created from. "Tip: Personal accounts are intended for humans, but you can create accounts to automate activity on GitHub. This type of account is called a machine user. For example, you can create a machine user account to automate continuous integration (CI) workflows."

• I'm not sure I understand your comment; please correct me if am wrong. This code retrieves the names of the changed files in the commit that fired the workflow. This list of names is one of the arguments of my python script (That will generate the profile). The display (echo) is just to facilitate the debug in case of problems.

  Oh I understand now! This probably reduces the time since not all the files need to be converted.

These automations are such a game changer, and will make a big difference for the editorial process of BioSchemas! Keep up to good work!