alert-changed-branch-protections.yml

name: Alert Changed Branch Protections

on:
  branch_protection_rule:
  workflow_dispatch:
  schedule:
    - cron: '20 16 * * 3' # Run every Wednesday at 16:30 UTC / 8:30 PST

permissions:
  contents: read

jobs:
  check-branch-protections:
    runs-on: ubuntu-latest
    if: github.repository == 'github/docs-internal'

    strategy:
      matrix:
        # List of branches we want to monitor for protection changes
        branch: [main]

    steps:
      - name: Checkout repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Fetch branch protections
        id: fetch
        env:
          GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_WORKFLOW }}
        run: |
          # Fetch branch protections and store them in a file
          gh api /repos/GitHub/docs-internal/branches/${{ matrix.branch }}/protection > ${{ matrix.branch }}-actual.json

      - name: Format fetched settings with prettier for comparison
        id: format
        run: |
          npx prettier --write ${{ matrix.branch }}-actual.json

      - name: Compare branch protections
        id: compare
        run: |
          # Compare the fetched branch protections with the committed ones
          git diff --no-index .github/branch_protection_settings/${{ matrix.branch }}.json ${{ matrix.branch }}-actual.json || echo "diff_failed=true" >> $GITHUB_ENV

      - name: Set failure message
        if: env.diff_failed == 'true'
        run: |
          message="Alert due to changes in branch protections for ${{ matrix.branch }}. Please review the changes and ensure they are intentional. If valid, update the branch protection settings in .github/branch_protection_settings/${{ matrix.branch }}.json to match the diff in this workflow."
          echo "failure_message=$message" >> $GITHUB_ENV
          echo "$message"

      - uses: ./.github/actions/slack-alert
        if: ${{ env.diff_failed == 'true' && github.event_name != 'workflow_dispatch' }}
        with:
          slack_channel_id: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
          slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
          message: ${{ env.failure_message }}
          color: purple