From 8b0542e173f005635c514f437ccd72cde84d380c Mon Sep 17 00:00:00 2001 From: carlos-marquez-wgu Date: Thu, 15 Oct 2026 13:04:35 -0600 Subject: [PATCH 1/3] feat: add scheduled workflow to sync Paragon icon allow-list Add a weekly GitHub Actions workflow that checks if the @openedx/paragon version used by frontend-app-admin-console has changed, and if so, updates the pinned version and regenerates the vendored icon allow-list via `make paragon_icons`, then opens a PR with the changes. Refs: ADR 0029 --- .github/workflows/sync-paragon-icons.yml | 109 +++++++++++++++++++++++ 1 file changed, 109 insertions(+) create mode 100644 .github/workflows/sync-paragon-icons.yml diff --git a/.github/workflows/sync-paragon-icons.yml b/.github/workflows/sync-paragon-icons.yml new file mode 100644 index 00000000..d33b31b3 --- /dev/null +++ b/.github/workflows/sync-paragon-icons.yml @@ -0,0 +1,109 @@ +name: Sync Paragon Icon Allow-List + +on: + schedule: + - cron: "0 0 * * 1" + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + sync-paragon-icons: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: "3.12" + + - name: Get current pinned Paragon version + id: current + run: | + version=$(grep -oP -m 1 'PARAGON_VERSION\s*=\s*"\K[^"]+' scripts/generate_paragon_icons.py) + echo "version=$version" >> "$GITHUB_OUTPUT" + + - name: Fetch upstream Paragon version from frontend-app-admin-console + id: upstream + run: | + version=$(curl -fsSL \ + https://raw.githubusercontent.com/openedx/frontend-app-admin-console/master/package-lock.json \ + | jq -r '.packages["node_modules/@openedx/paragon"].version') + echo "version=$version" >> "$GITHUB_OUTPUT" + echo "Upstream @openedx/paragon: $version" + + - name: Compare versions + id: compare + run: | + current="${{ steps.current.outputs.version }}" + upstream="${{ steps.upstream.outputs.version }}" + if [ "$current" = "$upstream" ]; then + echo "changed=false" >> "$GITHUB_OUTPUT" + echo "✅ Paragon version unchanged ($current). Nothing to do." + else + echo "changed=true" >> "$GITHUB_OUTPUT" + echo "🔄 Paragon version changed: $current → $upstream" + fi + + - name: Update generator script pinned version + if: steps.compare.outputs.changed == 'true' + run: | + new_version="${{ steps.upstream.outputs.version }}" + sed -i "s/^PARAGON_VERSION = \"[0-9][0-9.]*\"/PARAGON_VERSION = \"$new_version\"/" \ + scripts/generate_paragon_icons.py + + - name: Regenerate Paragon icon allow-list + if: steps.compare.outputs.changed == 'true' + run: make paragon_icons + + - name: Verify regenerated list + if: steps.compare.outputs.changed == 'true' + run: make paragon_icons_check + + - name: Create Pull Request + if: steps.compare.outputs.changed == 'true' + uses: peter-evans/create-pull-request@v8.1.1 + with: + token: ${{ secrets.GITHUB_TOKEN }} + branch: bot/sync-paragon-icons + delete-branch: true + commit-message: | + chore: update Paragon icon allow-list to v${{ steps.upstream.outputs.version }} + + frontend-app-admin-console updated @openedx/paragon from + ${{ steps.current.outputs.version }} to ${{ steps.upstream.outputs.version }}. + + Regenerated via `make paragon_icons` (ADR 0029). + title: "chore: sync Paragon icon allow-list to v${{ steps.upstream.outputs.version }}" + body: | + ## Summary + + `frontend-app-admin-console` updated its `@openedx/paragon` dependency + from `${{ steps.current.outputs.version }}` to `${{ steps.upstream.outputs.version }}`. + + This PR updates the vendored Paragon icon allow-list to match (see [ADR 0029]). + + ## Changes + + - Updated `PARAGON_VERSION` in `scripts/generate_paragon_icons.py` + - Regenerated `src/openedx_authz/engine/schema/paragon_icons.py` + + ## Verification + + The workflow already ran `make paragon_icons_check` to confirm the + regenerated file is consistent. After merge you can verify locally: + + ``` + make paragon_icons_check + ``` + + [ADR 0029]: docs/decisions/0029-paragon-icon-list-maintenance.rst + + --- + *Automated by the [Sync Paragon Icon Allow-List](${{ github.server_url }}/${{ github.repository }}/actions/workflows/sync-paragon-icons.yml) workflow.* + labels: | + dependencies + automated From d008421120baec72ee31ea1719ee164f72894f61 Mon Sep 17 00:00:00 2001 From: carlos-marquez-wgu Date: Thu, 22 Oct 2026 09:13:57 -0600 Subject: [PATCH 2/3] squash! Addresed PR review comments - Pin actions to SHAs - Add 'actions: write' - Validate version semver with a regex - Pass outputs through env - Drop redundant 'paran_icons_check' - Add id: cpr to create-pull-request - Remove default token statement - Added workflow_dispatch ti ci.yml - Trigger github workflow run on pr --- .github/workflows/ci.yml | 1 + .github/workflows/sync-paragon-icons.yml | 42 ++++++++++++++---------- 2 files changed, 26 insertions(+), 17 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e3bc2cfb..350b8cd2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,7 @@ name: Python CI on: workflow_call: + workflow_dispatch: pull_request: branches: - "**" diff --git a/.github/workflows/sync-paragon-icons.yml b/.github/workflows/sync-paragon-icons.yml index d33b31b3..5b38bd61 100644 --- a/.github/workflows/sync-paragon-icons.yml +++ b/.github/workflows/sync-paragon-icons.yml @@ -6,6 +6,7 @@ on: workflow_dispatch: permissions: + actions: write contents: write pull-requests: write @@ -13,10 +14,10 @@ jobs: sync-paragon-icons: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" @@ -32,42 +33,44 @@ jobs: version=$(curl -fsSL \ https://raw.githubusercontent.com/openedx/frontend-app-admin-console/master/package-lock.json \ | jq -r '.packages["node_modules/@openedx/paragon"].version') + if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "::error::Unexpected Paragon version: '$version'" + exit 1 + fi echo "version=$version" >> "$GITHUB_OUTPUT" echo "Upstream @openedx/paragon: $version" - name: Compare versions id: compare + env: + CURRENT: ${{ steps.current.outputs.version }} + UPSTREAM: ${{ steps.upstream.outputs.version }} run: | - current="${{ steps.current.outputs.version }}" - upstream="${{ steps.upstream.outputs.version }}" - if [ "$current" = "$upstream" ]; then + if [ "$CURRENT" = "$UPSTREAM" ]; then echo "changed=false" >> "$GITHUB_OUTPUT" - echo "✅ Paragon version unchanged ($current). Nothing to do." + echo "✅ Paragon version unchanged ($CURRENT). Nothing to do." else echo "changed=true" >> "$GITHUB_OUTPUT" - echo "🔄 Paragon version changed: $current → $upstream" + echo "🔄 Paragon version changed: $CURRENT → $UPSTREAM" fi - name: Update generator script pinned version if: steps.compare.outputs.changed == 'true' + env: + NEW_VERSION: ${{ steps.upstream.outputs.version }} run: | - new_version="${{ steps.upstream.outputs.version }}" - sed -i "s/^PARAGON_VERSION = \"[0-9][0-9.]*\"/PARAGON_VERSION = \"$new_version\"/" \ + sed -i "s/^PARAGON_VERSION = \"[0-9][0-9.]*\"/PARAGON_VERSION = \"$NEW_VERSION\"/" \ scripts/generate_paragon_icons.py - name: Regenerate Paragon icon allow-list if: steps.compare.outputs.changed == 'true' run: make paragon_icons - - name: Verify regenerated list - if: steps.compare.outputs.changed == 'true' - run: make paragon_icons_check - - name: Create Pull Request if: steps.compare.outputs.changed == 'true' - uses: peter-evans/create-pull-request@v8.1.1 + id: cpr + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: - token: ${{ secrets.GITHUB_TOKEN }} branch: bot/sync-paragon-icons delete-branch: true commit-message: | @@ -93,8 +96,7 @@ jobs: ## Verification - The workflow already ran `make paragon_icons_check` to confirm the - regenerated file is consistent. After merge you can verify locally: + After merge you can verify locally: ``` make paragon_icons_check @@ -107,3 +109,9 @@ jobs: labels: | dependencies automated + + - name: Trigger CI on the bot branch + if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run ci.yml --ref bot/sync-paragon-icons From cfecd5246b28e236bba2c3eb271c00778618feeb Mon Sep 17 00:00:00 2001 From: carlos-marquez-wgu Date: Fri, 23 Oct 2026 14:58:03 -0600 Subject: [PATCH 3/3] squash! Run make paragon_icons during ci.yml --- .github/workflows/ci.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 350b8cd2..ba53b8a6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,3 +40,19 @@ jobs: token: ${{ secrets.CODECOV_TOKEN }} flags: unittests fail_ci_if_error: true + + paragon_icons_check: + name: paragon icons check + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Set up Python + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + with: + python-version: "3.12" + + - name: Check Paragon icon list is up to date + run: make paragon_icons_check