Skip to content

feat: add scheduled workflow to sync Paragon icon allow-list #537

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
carlos-marquez-wgu wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: add scheduled workflow to sync Paragon icon allow-list #537

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
109 changes: 109 additions & 0 deletions .github/workflows/sync-paragon-icons.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,109 @@
name: Sync Paragon Icon Allow-List

on:
schedule:
- cron: "0 0 * * 1"
workflow_dispatch:

permissions:

@bmtcril bmtcril Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needed for the CI dispatch suggested in the top-level comment:

permissions:
  contents: write
  pull-requests: write
  actions: write

contents: write
pull-requests: write

jobs:
sync-paragon-icons:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

@bmtcril bmtcril Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please pin all of the required actions to SHAs and make sure they're at the latest versions?


- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.12"

- name: Get current pinned Paragon version
id: current
run: |
version=$(grep -oP -m 1 'PARAGON_VERSION\s*=\s*"\K[^"]+' scripts/generate_paragon_icons.py)
echo "version=$version" >> "$GITHUB_OUTPUT"

- name: Fetch upstream Paragon version from frontend-app-admin-console
id: upstream
run: |
version=$(curl -fsSL \
https://raw.githubusercontent.com/openedx/frontend-app-admin-console/master/package-lock.json \
| jq -r '.packages["node_modules/@openedx/paragon"].version')

@bmtcril bmtcril Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This value comes from a file in another repo and is later expanded with ${{ }} directly into run: scripts and sed, in a job that has contents: write. It's lower risk since it's an openedx repo, but it's an injection path. Could we validate it right here and fail otherwise? Something like...

if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  echo "Unexpected Paragon version: '$version'" >&2
  exit 1
fi

echo "version=$version" >> "$GITHUB_OUTPUT"
echo "Upstream @openedx/paragon: $version"

- name: Compare versions
id: compare
run: |
current="${{ steps.current.outputs.version }}"

@bmtcril bmtcril Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Related to the note on line 34: step outputs should be passed through env: instead of being expanded inline in the script. Something like:

        env:
          CURRENT: ${{ steps.current.outputs.version }}
          UPSTREAM: ${{ steps.upstream.outputs.version }}
        run: |
          if [ "$CURRENT" = "$UPSTREAM" ]; then

The same applies to new_version on line 54.

upstream="${{ steps.upstream.outputs.version }}"
if [ "$current" = "$upstream" ]; then
echo "changed=false" >> "$GITHUB_OUTPUT"
echo "✅ Paragon version unchanged ($current). Nothing to do."
else
echo "changed=true" >> "$GITHUB_OUTPUT"
echo "🔄 Paragon version changed: $current → $upstream"
fi

- name: Update generator script pinned version
if: steps.compare.outputs.changed == 'true'
run: |
new_version="${{ steps.upstream.outputs.version }}"
sed -i "s/^PARAGON_VERSION = \"[0-9][0-9.]*\"/PARAGON_VERSION = \"$new_version\"/" \
scripts/generate_paragon_icons.py

- name: Regenerate Paragon icon allow-list
if: steps.compare.outputs.changed == 'true'
run: make paragon_icons

- name: Verify regenerated list

@bmtcril bmtcril Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This runs immediately after make paragon_icons, so I don't see how it can't fail. I think it can be dropped since CI will run on the PR once the dispatch step is in.

if: steps.compare.outputs.changed == 'true'
run: make paragon_icons_check

- name: Create Pull Request
if: steps.compare.outputs.changed == 'true'
uses: peter-evans/create-pull-request@v8.1.1

@bmtcril bmtcril Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please pin this to a commit SHA as well, and add id: cpr so the CI dispatch step can read pull-request-operation.

with:
token: ${{ secrets.GITHUB_TOKEN }}

@bmtcril bmtcril Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the default, so it can be removed.

branch: bot/sync-paragon-icons
delete-branch: true
commit-message: |
chore: update Paragon icon allow-list to v${{ steps.upstream.outputs.version }}

frontend-app-admin-console updated @openedx/paragon from
${{ steps.current.outputs.version }} to ${{ steps.upstream.outputs.version }}.

Regenerated via `make paragon_icons` (ADR 0029).
title: "chore: sync Paragon icon allow-list to v${{ steps.upstream.outputs.version }}"
body: |
## Summary

`frontend-app-admin-console` updated its `@openedx/paragon` dependency
from `${{ steps.current.outputs.version }}` to `${{ steps.upstream.outputs.version }}`.

This PR updates the vendored Paragon icon allow-list to match (see [ADR 0029]).

## Changes

- Updated `PARAGON_VERSION` in `scripts/generate_paragon_icons.py`
- Regenerated `src/openedx_authz/engine/schema/paragon_icons.py`

## Verification

The workflow already ran `make paragon_icons_check` to confirm the
regenerated file is consistent. After merge you can verify locally:

```
make paragon_icons_check
```

[ADR 0029]: docs/decisions/0029-paragon-icon-list-maintenance.rst

---
*Automated by the [Sync Paragon Icon Allow-List](${{ github.server_url }}/${{ github.repository }}/actions/workflows/sync-paragon-icons.yml) workflow.*
labels: |
dependencies
automated
Loading