| 1 | name: Restore publish backup |
| 2 | |
| 3 | on: |
| 4 | workflow_dispatch: |
| 5 | # checkov:skip=CKV_GHA_7:Operational restore workflow (not a release build). The single input names an immutable backup manifest to restore; it does not influence a build's output artifacts. Input is required for manual recovery. |
| 6 | inputs: |
| 7 | backup_manifest: |
| 8 | description: 'Immutable backup manifest on publish (for example data/backups/2026-W23/123/content/manifest.json).' |
| 9 | required: true |
| 10 | type: string |
| 11 | |
| 12 | permissions: |
| 13 | contents: read |
| 14 | |
| 15 | concurrency: |
| 16 | group: restore-publish-backup |
| 17 | cancel-in-progress: false |
| 18 | |
| 19 | jobs: |
| 20 | restore: |
| 21 | runs-on: ubuntu-latest |
| 22 | permissions: |
| 23 | contents: write # force-push the restored backup to the publish branch |
| 24 | steps: |
| 25 | - name: Check out workflow source |
| 26 | uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
| 27 | with: |
| 28 | ref: ${{ github.sha }} |
| 29 | path: workflow-source |
| 30 | persist-credentials: false |
| 31 | |
| 32 | - name: Check out publish # zizmor: ignore[artipacked] this job force-pushes the restored backup to publish; checkout token is reused by git push |
| 33 | uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
| 34 | with: |
| 35 | ref: publish |
| 36 | fetch-depth: 0 |
| 37 | path: publish |
| 38 | |
| 39 | - name: Restore immutable backup |
| 40 | env: |
| 41 | BACKUP_MANIFEST: ${{ inputs.backup_manifest }} |
| 42 | run: | |
| 43 | set -euo pipefail |
| 44 | cd publish |
| 45 | git config user.name "github-actions[bot]" |
| 46 | git config user.email "github-actions[bot]@users.noreply.github.com" |
| 47 | git fetch origin publish |
| 48 | EXPECTED_PUBLISH_SHA=$(git rev-parse origin/publish) |
| 49 | git checkout -f -B publish origin/publish |
| 50 | python3 ../workflow-source/scripts/publish_safety.py restore-backup --backup-manifest "$BACKUP_MANIFEST" |
| 51 | git add data/analyzed/ content/weekly/ |
| 52 | if git diff --cached --quiet; then |
| 53 | echo "Backup restore produced no changes." |
| 54 | exit 0 |
| 55 | fi |
| 56 | git commit -m "restore: publish backup ${BACKUP_MANIFEST}" |
| 57 | git push --force-with-lease="refs/heads/publish:$EXPECTED_PUBLISH_SHA" origin HEAD:publish |