sigstore/root-signing

Consider merging sync GHAs into one

haydentherapper opened this issue · 2 comments

Description

There's an edge case where poor cronjob scheduling causes sync-main-to-preprod causes sync-preprod-to-prod at the same time, which risks metadata being out of sync. We could merge these into one to prevent this.

Additionally, sync-main-to-staging is mostly a copy of sync-main-to-preprod, so we should probably create a reusable workflow too.

sync-main-to-prepprod is run when the repository is changed. sync-preprod-to-prod is rune by cron every hour. What is the edge cause? So that I can understand the issue better.

If we combine them into a single workflow, what would be the trigger for the sync-preprod-to-prod? Only cron for that job?

I'll be honest, I don't remember why I posted this. I was thinking about making sync-main-to-preprod periodic to handle cases where a GHA doesn't fire. For now, this is not an issue though, so closing.