From 8a80369a5a99f2865d21aa57bcca270e88eb92e6 Mon Sep 17 00:00:00 2001
From: Dafydd Jones <dafydd@techneg.it>
Date: Fri, 17 Jul 2026 13:09:21 +0100
Subject: [PATCH] ci(safe-settings): call workflow `libsafe-settings`

---
 .github/workflows/safe-settings.yml | 59 ++++-------------------------
 1 file changed, 7 insertions(+), 52 deletions(-)

diff --git a/.github/workflows/safe-settings.yml b/.github/workflows/safe-settings.yml
index 1b763bf..b1a546c 100644
--- a/.github/workflows/safe-settings.yml
+++ b/.github/workflows/safe-settings.yml
@@ -1,4 +1,4 @@
-name: Apply Safe Settings
+name: Apply Admin Safe Settings
 on:
   workflow_dispatch:
     inputs:
@@ -14,54 +14,9 @@ jobs:
   apply-safe-settings:
     permissions:
       contents: read
-    runs-on: ubuntu-24.04
-    environment: ${{ github.ref_name == github.event.repository.default_branch && 'production' || 'test' }}
-    env:
-      # Version/tag of `github/safe-settings` repository to use:
-      SAFE_SETTINGS_VERSION: ff7a65655d33006b9820479df0a9e1057a8927e4 # 2.1.17
-
-      # Path on GHA runner box where safe-settings code downloaded to:
-      SAFE_SETTINGS_CODE_DIR: .safe-settings-code
-    steps:
-      # Self-checkout of 'admin' repo for access to safe-settings deployment configuration
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      # Checkout of `safe-settings` source repository to apply all settings
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: github/safe-settings
-          ref: ${{ env.SAFE_SETTINGS_VERSION }}
-          path: ${{ env.SAFE_SETTINGS_CODE_DIR }}
-          persist-credentials: false
-      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          cache: npm
-          cache-dependency-path: ${{ env.SAFE_SETTINGS_CODE_DIR }}/package-lock.json
-          node-version-file: ${{ env.SAFE_SETTINGS_CODE_DIR }}/.nvmrc
-      - run: npm install
-        working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }}
-      - name: Run Safe-Settings Full-Sync
-        run: |
-          set +e  # Allow commands to fail
-          npm run full-sync
-          exit_code=$?
-          echo "Full-sync exit code: $exit_code"
-
-          if [[ "$FULL_SYNC_NOP" == "true" ]]; then
-            echo "Dry-run mode — ignoring failure"
-            exit 0
-          fi
-
-          exit $exit_code
-        working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }}
-        env:
-          APP_ID: ${{ vars.SAFE_SETTINGS_APP_ID }}
-          ADMIN_REPO: ${{ vars.SAFE_SETTINGS_ADMIN_REPO || '.github' }}
-          CONFIG_PATH: ${{ vars.SAFE_SETTINGS_CONFIG_PATH || 'safe-settings' }}
-          DEPLOYMENT_CONFIG_FILE: ${{ github.workspace }}/${{ vars.SAFE_SETTINGS_CONFIG_PATH || 'safe-settings' }}/deployment-settings.yml
-          FULL_SYNC_NOP: ${{ inputs.dry-run }}
-          GH_ORG: ${{ vars.SAFE_SETTINGS_GH_ORG }}
-          LOG_LEVEL: ${{ vars.SAFE_SETTINGS_LOG_LEVEL || 'debug' }}
-          PRIVATE_KEY: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }}
+    # This is required to work with environment secrets in the called workflow
+    secrets: inherit # zizmor: ignore[secrets-inherit]
+    uses: ./.github/workflows/libsafe-settings.yml
+    with:
+      admin-repo: admin
+      dry-run: ${{ inputs.dry-run }}