Skip to content
Latchkey

Sync CNCF Projects from Landscape workflow (cncf/mentoring)

The Sync CNCF Projects from Landscape workflow from cncf/mentoring, explained and optimized by Latchkey.

B

CI health: B - good

Point runs-on at Latchkey and get job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →
Source: cncf/mentoring.github/workflows/landscape-projects-sync.ymlLicense Apache-2.0View source

What it does

This is the Sync CNCF Projects from Landscape workflow from the cncf/mentoring repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)
name: Sync CNCF Projects from Landscape

on:
  schedule:
    - cron: '0 6 * * 1'  # every Monday at 06:00 UTC
  workflow_dispatch:       # manual trigger

permissions:
  contents: write
  pull-requests: write

jobs:
  sync-projects:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        # --ignore-scripts blocks dependency lifecycle scripts (js-yaml needs none)
        run: npm install --no-save --ignore-scripts js-yaml@4.3.0

      - name: Fetch and sync projects
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const fs = require('fs');
            const path = require('path');
            const ws = process.env.GITHUB_WORKSPACE || process.cwd();
            const yaml = require(path.join(ws, 'node_modules', 'js-yaml'));
            const _lib = (m) => require(path.join(ws, 'programs/lfx-mentorship/automation/lib', m));
            const { extractProjects, orgOf, render, rewriteOptionsBlock } = _lib('landscape');

            // Fetch landscape.yml
            const url = 'https://raw.githubusercontent.com/cncf/landscape/master/landscape.yml';
            const resp = await fetch(url);
            if (!resp.ok) throw new Error(`Failed to fetch landscape.yml: ${resp.status}`);
            const landscape = yaml.load(await resp.text());

            // Extract CNCF projects (graduated/incubating/sandbox), sorted by name
            const projects = extractProjects(landscape);
            core.info(`Found ${projects.length} CNCF projects`);

            // Mark projects whose org publishes a `.project` repo. Cache per org
            // to avoid duplicate lookups.
            const checkedOrgs = new Map();
            for (const proj of projects) {
              const org = orgOf(proj.repo_url);
              if (!org) continue;
              if (checkedOrgs.has(org)) {
                if (checkedOrgs.get(org)) proj.has_dot_project = true;
                continue;
              }
              try {
                await github.rest.repos.get({ owner: org, repo: '.project' });
                checkedOrgs.set(org, true);
                proj.has_dot_project = true;
                core.info(`  ${org}/.project: found`);
              } catch (e) {
                if (e.status !== 404) {
                  core.info(`  ${org}/.project: HTTP ${e.status}, skipping`);
                }
                checkedOrgs.set(org, false);
              }
            }
            const dotCount = [...checkedOrgs.values()].filter(Boolean).length;
            core.info(`Checked ${checkedOrgs.size} orgs, ${dotCount} have .project repos`);

            // Write projects.yml via the tested render() so the "Last updated"
            // date only moves when the project list actually changes. Otherwise
            // the weekly run would diff on the date line alone and open a
            // spurious PR.
            const projectsPath = 'programs/lfx-mentorship/automation/projects.yml';
            const body = yaml.dump(projects, { sortKeys: false, lineWidth: -1, noRefs: true });
            let existing = null;
            try {
              existing = fs.readFileSync(projectsPath, 'utf8');
            } catch (e) {
              if (e.code !== 'ENOENT') throw e;
            }
            const today = new Date().toISOString().slice(0, 10);
            fs.writeFileSync(
              projectsPath,
              render(body, { total: projects.length, today, existing }),
            );

            // Update the CNCF Project dropdown in the issue form
            const formPath = '.github/ISSUE_TEMPLATE/lfx-program-proposal.yml';
            let formText = fs.readFileSync(formPath, 'utf8');
            formText = rewriteOptionsBlock(formText, 'id: cncf_project', projects.map((p) => p.name));

            // Sync term dropdowns from terms.yml (single source of truth) into
            // the issue form (id: term) and the export workflow (workflow_dispatch input)
            const termsPath = 'programs/lfx-mentorship/automation/terms.yml';
            const termList = yaml.load(fs.readFileSync(termsPath, 'utf8')).terms || [];
            formText = rewriteOptionsBlock(formText, 'id: term', termList);
            fs.writeFileSync(formPath, formText);

            const exportPath = '.github/workflows/lfx-export.yml';
            const exportText = rewriteOptionsBlock(
              fs.readFileSync(exportPath, 'utf8'),
              'term:',
              termList,
            );
            fs.writeFileSync(exportPath, exportText);
            core.info(`Term dropdowns synced: ${termList.join(', ')}`);

            core.info('Files updated successfully');

      - name: Check for changes
        id: check
        run: |
          if git diff --quiet; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Create Pull Request
        if: steps.check.outputs.changed == 'true'
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # Commit only the files the script writes, so npm's untracked
          # node_modules/ never lands in the generated PR.
          add-paths: |
            programs/lfx-mentorship/automation/projects.yml
            .github/ISSUE_TEMPLATE/lfx-program-proposal.yml
            .github/workflows/lfx-export.yml
          commit-message: |
            chore: sync CNCF project list from landscape

            Auto-generated by landscape-projects-sync workflow.

            Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
            Assisted-by: Copilot <223556219+Copilot@users.noreply.github.com>
          branch: automation/landscape-sync
          title: "chore: sync CNCF project list from landscape"
          body: |
            Auto-generated update to the CNCF Project dropdown in the
            LFX program proposal issue form and the projects.yml config.

            Source: [`cncf/landscape/landscape.yml`](https://github.com/cncf/landscape/blob/master/landscape.yml)

            Please review the project list diff and merge if correct.
          labels: administration

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Sync CNCF Projects from Landscape
 
on:
  schedule:
    - cron: '0 6 * * 1'  # every Monday at 06:00 UTC
  workflow_dispatch:       # manual trigger
 
permissions:
  contents: write
  pull-requests: write
 
jobs:
  sync-projects:
    timeout-minutes: 30
    runs-on: latchkey-small
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Install dependencies
        # --ignore-scripts blocks dependency lifecycle scripts (js-yaml needs none)
        run: npm install --no-save --ignore-scripts js-yaml@4.3.0
 
      - name: Fetch and sync projects
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const fs = require('fs');
            const path = require('path');
            const ws = process.env.GITHUB_WORKSPACE || process.cwd();
            const yaml = require(path.join(ws, 'node_modules', 'js-yaml'));
            const _lib = (m) => require(path.join(ws, 'programs/lfx-mentorship/automation/lib', m));
            const { extractProjects, orgOf, render, rewriteOptionsBlock } = _lib('landscape');
 
            // Fetch landscape.yml
            const url = 'https://raw.githubusercontent.com/cncf/landscape/master/landscape.yml';
            const resp = await fetch(url);
            if (!resp.ok) throw new Error(`Failed to fetch landscape.yml: ${resp.status}`);
            const landscape = yaml.load(await resp.text());
 
            // Extract CNCF projects (graduated/incubating/sandbox), sorted by name
            const projects = extractProjects(landscape);
            core.info(`Found ${projects.length} CNCF projects`);
 
            // Mark projects whose org publishes a `.project` repo. Cache per org
            // to avoid duplicate lookups.
            const checkedOrgs = new Map();
            for (const proj of projects) {
              const org = orgOf(proj.repo_url);
              if (!org) continue;
              if (checkedOrgs.has(org)) {
                if (checkedOrgs.get(org)) proj.has_dot_project = true;
                continue;
              }
              try {
                await github.rest.repos.get({ owner: org, repo: '.project' });
                checkedOrgs.set(org, true);
                proj.has_dot_project = true;
                core.info(`  ${org}/.project: found`);
              } catch (e) {
                if (e.status !== 404) {
                  core.info(`  ${org}/.project: HTTP ${e.status}, skipping`);
                }
                checkedOrgs.set(org, false);
              }
            }
            const dotCount = [...checkedOrgs.values()].filter(Boolean).length;
            core.info(`Checked ${checkedOrgs.size} orgs, ${dotCount} have .project repos`);
 
            // Write projects.yml via the tested render() so the "Last updated"
            // date only moves when the project list actually changes. Otherwise
            // the weekly run would diff on the date line alone and open a
            // spurious PR.
            const projectsPath = 'programs/lfx-mentorship/automation/projects.yml';
            const body = yaml.dump(projects, { sortKeys: false, lineWidth: -1, noRefs: true });
            let existing = null;
            try {
              existing = fs.readFileSync(projectsPath, 'utf8');
            } catch (e) {
              if (e.code !== 'ENOENT') throw e;
            }
            const today = new Date().toISOString().slice(0, 10);
            fs.writeFileSync(
              projectsPath,
              render(body, { total: projects.length, today, existing }),
            );
 
            // Update the CNCF Project dropdown in the issue form
            const formPath = '.github/ISSUE_TEMPLATE/lfx-program-proposal.yml';
            let formText = fs.readFileSync(formPath, 'utf8');
            formText = rewriteOptionsBlock(formText, 'id: cncf_project', projects.map((p) => p.name));
 
            // Sync term dropdowns from terms.yml (single source of truth) into
            // the issue form (id: term) and the export workflow (workflow_dispatch input)
            const termsPath = 'programs/lfx-mentorship/automation/terms.yml';
            const termList = yaml.load(fs.readFileSync(termsPath, 'utf8')).terms || [];
            formText = rewriteOptionsBlock(formText, 'id: term', termList);
            fs.writeFileSync(formPath, formText);
 
            const exportPath = '.github/workflows/lfx-export.yml';
            const exportText = rewriteOptionsBlock(
              fs.readFileSync(exportPath, 'utf8'),
              'term:',
              termList,
            );
            fs.writeFileSync(exportPath, exportText);
            core.info(`Term dropdowns synced: ${termList.join(', ')}`);
 
            core.info('Files updated successfully');
 
      - name: Check for changes
        id: check
        run: |
          if git diff --quiet; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi
 
      - name: Create Pull Request
        if: steps.check.outputs.changed == 'true'
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # Commit only the files the script writes, so npm's untracked
          # node_modules/ never lands in the generated PR.
          add-paths: |
            programs/lfx-mentorship/automation/projects.yml
            .github/ISSUE_TEMPLATE/lfx-program-proposal.yml
            .github/workflows/lfx-export.yml
          commit-message: |
            chore: sync CNCF project list from landscape
 
            Auto-generated by landscape-projects-sync workflow.
 
            Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
            Assisted-by: Copilot <223556219+Copilot@users.noreply.github.com>
          branch: automation/landscape-sync
          title: "chore: sync CNCF project list from landscape"
          body: |
            Auto-generated update to the CNCF Project dropdown in the
            LFX program proposal issue form and the projects.yml config.
 
            Source: [`cncf/landscape/landscape.yml`](https://github.com/cncf/landscape/blob/master/landscape.yml)
 
            Please review the project list diff and merge if correct.
          labels: administration
 

What changed

1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow