Update package website via cross-repo action dispatch

[timwoj]

This adds a step to the aggregation action that dispatches an action in the package-website repository to notify it of new data. This allows that repo to avoid manually requesting data from the packages repo except only when needed.

[bbannier]

Just curious, could this be a webhook configured through Github?

[timwoj]

Just curious, could this be a webhook configured through Github?

I tried doing a webhook when I was testing it on another repo, but iirc there were a couple of reasons why it wouldn't work for this:

1. The event selection isn't fine enough granularity. We only want this to trigger on the aggregation workflow completing, and only on the master branch. The options in the webhook interface only allow you to select workflows starting/stopping.
2. You can't specify the payload being passed to the webhook, just a URL. For dispatching actions, you have to pass what action should be triggered as data in the request. The data that gets passed is specified by the github webhook itself, so you'd need to add some filtering on the receiving side.

[ckreibich]

I know you've tried this with independent repos before Tim, but could you explain the auth mechanism? I'm asking because both this and the packages-website repo has a ZEEK_BOT_TOKEN. Do they need to match for this to work?

All the docs I find only refer to "the repository" when explaining this, which is super helpful when the whole point is to bridge two repositories. :-)

[timwoj]

Do they need to match for this to work?

Yes, they need to match. That token should be identical between the two repos. It should be the same as the github-notifier token that we keep in 1password, which is a token with full repo permissions.

[ckreibich]

Got it!

[ckreibich]

@timwoj I'm just going to close this until we actually need the dispatch. :-)