From 9df94973d72687e31855446045deee5417adbf48 Mon Sep 17 00:00:00 2001
From: Mark Bolwell <mark.bollyuk@gmail.com>
Date: Fri, 3 Oct 2025 07:56:30 +0100
Subject: [PATCH] added badge workflows

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
---
 .../benchmark_tracking_controller.yml         | 38 +++++++++++++++++++
 .github/workflows/export_badges_private.yml   | 27 +++++++++++++
 .github/workflows/export_badges_public.yml    | 19 ++++++++++
 3 files changed, 84 insertions(+)
 create mode 100644 .github/workflows/benchmark_tracking_controller.yml
 create mode 100644 .github/workflows/export_badges_private.yml
 create mode 100644 .github/workflows/export_badges_public.yml

diff --git a/.github/workflows/benchmark_tracking_controller.yml b/.github/workflows/benchmark_tracking_controller.yml
new file mode 100644
index 0000000..0d9f515
--- /dev/null
+++ b/.github/workflows/benchmark_tracking_controller.yml
@@ -0,0 +1,38 @@
+---
+
+# GitHub schedules all cron jobs in UTC.
+# This expression will run the job every day at 9 AM Eastern Time during Daylight Saving Time (mid-March to early November).
+# This expression will run the job every day at 8 AM Eastern Time during Standard Time (early November to mid-March).
+
+name: Central Benchmark Orchestrator
+
+on:
+  push:
+    branches:
+      - latest
+  schedule:
+    - cron: '0 6 * * *'  # Runs daily at 9 AM ET
+  workflow_dispatch:
+
+jobs:
+  call-benchmark-tracker:
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref_name == 'latest')
+    name: Start Benchmark Tracker
+    uses: ansible-lockdown/github_linux_IaC/.github/workflows/benchmark_track.yml@self_hosted
+    with:
+      repo_name: ${{ github.repository }}
+    secrets:
+      TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
+      BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
+      DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+
+  call-monitor-promotions:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    name: Monitor Promotions and Auto-Promote
+    uses: ansible-lockdown/github_linux_IaC/.github/workflows/benchmark_promote.yml@self_hosted
+    with:
+      repo_name: ${{ github.repository }}
+    secrets:
+      TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
+      BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
+      DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
diff --git a/.github/workflows/export_badges_private.yml b/.github/workflows/export_badges_private.yml
new file mode 100644
index 0000000..d316cbf
--- /dev/null
+++ b/.github/workflows/export_badges_private.yml
@@ -0,0 +1,27 @@
+---
+
+name: Export Private Repo Badges
+
+# Use different minute offsets with the same hourly pattern:
+# Repo Group Suggested Cron Expression Explanation
+# Group A 0 */6 * * * Starts at top of hour
+# Group B 10 */6 * * * Starts at 10 after
+# And So On
+
+on:
+  push:
+    branches:
+      - latest
+  schedule:
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+
+jobs:
+  export-badges:
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'schedule' && startsWith(github.repository, 'ansible-lockdown/Private-')) || (github.event_name == 'push' && github.ref_name == 'latest')
+    uses: ansible-lockdown/github_linux_IaC/.github/workflows/export_badges_private.yml@self_hosted
+    with:
+      # Full org/repo path passed for GitHub API calls (e.g., ansible-lockdown/Private-Windows-2016-CIS)
+      repo_name: ${{ github.repository }}
+    secrets:
+      BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
diff --git a/.github/workflows/export_badges_public.yml b/.github/workflows/export_badges_public.yml
new file mode 100644
index 0000000..fa4b27f
--- /dev/null
+++ b/.github/workflows/export_badges_public.yml
@@ -0,0 +1,19 @@
+---
+
+name: Export Public Repo Badges
+
+on:
+  push:
+    branches:
+      - main
+      - devel
+  workflow_dispatch:
+
+jobs:
+  export-badges:
+    if: github.repository_visibility == 'public' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && (github.ref_name == 'devel' || github.ref_name == 'main')))
+    uses: ansible-lockdown/github_linux_IaC/.github/workflows/export_badges_public.yml@self_hosted
+    with:
+      repo_name: ${{ github.repository }}
+    secrets:
+      BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}