Repository navigation
Linuxfabrik: Check upstream versions #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Linuxfabrik: Check upstream versions' | |
| on: | |
| schedule: | |
| # Daily at 04:00 UTC. | |
| - cron: '0 4 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: 'read' | |
| jobs: | |
| check-upstream: | |
| runs-on: | |
| - 'ubuntu-24.04' | |
| permissions: | |
| contents: 'write' | |
| pull-requests: 'write' | |
| steps: | |
| - name: 'Harden the runner (Audit all outbound calls)' | |
| uses: 'step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920' # v2.20.0 | |
| with: | |
| egress-policy: 'audit' | |
| # The bump pull requests are opened with the Linuxfabrik automation app | |
| # instead of GITHUB_TOKEN. Pull requests authored by GITHUB_TOKEN do not | |
| # get their checks run, so the required `dependency-review` check never | |
| # reports and the pull request stays blocked forever. | |
| - name: 'Generate app token' | |
| id: 'app-token' | |
| uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # v3.2.0 | |
| with: | |
| client-id: '${{ vars.LF_AUTOMATION_CLIENT_ID }}' | |
| private-key: '${{ secrets.LF_AUTOMATION_APP_PRIVATE_KEY }}' | |
| - name: 'git clone https://github.com/Linuxfabrik/packaging' | |
| uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 | |
| with: | |
| token: '${{ steps.app-token.outputs.token }}' | |
| - name: 'Open a version-bump PR for every package behind its upstream' | |
| env: | |
| GITHUB_TOKEN: '${{ steps.app-token.outputs.token }}' | |
| run: | | |
| git config user.name 'linuxfabrik-automation[bot]' | |
| git config user.email 'linuxfabrik-automation[bot]@users.noreply.github.com' | |
| for dir in packages/*/; do | |
| name="$(basename "$dir")" | |
| # check-upstream.sh exits 0 only when a newer upstream version exists. | |
| if versions="$(bash build/check-upstream.sh "$dir")"; then | |
| current="$(echo "$versions" | cut -d' ' -f1)" | |
| latest="$(echo "$versions" | cut -d' ' -f2)" | |
| branch="bump/$name-$latest" | |
| # Skip if the bump PR already exists. | |
| if git ls-remote --exit-code --heads origin "$branch" >/dev/null 2>&1; then | |
| echo "Branch $branch already exists, skipping $name." | |
| continue | |
| fi | |
| echo "Bumping $name: $current -> $latest" | |
| git checkout -b "$branch" | |
| bash build/check-upstream.sh --write "$dir" >/dev/null | |
| git add "$dir/package.conf" | |
| git commit -m "build($name): bump to $latest" | |
| git push origin "$branch" | |
| gh pr create \ | |
| --base 'main' \ | |
| --head "$branch" \ | |
| --title "build($name): bump to $latest" \ | |
| --body "Upstream released \`$latest\` (packaged: \`$current\`). Merging this triggers a build and publish of \`$name\` $latest." | |
| git checkout main | |
| fi | |
| done |