updater.yml

# Allows updating dependencies to the latest published tag
on:
  workflow_call:
    inputs:
      path:
        description: Dependency path in the source repository, this can be either a submodule, a .properties file or a shell script.
        type: string
        required: true
      name:
        description: Name used in the PR title and the changelog entry.
        type: string
        required: true
      pattern:
        description: RegEx pattern that will be matched against available versions when picking the latest one.
        type: string
        required: false
        default: ''
      changelog-entry:
        description: Whether to add a changelog entry for the update.
        type: boolean
        required: false
        default: true
      changelog-section:
        description: Section header to attach the changelog entry to.
        type: string
        required: false
        default: Dependencies
      runs-on:
        description: GitHub Actions virtual environment name to run the udpater job on.
        type: string
        required: false
        default: 'ubuntu-latest'
      pr-strategy:
        description: |
          How to handle PRs - can be either of the following:
          * create - create a new PR for new dependency versions as they are released - maintainers may merge or close older PRs manually
          * update - keep a single PR that gets updated with new dependency versions until merged - only the latest version update is available at any time
        type: string
        required: false
        default: create
      _workflow_version:
        description: 'Internal: specify github-workflows (this repo) revision to use when checking out scripts.'
        type: string
        required: false
        default: v2 # Note: update when publishing a new version
    secrets:
      api-token:
        required: true
    outputs:
      prUrl:
        description: 'The created/updated PRs url.'
        value: ${{ jobs.update.outputs.prUrl }}
      baseBranch:
        description: 'The base branch name.'
        value: ${{ jobs.update.outputs.baseBranch }}
      prBranch:
        description: 'The created/updated pr branch name.'
        value: ${{ jobs.update.outputs.prBranch }}
      originalTag:
        description: 'The original tag from which the dependency was updated from.'
        value: ${{ jobs.update.outputs.originalTag }}
      latestTag:
        description: 'The latest tag to which the dependency was updated to.'
        value: ${{ jobs.update.outputs.latestTag }}

jobs:
  cancel-previous-run:
    runs-on: ubuntu-latest
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # Tag: 0.12.1
        with:
          access_token: ${{ github.token }}

  # What we need to accomplish:
  # * update to the latest tag
  # * create a PR
  # * update changelog (including the link to the just created PR)
  #
  # What we actually do is based on whether a PR exists already:
  # * YES it does:
  #    * make the update
  #    * update changelog (with the ID of an existing PR)
  #    * push to the PR
  # * NO it doesn't:
  #    * make the update
  #    * push to a new PR
  #    * update changelog (with the ID of the just created PR)
  #    * push to the PR
  # We do different approach on subsequent runs because otherwise we would spam users' mailboxes
  # with notifications about pushes to existing PRs. This way there is actually no push if not needed.
  update:
    runs-on: ${{ inputs.runs-on }}
    # Map the job outputs to step outputs
    outputs:
      prUrl: ${{ steps.pr.outputs.url }}
      baseBranch: ${{ steps.root.outputs.baseBranch }}
      prBranch: ${{ steps.root.outputs.prBranch }}
      originalTag: ${{ steps.target.outputs.originalTag }}
      latestTag: ${{ steps.target.outputs.latestTag }}
    timeout-minutes: 30
    defaults:
      run:
        shell: pwsh
    steps:
      - uses: actions/checkout@v4
        with:
          ssh-key: ${{ secrets.api-token }}

      # In order to run scripts from this repo, we need to check it out manually, doesn't seem available locally.
      - name: Check out workflow scripts
        # Note: cannot use `actions/checkout` at the moment because you can't clone outside of the repo root.
        #       Follow https://github.com/actions/checkout/issues/197
        run: |
          mkdir -p ${{ runner.temp }}/ghwf
          cd ${{ runner.temp }}/ghwf
          git init
          git remote add origin https://github.com/getsentry/github-workflows.git
          git fetch --depth 1 origin ${{ inputs._workflow_version }}
          git checkout FETCH_HEAD

      - name: Update to the latest version
        id: target
        run: ${{ runner.temp }}/ghwf/updater/scripts/update-dependency.ps1 -Path '${{ inputs.path }}' -Pattern '${{ inputs.pattern }}'

      - name: Get the base repo info
        if: steps.target.outputs.latestTag != steps.target.outputs.originalTag
        id: root
        run: |
          $mainBranch = $(git remote show origin | Select-String "HEAD branch: (.*)").Matches[0].Groups[1].Value
          $prBranch = switch ('${{ inputs.pr-strategy }}')
          {
              'create' { 'deps/${{ inputs.path }}/${{ steps.target.outputs.latestTag }}' }
              'update' { 'deps/${{ inputs.path }}' }
              default { throw "Unkown PR strategy '${{ inputs.pr-strategy }}'." }
          }
          "baseBranch=$mainBranch" | Tee-Object $env:GITHUB_OUTPUT -Append
          "prBranch=$prBranch" | Tee-Object $env:GITHUB_OUTPUT -Append
          $nonBotCommits = ${{ runner.temp }}/ghwf/updater/scripts/nonbot-commits.ps1 `
            -RepoUrl "$(git config --get remote.origin.url)" -PrBranch $prBranch -MainBranch $mainBranch
          $changed = $nonBotCommits.Length -gt 0 ? 'true' : 'false'
          "changed=$changed" | Tee-Object $env:GITHUB_OUTPUT -Append
          if ("$changed" -eq "true")
          {
              Write-Output "::warning::Target branch '$prBranch' has been changed manually - skipping updater to avoid overwriting these changes."
          }

      - name: Parse the existing PR URL
        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
        id: existing-pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $urls = @(gh api 'repos/${{ github.repository }}/pulls?base=${{ steps.root.outputs.baseBranch }}&head=${{ github.repository_owner }}:${{ steps.root.outputs.prBranch }}' --jq '.[].html_url')
          if ($urls.Length -eq 0)
          {
              "url=" | Tee-Object $env:GITHUB_OUTPUT -Append
          }
          elseif ($urls.Length -eq 1)
          {
              "url=$($urls[0])" | Tee-Object $env:GITHUB_OUTPUT -Append
          }
          else
          {
              throw "Unexpected number of PRs matched ($($urls.Length)): $urls"
          }

      - run: git --no-pager diff
        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}

      - name: Get target changelog
        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
        run: |
          $changelog = ${{ runner.temp }}/ghwf/updater/scripts/get-changelog.ps1 `
            -RepoUrl '${{ steps.target.outputs.url }}' `
            -OldTag '${{ steps.target.outputs.originalTag }}' `
            -NewTag '${{ steps.target.outputs.latestTag }}'
          ${{ runner.temp }}/ghwf/updater/scripts/set-github-env.ps1 TARGET_CHANGELOG $changelog

      # First we create a PR only if it doesn't exist. We will later overwrite the content with the same action.
      - name: Create a PR
        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
        uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc # pin#v6.0.1
        id: create-pr
        with:
          base: ${{ steps.root.outputs.baseBranch }}
          branch: ${{ steps.root.outputs.prBranch }}
          commit-message: 'chore: update ${{ inputs.path }} to ${{ steps.target.outputs.latestTag }}'
          author: 'GitHub <noreply@github.com>'
          title: 'chore(deps): update ${{ inputs.name }} to ${{ steps.target.outputs.latestTagNice }}'
          body: |
            Bumps ${{ inputs.path }} from ${{ steps.target.outputs.originalTag }} to ${{ steps.target.outputs.latestTag }}.

            Auto-generated by a [dependency updater](https://github.com/getsentry/github-workflows/blob/main/.github/workflows/updater.yml).
            ${{ env.TARGET_CHANGELOG }}
          labels: dependencies
          # draft: true

      - name: Verify we have a PR
        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
        id: pr
        run: |
          if ('${{ steps.create-pr.outputs.pull-request-url }}' -ne '')
          {
              "url=${{ steps.create-pr.outputs.pull-request-url }}" | Tee-Object $env:GITHUB_OUTPUT -Append
          }
          elseif ('${{ steps.existing-pr.outputs.url }}' -ne '')
          {
              "url=${{ steps.existing-pr.outputs.url }}" | Tee-Object $env:GITHUB_OUTPUT -Append
          }
          else
          {
              throw "PR hasn't been created"
          }

      # If we had to create a new PR, we must do a clean checkout & update the submodule again.
      # If we didn't do this, the new PR would only have a changelog...
      - name: 'After new PR: restore repo'
        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
        uses: actions/checkout@v4
        with:
          ssh-key: ${{ secrets.api-token }}

      - name: 'After new PR: redo the update'
        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
        run: ${{ runner.temp }}/ghwf/updater/scripts/update-dependency.ps1 -Path '${{ inputs.path }}' -Tag '${{ steps.target.outputs.latestTag }}'

      - name: Update Changelog
        if: ${{ inputs.changelog-entry && ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
        run: |
          ${{ runner.temp }}/ghwf/updater/scripts/update-changelog.ps1 `
            -Name '${{ inputs.name }}' `
            -PR '${{ steps.pr.outputs.url }}' `
            -RepoUrl '${{ steps.target.outputs.url }}' `
            -MainBranch '${{ steps.target.outputs.mainBranch }}' `
            -OldTag '${{ steps.target.outputs.originalTag }}' `
            -NewTag '${{ steps.target.outputs.latestTag }}' `
            -Section '${{ inputs.changelog-section }}'

      - run: git --no-pager diff
        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}

      # Now make the PR in its final state. This way we only have one commit and no updates if there are no changes between runs.
      - name: Update the PR
        if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
        uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc # pin#v6.0.1
        with:
          base: ${{ steps.root.outputs.baseBranch }}
          branch: ${{ steps.root.outputs.prBranch }}
          commit-message: 'chore: update ${{ inputs.path }} to ${{ steps.target.outputs.latestTag }}'
          author: 'GitHub <noreply@github.com>'
          title: 'chore(deps): update ${{ inputs.name }} to ${{ steps.target.outputs.latestTagNice }}'
          body: |
            Bumps ${{ inputs.path }} from ${{ steps.target.outputs.originalTag }} to ${{ steps.target.outputs.latestTag }}.

            Auto-generated by a [dependency updater](https://github.com/getsentry/github-workflows/blob/main/.github/workflows/updater.yml).
            ${{ env.TARGET_CHANGELOG }}
          labels: dependencies