name: Renovate Autoupdate

# Renovate prepares branches with every Go and npm/pnpm/yarn update and opens no PR.
# Each branch is merged into the default branch and tested. Only when the tests
# pass does the workflow open a PR and merge it. Replaces go-autoupdate.
# A renovate.json in the calling repository adds to these defaults.

on:
  workflow_call:
    inputs:
      go-version:
        description: "Go version to use"
        required: false
        type: string
        default: ">=1.24"
      go:
        description: "Update and test the Go module. Turn off for a repo with no Go code."
        required: false
        type: boolean
        default: true
      go-working-directory:
        description: "Directory that holds go.mod. Only this module is updated and tested."
        required: false
        type: string
        default: "."
      node-version:
        description: "Node.js version to use"
        required: false
        type: string
        default: "22"
      go-mod-tidy:
        description: "Run go mod tidy after a Go update. Turn it off for an Encore app: Encore adds imports at build time, so tidy prunes go.sum entries the build needs."
        required: false
        type: boolean
        default: true
      go-prepare-command:
        description: "Shell commands to run before the Go tests, for example installing a CLI. To put a tool on PATH, append its directory to $GITHUB_PATH."
        required: false
        type: string
        default: ""
      go-test-command:
        description: "Replaces the default Go build and test commands, for example 'encore test ./...' for an Encore app. It runs in go-working-directory."
        required: false
        type: string
        default: ""
      node:
        description: "Update and test the Node project. Turn off for a repo with no frontend to test."
        required: false
        type: boolean
        default: true
      node-working-directory:
        description: "Directory that holds package.json. Only this project is updated and tested."
        required: false
        type: string
        default: "."
      node-scripts:
        description: "Comma-separated package.json scripts to run, in order. A script that does not exist is skipped."
        required: false
        type: string
        default: "lint,typecheck,test,build"
      node-workspace:
        description: "The Node project is a pnpm workspace. node-working-directory then holds pnpm-workspace.yaml and pnpm-lock.yaml, and needs no package.json. Dependencies install once there, and node-scripts run in each of node-packages."
        required: false
        type: boolean
        default: false
      node-packages:
        description: "With node-workspace, comma-separated workspace package directories, relative to node-working-directory. Only these are updated and tested."
        required: false
        type: string
        default: ""
      pnpm-version:
        description: "pnpm version to use, for a repo whose package.json has no packageManager field. Empty uses the packageManager field, or the newest pnpm."
        required: false
        type: string
        default: ""
      require-node-tests:
        description: "Fail when a Node project has no test script, so an untested update never merges"
        required: false
        type: boolean
        default: true
      major-updates:
        description: "What to do with major updates: 'separate' gives each its own branch, tested and merged on its own, 'batch' puts them in the one batch, 'ignore' skips them."
        required: false
        type: string
        default: "separate"
      minimum-release-age:
        description: "Skip releases younger than this, for example '2 days'"
        required: false
        type: string
        default: "2 days"
      renovate-version:
        description: "Renovate version for the action"
        required: false
        type: string
        default: "44"
      release-workflow:
        description: "Workflow file to dispatch after a merge, for example release.yaml. Give several as a comma-separated list. Each must have a workflow_dispatch trigger and the caller needs actions: write. Empty means no dispatch."
        required: false
        type: string
        default: ""
      admin-merge:
        description: "Merge with --admin, which bypasses branch protection. The workflow token cannot do this, so leave it off unless you pass a token that can."
        required: false
        type: boolean
        default: false
      log-level:
        description: "Renovate log level: info, debug or trace. Use debug to see why Renovate fails."
        required: false
        type: string
        default: "info"
      lfs:
        description: "Enable Git LFS checkout (for repos with large files)"
        required: false
        type: boolean
        default: false
      npm-registry-scope:
        description: "Scope served by a private npm registry, for example '@fortawesome'. Used only when npm-registry-url and the npm-registry-token secret are also set."
        required: false
        type: string
        default: ""
      npm-registry-url:
        description: "URL of the private npm registry, for example 'https://npm.fontawesome.com/'. Used only when npm-registry-scope and the npm-registry-token secret are also set."
        required: false
        type: string
        default: ""
      runner:
        description: "Runner label, or JSON object such as {\"group\":\"ci\",\"labels\":[\"linux\"]} to select a runner group. Falls back to vars.SHARED_ACTIONS_RUNNER, then ubuntu-latest."
        required: false
        type: string
        default: ""
    secrets:
      npm-registry-token:
        description: "Auth token for the private npm registry"
        required: false

concurrency:
  group: renovate-autoupdate-${{ github.repository }}
  cancel-in-progress: false

env:
  BATCH_BRANCH: deps-autoupdate/batch
  ISSUE_TITLE: Dependency updates failing tests

jobs:
  renovate:
    name: Prepare the updates
    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
    timeout-minutes: 45
    permissions:
      contents: write
      # Renovate reads the repository's issues when it starts. A private repo refuses that without this.
      issues: read
      pull-requests: write
    outputs:
      branches: ${{ steps.list.outputs.branches }}
      base-sha: ${{ steps.base.outputs.sha }}
    steps:
      - name: Record the default branch commit
        id: base
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          branch=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)
          echo "sha=$(gh api "repos/$GITHUB_REPOSITORY/commits/$branch" --jq .sha)" >> "$GITHUB_OUTPUT"

      - name: Write Renovate config
        env:
          MIN_AGE: ${{ inputs.minimum-release-age }}
          MAJOR_UPDATES: ${{ inputs.major-updates }}
          USE_GO: ${{ inputs.go }}
          USE_NODE: ${{ inputs.node }}
          GO_DIR: ${{ inputs.go-working-directory }}
          NODE_DIR: ${{ inputs.node-working-directory }}
          NODE_WORKSPACE: ${{ inputs.node-workspace }}
          NODE_PACKAGES: ${{ inputs.node-packages }}
          PNPM_VERSION: ${{ inputs.pnpm-version }}
          GO_MOD_TIDY: ${{ inputs.go-mod-tidy }}
          NPM_SCOPE: ${{ inputs.npm-registry-scope }}
          NPM_URL: ${{ inputs.npm-registry-url }}
          NPM_TOKEN: ${{ secrets.npm-registry-token }}
          CONFIG_FILE: ${{ runner.temp }}/renovate-autoupdate-config.json
        run: |
          # The token goes to jq through the environment, never argv, and the config print below hides it.
          export NPMRC=""
          if [ -n "$NPM_SCOPE" ] && [ -n "$NPM_URL" ] && [ -n "$NPM_TOKEN" ]; then
            echo "::add-mask::$NPM_TOKEN"
            url="${NPM_URL%/}/"
            NPMRC=$(printf '%s:registry=%s\n//%s:_authToken=%s\n' "$NPM_SCOPE" "$url" "${url#*://}" "$NPM_TOKEN")
            # Renovate writes its npmrc option into the package directory, but a pnpm workspace install reads
            # only the root, so the lockfile update gets a 404. The Renovate container shares /tmp with the host.
            RENOVATE_NPMRC_FILE="/tmp/renovate-npmrc-$GITHUB_RUN_ID"
            (umask 022 && printf '%s\n' "$NPMRC" > "$RENOVATE_NPMRC_FILE")
            echo "RENOVATE_NPMRC_FILE=$RENOVATE_NPMRC_FILE" >> "$GITHUB_ENV"
            export RENOVATE_NPMRC_FILE
          fi
          jq -n \
            --arg repo "$GITHUB_REPOSITORY" \
            --arg age "$MIN_AGE" \
            --arg branch_prefix "${BATCH_BRANCH%%/*}/" \
            --arg majors "$MAJOR_UPDATES" \
            --argjson use_go "$USE_GO" \
            --argjson use_node "$USE_NODE" \
            --arg go_dir "$GO_DIR" \
            --arg node_dir "$NODE_DIR" \
            --argjson node_workspace "$NODE_WORKSPACE" \
            --arg node_packages "$NODE_PACKAGES" \
            --arg pnpm_version "$PNPM_VERSION" \
            --argjson go_tidy "$GO_MOD_TIDY" \
            '
            # A regex for files directly inside a directory, so only what the tests cover is updated.
            def prefix($d): (if $d == "." or $d == "" then "" else ($d | ltrimstr("./") | rtrimstr("/")) + "/" end) | gsub("\\."; "\\.");
            def pkgprefix($d; $p): prefix($d) + ($p | ltrimstr("./") | rtrimstr("/") | gsub("\\."; "\\.")) + "/";
            # A workspace updates only its listed packages. The root lockfile is rewritten by pnpm with them.
            def node_files:
              if $node_workspace
              then [$node_packages | split(",")[] | gsub("^\\s+|\\s+$"; "") | select(length > 0) | "/^" + pkgprefix($node_dir; .) + "package\\.json$/"]
              else ["/^" + prefix($node_dir) + "package\\.json$/"]
              end;
            {
              platform: "github",
              repositories: [$repo],
              onboarding: false,
              requireConfig: "optional",
              branchPrefix: $branch_prefix,
              enabledManagers: ((if $use_go then ["gomod"] else [] end) + (if $use_node then ["npm"] else [] end)),
              # Renovate writes the lockfile with its own pnpm. Use the version the tests install with.
              constraints: (if $pnpm_version != "" then {pnpm: $pnpm_version} else {} end),
              gomod: {managerFilePatterns: ["/^" + prefix($go_dir) + "go\\.mod$/"]},
              npm: {managerFilePatterns: (node_files + ["/^" + prefix($node_dir) + "pnpm-workspace\\.yaml$/"])},
              dependencyDashboard: false,
              # Branches only: with no dashboard, no PR is ever opened. The workflow opens it after the tests.
              prCreation: "approval",
              # A PR closed after a merge or by hand must not stop a later update of the same package.
              recreateWhen: "always",
              rebaseWhen: "behind-base-branch",
              semanticCommits: "enabled",
              semanticCommitType: "chore",
              semanticCommitScope: "deps",
              minimumReleaseAge: $age,
              prConcurrentLimit: 0,
              prHourlyLimit: 0,
              branchConcurrentLimit: 0,
              # A Go major update changes the import path: rewrite the imports, so the build tests the real update.
              postUpdateOptions: ((if $go_tidy then ["gomodTidy"] else [] end) + ["gomodUpdateImportPaths"]),
              statusCheckNames: {
                artifactError: null,
                configValidation: null,
                mergeConfidence: null,
                minimumReleaseAge: null
              },
              packageRules: (
                [
                  ({
                    matchManagers: ["gomod", "npm"],
                    groupName: "dependencies",
                    groupSlug: "batch"
                  } + (if $majors == "batch" then {} else {matchUpdateTypes: ["minor", "patch", "pin", "pinDigest", "digest"]} end)),
                  {matchManagers: ["gomod"], matchDepTypes: ["indirect"], enabled: true},
                  # The parent module chooses the major version of an indirect dependency.
                  {matchManagers: ["gomod"], matchDepTypes: ["indirect"], allowedVersions: "<{{add major 1}}.0.0"},
                  {matchPackageNames: ["typescript"], allowedVersions: "<7"}
                ]
                # Rules that disable by update type are ignored, but a version cap works.
                + (if $majors == "ignore" then [{matchManagers: ["gomod", "npm"], allowedVersions: "<{{add major 1}}.0.0"}] else [] end)
              )
            }
            | if $ENV.NPMRC != "" then .npmrc = $ENV.NPMRC | .customEnvVariables = {NPM_CONFIG_USERCONFIG: $ENV.RENOVATE_NPMRC_FILE} else . end' > "$CONFIG_FILE"
          jq 'if has("npmrc") then .npmrc = "<redacted>" else . end' "$CONFIG_FILE"

      - name: Run Renovate
        uses: renovatebot/github-action@v46.3.6
        with:
          configurationFile: ${{ runner.temp }}/renovate-autoupdate-config.json
          token: ${{ github.token }}
          renovate-version: ${{ inputs.renovate-version }}
        env:
          LOG_LEVEL: ${{ inputs.log-level }}

      - name: Remove the registry token file
        if: always() && env.RENOVATE_NPMRC_FILE != ''
        run: rm -f "$RENOVATE_NPMRC_FILE"

      - name: List the update branches
        id: list
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          prefix="${BATCH_BRANCH%%/*}/"
          all=$(gh api --paginate "repos/$GITHUB_REPOSITORY/branches" --jq '.[].name' | grep -F "$prefix" || true)
          # The batch first, then each major update.
          ordered=$({ printf '%s\n' "$all" | grep -Fx "$BATCH_BRANCH" || true; printf '%s\n' "$all" | grep -vFx "$BATCH_BRANCH" || true; } | sed '/^$/d')
          json=$(printf '%s\n' "$ordered" | jq -R . | jq -sc 'map(select(length > 0))')
          echo "branches=$json" >> "$GITHUB_OUTPUT"
          echo "Update branches: $json"

  test-and-merge:
    name: Test and merge ${{ matrix.branch }}
    needs: renovate
    if: needs.renovate.outputs.branches != '[]'
    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
    timeout-minutes: 60
    permissions:
      contents: write
      issues: write
      pull-requests: write
    strategy:
      fail-fast: false
      # One at a time, so each branch is tested on top of the ones merged before it.
      max-parallel: 1
      matrix:
        branch: ${{ fromJSON(needs.renovate.outputs.branches) }}
    env:
      BRANCH: ${{ matrix.branch }}
      GH_TOKEN: ${{ github.token }}
    steps:
      - name: Find the default branch
        id: default
        run: echo "branch=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)" >> "$GITHUB_OUTPUT"

      # Not the triggering ref: a push or a manual run from another branch must still test the default branch.
      - name: Checkout the default branch
        uses: actions/checkout@v7
        with:
          ref: ${{ steps.default.outputs.branch }}
          fetch-depth: 0
          lfs: ${{ inputs.lfs }}

      - name: Merge the update branch locally
        id: merge
        run: |
          git config user.name "Lukasz Raczylo"
          git config user.email "lukasz@raczylo.com"
          git fetch origin "$BRANCH"
          echo "head=$(git rev-parse FETCH_HEAD)" >> "$GITHUB_OUTPUT"
          echo "subject=$(git log -1 --format=%s FETCH_HEAD)" >> "$GITHUB_OUTPUT"
          if git merge-base --is-ancestor FETCH_HEAD HEAD; then
            echo "::notice::$BRANCH is already in the default branch."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          elif git merge --no-ff --no-commit FETCH_HEAD; then
            echo "skip=false" >> "$GITHUB_OUTPUT"
          else
            git merge --abort
            echo "::warning::$BRANCH conflicts with the default branch. Renovate rebases it on the next run."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Run workflow prepare script
        if: steps.merge.outputs.skip != 'true'
        shell: bash
        run: |
          if [ -f "./workflow-prepare.sh" ]; then
            chmod +x ./workflow-prepare.sh
            ./workflow-prepare.sh
          fi

      - name: Detect project types
        id: detect
        if: steps.merge.outputs.skip != 'true'
        env:
          GO_DIR: ${{ inputs.go-working-directory }}
          NODE_DIR: ${{ inputs.node-working-directory }}
          NODE_WORKSPACE: ${{ inputs.node-workspace }}
          NODE_PACKAGES: ${{ inputs.node-packages }}
          USE_GO: ${{ inputs.go }}
          USE_NODE: ${{ inputs.node }}
        run: |
          go=false
          node=false
          pm=npm
          if [ "$USE_GO" = true ] && [ -f "$GO_DIR/go.mod" ]; then go=true; fi
          if [ "$USE_NODE" = true ] && [ "$NODE_WORKSPACE" = true ]; then
            if [ ! -f "$NODE_DIR/pnpm-workspace.yaml" ] || [ ! -f "$NODE_DIR/pnpm-lock.yaml" ]; then
              echo "::error::node-workspace needs pnpm-workspace.yaml and pnpm-lock.yaml in $NODE_DIR."
              exit 1
            fi
            IFS=',' read -r -a packages <<<"$NODE_PACKAGES"
            count=0
            for package in "${packages[@]}"; do
              package=$(echo "$package" | xargs)
              [ -n "$package" ] || continue
              if [ ! -f "$NODE_DIR/$package/package.json" ]; then
                echo "::error::node-packages lists $package, but $NODE_DIR/$package/package.json does not exist."
                exit 1
              fi
              count=$((count + 1))
            done
            if [ "$count" -eq 0 ]; then
              echo "::error::node-workspace needs node-packages: the packages to update and test."
              exit 1
            fi
            node=true
            pm=pnpm
          elif [ "$USE_NODE" = true ] && [ -f "$NODE_DIR/package.json" ]; then
            node=true
            if [ -f "$NODE_DIR/pnpm-lock.yaml" ]; then pm=pnpm
            elif [ -f "$NODE_DIR/yarn.lock" ]; then pm=yarn
            fi
          fi
          if [ "$go" = false ] && [ "$node" = false ]; then
            echo "::error::Neither $GO_DIR/go.mod nor $NODE_DIR/package.json exists, so there is nothing to test."
            exit 1
          fi
          {
            echo "go=$go"
            echo "node=$node"
            echo "pm=$pm"
          } >> "$GITHUB_OUTPUT"

      - name: Setup Go
        if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.go == 'true'
        uses: actions/setup-go@v7
        with:
          go-version: ${{ inputs.go-version }}
          check-latest: true
          cache: true
          cache-dependency-path: ${{ inputs.go-working-directory }}/go.sum

      - name: Prepare Go
        if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.go == 'true' && inputs.go-prepare-command != ''
        working-directory: ${{ inputs.go-working-directory }}
        env:
          GO_PREPARE_COMMAND: ${{ inputs.go-prepare-command }}
        run: |
          set -o pipefail
          bash -c "$GO_PREPARE_COMMAND" 2>&1 | tee -a "$RUNNER_TEMP/test-output.log"

      - name: Build and test Go
        if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.go == 'true'
        working-directory: ${{ inputs.go-working-directory }}
        env:
          GO_TEST_COMMAND: ${{ inputs.go-test-command }}
        run: |
          set -o pipefail
          {
            go mod verify
            if [ -n "$GO_TEST_COMMAND" ]; then
              bash -c "$GO_TEST_COMMAND"
            else
              go build ./...
              go test -race -cover ./...
            fi
          } 2>&1 | tee -a "$RUNNER_TEMP/test-output.log"

      - name: Setup Node.js
        if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
        uses: actions/setup-node@v7
        with:
          node-version: ${{ inputs.node-version }}

      # The npmrc lives in RUNNER_TEMP, not the checkout, so no git command can pick the token up.
      - name: Configure the private npm registry
        if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
        env:
          NPM_SCOPE: ${{ inputs.npm-registry-scope }}
          NPM_URL: ${{ inputs.npm-registry-url }}
          NPM_TOKEN: ${{ secrets.npm-registry-token }}
        run: |
          [ -n "$NPM_SCOPE" ] && [ -n "$NPM_URL" ] && [ -n "$NPM_TOKEN" ] || exit 0
          echo "::add-mask::$NPM_TOKEN"
          url="${NPM_URL%/}/"
          npmrc="$RUNNER_TEMP/private-registry.npmrc"
          (umask 077 && printf '%s:registry=%s\n//%s:_authToken=%s\n' "$NPM_SCOPE" "$url" "${url#*://}" "$NPM_TOKEN" > "$npmrc")
          echo "NPM_CONFIG_USERCONFIG=$npmrc" >> "$GITHUB_ENV"
          echo "Using a private npm registry for $NPM_SCOPE."

      - name: Install Node dependencies
        if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
        working-directory: ${{ inputs.node-working-directory }}
        env:
          PM: ${{ steps.detect.outputs.pm }}
          PNPM_VERSION: ${{ inputs.pnpm-version }}
        run: |
          set -o pipefail
          {
            # The lockfile must match what Renovate wrote: install without updating it.
            case "$PM" in
              pnpm | yarn)
                command -v corepack >/dev/null || npm install --global corepack
                corepack enable "$PM"
                ;;
            esac
            if [ "$PM" = pnpm ] && [ -n "$PNPM_VERSION" ]; then
              corepack prepare "pnpm@$PNPM_VERSION" --activate
            fi
            case "$PM" in
              pnpm) pnpm install --frozen-lockfile ;;
              yarn) yarn install --immutable ;;
              npm)
                if [ -f package-lock.json ]; then npm ci; else npm install; fi
                ;;
            esac
          } 2>&1 | tee -a "$RUNNER_TEMP/test-output.log"

      - name: Run Node scripts
        if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
        working-directory: ${{ inputs.node-working-directory }}
        env:
          PM: ${{ steps.detect.outputs.pm }}
          SCRIPTS: ${{ inputs.node-scripts }}
          REQUIRE_TESTS: ${{ inputs.require-node-tests }}
          NODE_WORKSPACE: ${{ inputs.node-workspace }}
          NODE_PACKAGES: ${{ inputs.node-packages }}
        run: |
          set -o pipefail
          log="$RUNNER_TEMP/test-output.log"
          # A single project is the one package ".". A workspace is each listed package.
          packages=(.)
          if [ "$NODE_WORKSPACE" = true ]; then
            IFS=',' read -r -a packages <<<"$NODE_PACKAGES"
          fi
          if [ "$REQUIRE_TESTS" = true ]; then
            for package in "${packages[@]}"; do
              package=$(echo "$package" | xargs)
              [ -n "$package" ] || continue
              if ! jq -e '.scripts.test' "$package/package.json" >/dev/null; then
                echo "::error::$package/package.json has no test script. Add one, or set require-node-tests to false."
                echo "$package/package.json has no test script, so the update was not tested." >>"$log"
                exit 1
              fi
            done
          fi
          IFS=',' read -r -a scripts <<<"$SCRIPTS"
          for script in "${scripts[@]}"; do
            script=$(echo "$script" | xargs)
            [ -n "$script" ] || continue
            for package in "${packages[@]}"; do
              package=$(echo "$package" | xargs)
              [ -n "$package" ] || continue
              where=""
              [ "$package" = . ] || where=" ($package)"
              if jq -e --arg s "$script" '.scripts[$s]' "$package/package.json" >/dev/null; then
                echo "::group::$PM run $script$where"
                (cd "$package" && "$PM" run "$script") 2>&1 | tee -a "$log"
                echo "::endgroup::"
              else
                echo "::notice::No '$script' script$where, skipping."
              fi
            done
          done

      - name: Mark the tests as passed
        if: steps.merge.outputs.skip != 'true'
        run: touch "$RUNNER_TEMP/tests-passed"

      - name: Open the PR and merge it
        if: steps.merge.outputs.skip != 'true'
        env:
          HEAD_SHA: ${{ steps.merge.outputs.head }}
          SUBJECT: ${{ steps.merge.outputs.subject }}
          ADMIN: ${{ inputs.admin-merge && 'true' || '' }}
        run: |
          default=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)
          pr=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --state open --json number --jq '.[0].number // empty')
          if [ -z "$pr" ]; then
            url=$(gh pr create --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --base "$default" \
              --title "$SUBJECT" \
              --body "Automated dependency update. The tests passed on the result of merging this branch into $default.")
            pr=${url##*/}
          fi
          # GitHub needs a moment to work out whether the PR can merge.
          for _ in $(seq 1 12); do
            state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" --json mergeable --jq .mergeable)
            [ "$state" != UNKNOWN ] && break
            sleep 5
          done
          if [ "$state" = CONFLICTING ]; then
            gh pr close "$pr" --repo "$GITHUB_REPOSITORY" \
              --comment "The tests passed, but the branch conflicts with $default. Renovate rebases it on the next run."
            echo "::warning::$BRANCH conflicts with $default, so PR #$pr was closed. Renovate rebases it on the next run."
            echo "\`$BRANCH\` passed its tests but conflicts with \`$default\`. Renovate rebases it on the next run." >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          # --match-head-commit refuses to merge anything newer than the commit that was tested.
          # GitHub answers 5xx now and then; a failed call may still have merged, so check the state before retrying.
          merged=false
          for _ in 1 2 3; do
            if gh pr merge "$pr" --repo "$GITHUB_REPOSITORY" --squash --delete-branch \
              --match-head-commit "$HEAD_SHA" \
              --subject "$SUBJECT" \
              --body "Automated dependency update. All tests passed." \
              ${ADMIN:+--admin}; then
              merged=true
              break
            fi
            sleep 10
            [ "$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" --json state --jq .state)" = MERGED ] && { merged=true; break; }
          done
          if [ "$merged" != true ]; then
            gh pr close "$pr" --repo "$GITHUB_REPOSITORY" --comment "The tests passed, but GitHub refused the merge. See the workflow run. The next run tries again."
            exit 1
          fi
          echo "Merged #$pr ($BRANCH)." >> "$GITHUB_STEP_SUMMARY"

      - name: Report the failure
        if: failure()
        # Best effort: the summary is always written, the issue needs issues: write.
        continue-on-error: true
        env:
          HEAD_SHA: ${{ steps.merge.outputs.head }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          if [ -e "$RUNNER_TEMP/tests-passed" ]; then
            echo "The tests passed for \`$BRANCH\`, but the merge failed. See the log above. The next run tries again." >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          echo "The tests failed for \`$BRANCH\`, so no PR was opened. Renovate retries on the next run." >> "$GITHUB_STEP_SUMMARY"

          log="$RUNNER_TEMP/test-output.log"
          esc=$(printf '\033')
          marker="<!-- renovate-autoupdate:$BRANCH -->"
          body="$RUNNER_TEMP/failure-comment.md"
          {
            echo "$marker"
            echo "### \`$BRANCH\` failed its tests"
            echo
            echo "Commit \`${HEAD_SHA:0:8}\`, [workflow run]($RUN_URL), $(date -u '+%Y-%m-%d %H:%M') UTC. No PR was opened."
            echo
            echo "<details open><summary>Test output, last lines</summary>"
            echo
            echo '`````'
            if [ -s "$log" ]; then
              sed -E "s/${esc}\[[0-9;]*[A-Za-z]//g" "$log" | tail -c 50000
            else
              echo "No output was captured. See the workflow run."
            fi
            echo '`````'
            echo
            echo "</details>"
          } > "$body"

          issue=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "\"$ISSUE_TITLE\" in:title" --json number,title \
            --jq "[.[] | select(.title == \"$ISSUE_TITLE\")][0].number // empty")
          if [ -z "$issue" ]; then
            url=$(gh issue create --repo "$GITHUB_REPOSITORY" --title "$ISSUE_TITLE" \
              --body "Updates that failed their tests, so no PR was opened. Each comment holds the output for one branch. Fix the cause on the branch or in the code. The workflow retries on every run, merges an update once it passes, and closes this issue when none fail.")
            issue=${url##*/}
          fi
          id=$(gh api "repos/$GITHUB_REPOSITORY/issues/$issue/comments" --paginate \
            --jq ".[] | select(.body | contains(\"$marker\")) | .id" | head -n 1)
          if [ -n "$id" ]; then
            gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -F body=@"$body" >/dev/null
          else
            gh issue comment "$issue" --repo "$GITHUB_REPOSITORY" --body-file "$body"
          fi

  tidy-failures:
    name: Tidy the failure issue
    needs: [renovate, test-and-merge]
    if: always() && needs.renovate.result == 'success'
    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
    timeout-minutes: 10
    permissions:
      issues: write
      contents: read
    steps:
      - name: Remove fixed updates and close the issue when none fail
        continue-on-error: true
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          issue=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "\"$ISSUE_TITLE\" in:title" --json number,title \
            --jq "[.[] | select(.title == \"$ISSUE_TITLE\")][0].number // empty")
          [ -n "$issue" ] || exit 0
          branches=$(gh api --paginate "repos/$GITHUB_REPOSITORY/branches" --jq '.[].name')
          remaining=0
          while IFS=$'\t' read -r id branch; do
            [ -n "$id" ] || continue
            if printf '%s\n' "$branches" | grep -Fxq "$branch"; then
              remaining=$((remaining + 1))
            else
              gh api -X DELETE "repos/$GITHUB_REPOSITORY/issues/comments/$id"
            fi
          done < <(gh api "repos/$GITHUB_REPOSITORY/issues/$issue/comments" --paginate \
            --jq '.[] | select(.body | startswith("<!-- renovate-autoupdate:")) | [.id, (.body | split("\n")[0] | sub("^<!-- renovate-autoupdate:"; "") | sub(" -->$"; ""))] | @tsv')
          if [ "$remaining" -eq 0 ]; then
            gh issue close "$issue" --repo "$GITHUB_REPOSITORY" --comment "Every dependency update now passes its tests."
          fi

  release:
    name: Dispatch the release
    needs: [renovate, test-and-merge]
    if: always() && needs.renovate.outputs.branches != '[]' && inputs.release-workflow != ''
    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
    timeout-minutes: 10
    permissions:
      actions: write
      contents: read
    steps:
      - name: Dispatch when the default branch moved
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_WORKFLOW: ${{ inputs.release-workflow }}
          BASE_SHA: ${{ needs.renovate.outputs.base-sha }}
        run: |
          # A push made with github.token does not trigger workflows, so dispatch the release explicitly.
          branch=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)
          now=$(gh api "repos/$GITHUB_REPOSITORY/commits/$branch" --jq .sha)
          if [ "$now" = "$BASE_SHA" ]; then
            echo "Nothing was merged, so no release."
            exit 0
          fi
          IFS=',' read -r -a workflows <<<"$RELEASE_WORKFLOW"
          for workflow in "${workflows[@]}"; do
            workflow=$(echo "$workflow" | xargs)
            [ -n "$workflow" ] || continue
            gh workflow run "$workflow" --repo "$GITHUB_REPOSITORY" --ref "$branch"
          done