mirror of
https://github.com/lukaszraczylo/shared-actions.git
synced 2026-10-12 04:54:48 +00:00
lukaszraczylo
94d1fe3409
A failing update has no PR, so its test output had nowhere to go. Capture the output of the Go and Node steps. On failure, write it as a comment on one sticky issue, one comment per branch, updated on every run. A final job removes comments for branches that are gone and closes the issue when no update fails. The step is best effort and also writes the run summary.
473 lines
20 KiB
YAML
473 lines
20 KiB
YAML
name: Renovate Autoupdate
|
|
|
|
# Renovate prepares branches with every Go and npm/pnpm/yarn update and opens no PR.
|
|
# Each branch is merged into the default branch and tested. Only when the tests
|
|
# pass does the workflow open a PR and merge it. Replaces go-autoupdate.
|
|
# A renovate.json in the calling repository adds to these defaults.
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
go-version:
|
|
description: "Go version to use"
|
|
required: false
|
|
type: string
|
|
default: ">=1.24"
|
|
go-working-directory:
|
|
description: "Directory that holds go.mod"
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
node-version:
|
|
description: "Node.js version to use"
|
|
required: false
|
|
type: string
|
|
default: "22"
|
|
node-working-directory:
|
|
description: "Directory that holds package.json"
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
node-scripts:
|
|
description: "Comma-separated package.json scripts to run, in order. A script that does not exist is skipped."
|
|
required: false
|
|
type: string
|
|
default: "lint,typecheck,test,build"
|
|
require-node-tests:
|
|
description: "Fail when a Node project has no test script, so an untested update never merges"
|
|
required: false
|
|
type: boolean
|
|
default: true
|
|
major-updates:
|
|
description: "What to do with major updates: 'separate' gives each its own branch, tested and merged on its own, 'batch' puts them in the one batch, 'ignore' skips them."
|
|
required: false
|
|
type: string
|
|
default: "separate"
|
|
minimum-release-age:
|
|
description: "Skip releases younger than this, for example '2 days'"
|
|
required: false
|
|
type: string
|
|
default: "2 days"
|
|
renovate-version:
|
|
description: "Renovate version for the action"
|
|
required: false
|
|
type: string
|
|
default: "44"
|
|
release-workflow:
|
|
description: "Workflow file to dispatch after a merge, for example release.yaml. It must have a workflow_dispatch trigger and the caller needs actions: write. Empty means no dispatch."
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
admin-merge:
|
|
description: "Merge with --admin, which bypasses branch protection. The workflow token cannot do this, so leave it off unless you pass a token that can."
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
lfs:
|
|
description: "Enable Git LFS checkout (for repos with large files)"
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
runner:
|
|
description: "Runner label, or JSON object such as {\"group\":\"ci\",\"labels\":[\"linux\"]} to select a runner group. Falls back to vars.SHARED_ACTIONS_RUNNER, then ubuntu-latest."
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
|
|
concurrency:
|
|
group: renovate-autoupdate-${{ github.repository }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
BATCH_BRANCH: deps-autoupdate/batch
|
|
ISSUE_TITLE: Dependency updates failing tests
|
|
|
|
jobs:
|
|
renovate:
|
|
name: Prepare the updates
|
|
runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
|
|
timeout-minutes: 45
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
outputs:
|
|
branches: ${{ steps.list.outputs.branches }}
|
|
base-sha: ${{ steps.base.outputs.sha }}
|
|
steps:
|
|
- name: Record the default branch commit
|
|
id: base
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
branch=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)
|
|
echo "sha=$(gh api "repos/$GITHUB_REPOSITORY/commits/$branch" --jq .sha)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Write Renovate config
|
|
env:
|
|
MIN_AGE: ${{ inputs.minimum-release-age }}
|
|
MAJOR_UPDATES: ${{ inputs.major-updates }}
|
|
CONFIG_FILE: ${{ runner.temp }}/renovate-autoupdate-config.json
|
|
run: |
|
|
jq -n \
|
|
--arg repo "$GITHUB_REPOSITORY" \
|
|
--arg age "$MIN_AGE" \
|
|
--arg branch_prefix "${BATCH_BRANCH%%/*}/" \
|
|
--arg majors "$MAJOR_UPDATES" \
|
|
'
|
|
{
|
|
platform: "github",
|
|
repositories: [$repo],
|
|
onboarding: false,
|
|
requireConfig: "optional",
|
|
branchPrefix: $branch_prefix,
|
|
enabledManagers: ["gomod", "npm"],
|
|
dependencyDashboard: false,
|
|
# Branches only: with no dashboard, no PR is ever opened. The workflow opens it after the tests.
|
|
prCreation: "approval",
|
|
rebaseWhen: "behind-base-branch",
|
|
semanticCommits: "enabled",
|
|
semanticCommitType: "chore",
|
|
semanticCommitScope: "deps",
|
|
minimumReleaseAge: $age,
|
|
prConcurrentLimit: 0,
|
|
prHourlyLimit: 0,
|
|
branchConcurrentLimit: 0,
|
|
postUpdateOptions: ["gomodTidy"],
|
|
statusCheckNames: {
|
|
artifactError: null,
|
|
configValidation: null,
|
|
mergeConfidence: null,
|
|
minimumReleaseAge: null
|
|
},
|
|
packageRules: (
|
|
[
|
|
({
|
|
matchManagers: ["gomod", "npm"],
|
|
groupName: "dependencies",
|
|
groupSlug: "batch"
|
|
} + (if $majors == "batch" then {} else {matchUpdateTypes: ["minor", "patch", "pin", "pinDigest", "digest"]} end)),
|
|
{matchManagers: ["gomod"], matchDepTypes: ["indirect"], enabled: true},
|
|
{matchPackageNames: ["typescript"], allowedVersions: "<7"}
|
|
]
|
|
# Rules that disable by update type are ignored, but a version cap works.
|
|
+ (if $majors == "ignore" then [{matchManagers: ["gomod", "npm"], allowedVersions: "<{{add major 1}}.0.0"}] else [] end)
|
|
)
|
|
}' > "$CONFIG_FILE"
|
|
jq . "$CONFIG_FILE"
|
|
|
|
- name: Run Renovate
|
|
uses: renovatebot/[email protected]
|
|
with:
|
|
configurationFile: ${{ runner.temp }}/renovate-autoupdate-config.json
|
|
token: ${{ github.token }}
|
|
renovate-version: ${{ inputs.renovate-version }}
|
|
env:
|
|
LOG_LEVEL: info
|
|
|
|
- name: List the update branches
|
|
id: list
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
prefix="${BATCH_BRANCH%%/*}/"
|
|
all=$(gh api --paginate "repos/$GITHUB_REPOSITORY/branches" --jq '.[].name' | grep -F "$prefix" || true)
|
|
# The batch first, then each major update.
|
|
ordered=$({ printf '%s\n' "$all" | grep -Fx "$BATCH_BRANCH" || true; printf '%s\n' "$all" | grep -vFx "$BATCH_BRANCH" || true; } | sed '/^$/d')
|
|
json=$(printf '%s\n' "$ordered" | jq -R . | jq -sc 'map(select(length > 0))')
|
|
echo "branches=$json" >> "$GITHUB_OUTPUT"
|
|
echo "Update branches: $json"
|
|
|
|
test-and-merge:
|
|
name: Test and merge ${{ matrix.branch }}
|
|
needs: renovate
|
|
if: needs.renovate.outputs.branches != '[]'
|
|
runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: write
|
|
issues: write
|
|
pull-requests: write
|
|
strategy:
|
|
fail-fast: false
|
|
# One at a time, so each branch is tested on top of the ones merged before it.
|
|
max-parallel: 1
|
|
matrix:
|
|
branch: ${{ fromJSON(needs.renovate.outputs.branches) }}
|
|
env:
|
|
BRANCH: ${{ matrix.branch }}
|
|
GH_TOKEN: ${{ github.token }}
|
|
steps:
|
|
- name: Checkout the default branch
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
lfs: ${{ inputs.lfs }}
|
|
|
|
- name: Merge the update branch locally
|
|
id: merge
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git fetch origin "$BRANCH"
|
|
echo "head=$(git rev-parse FETCH_HEAD)" >> "$GITHUB_OUTPUT"
|
|
echo "subject=$(git log -1 --format=%s FETCH_HEAD)" >> "$GITHUB_OUTPUT"
|
|
if git merge-base --is-ancestor FETCH_HEAD HEAD; then
|
|
echo "::notice::$BRANCH is already in the default branch."
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
elif git merge --no-ff --no-commit FETCH_HEAD; then
|
|
echo "skip=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
git merge --abort
|
|
echo "::warning::$BRANCH conflicts with the default branch. Renovate rebases it on the next run."
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Run workflow prepare script
|
|
if: steps.merge.outputs.skip != 'true'
|
|
shell: bash
|
|
run: |
|
|
if [ -f "./workflow-prepare.sh" ]; then
|
|
chmod +x ./workflow-prepare.sh
|
|
./workflow-prepare.sh
|
|
fi
|
|
|
|
- name: Detect project types
|
|
id: detect
|
|
if: steps.merge.outputs.skip != 'true'
|
|
env:
|
|
GO_DIR: ${{ inputs.go-working-directory }}
|
|
NODE_DIR: ${{ inputs.node-working-directory }}
|
|
run: |
|
|
go=false
|
|
node=false
|
|
pm=npm
|
|
if [ -f "$GO_DIR/go.mod" ]; then go=true; fi
|
|
if [ -f "$NODE_DIR/package.json" ]; then
|
|
node=true
|
|
if [ -f "$NODE_DIR/pnpm-lock.yaml" ]; then pm=pnpm
|
|
elif [ -f "$NODE_DIR/yarn.lock" ]; then pm=yarn
|
|
fi
|
|
fi
|
|
if [ "$go" = false ] && [ "$node" = false ]; then
|
|
echo "::error::Neither $GO_DIR/go.mod nor $NODE_DIR/package.json exists, so there is nothing to test."
|
|
exit 1
|
|
fi
|
|
{
|
|
echo "go=$go"
|
|
echo "node=$node"
|
|
echo "pm=$pm"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Setup Go
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.go == 'true'
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version: ${{ inputs.go-version }}
|
|
check-latest: true
|
|
cache: true
|
|
cache-dependency-path: ${{ inputs.go-working-directory }}/go.sum
|
|
|
|
- name: Build and test Go
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.go == 'true'
|
|
working-directory: ${{ inputs.go-working-directory }}
|
|
run: |
|
|
set -o pipefail
|
|
{
|
|
go mod verify
|
|
go build ./...
|
|
go test -race -cover ./...
|
|
} 2>&1 | tee -a "$RUNNER_TEMP/test-output.log"
|
|
|
|
- name: Setup Node.js
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ inputs.node-version }}
|
|
|
|
- name: Install Node dependencies
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
|
|
working-directory: ${{ inputs.node-working-directory }}
|
|
env:
|
|
PM: ${{ steps.detect.outputs.pm }}
|
|
run: |
|
|
set -o pipefail
|
|
{
|
|
# The lockfile must match what Renovate wrote: install without updating it.
|
|
case "$PM" in
|
|
pnpm | yarn)
|
|
command -v corepack >/dev/null || npm install --global corepack
|
|
corepack enable "$PM"
|
|
;;
|
|
esac
|
|
case "$PM" in
|
|
pnpm) pnpm install --frozen-lockfile ;;
|
|
yarn) yarn install --immutable ;;
|
|
npm)
|
|
if [ -f package-lock.json ]; then npm ci; else npm install; fi
|
|
;;
|
|
esac
|
|
} 2>&1 | tee -a "$RUNNER_TEMP/test-output.log"
|
|
|
|
- name: Run Node scripts
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
|
|
working-directory: ${{ inputs.node-working-directory }}
|
|
env:
|
|
PM: ${{ steps.detect.outputs.pm }}
|
|
SCRIPTS: ${{ inputs.node-scripts }}
|
|
REQUIRE_TESTS: ${{ inputs.require-node-tests }}
|
|
run: |
|
|
set -o pipefail
|
|
log="$RUNNER_TEMP/test-output.log"
|
|
if [ "$REQUIRE_TESTS" = true ] && ! jq -e '.scripts.test' package.json >/dev/null; then
|
|
echo "::error::package.json has no test script. Add one, or set require-node-tests to false."
|
|
echo "package.json has no test script, so the update was not tested." >>"$log"
|
|
exit 1
|
|
fi
|
|
IFS=',' read -r -a scripts <<<"$SCRIPTS"
|
|
for script in "${scripts[@]}"; do
|
|
script=$(echo "$script" | xargs)
|
|
[ -n "$script" ] || continue
|
|
if jq -e --arg s "$script" '.scripts[$s]' package.json >/dev/null; then
|
|
echo "::group::$PM run $script"
|
|
"$PM" run "$script" 2>&1 | tee -a "$log"
|
|
echo "::endgroup::"
|
|
else
|
|
echo "::notice::No '$script' script, skipping."
|
|
fi
|
|
done
|
|
|
|
- name: Open the PR and merge it
|
|
if: steps.merge.outputs.skip != 'true'
|
|
env:
|
|
HEAD_SHA: ${{ steps.merge.outputs.head }}
|
|
SUBJECT: ${{ steps.merge.outputs.subject }}
|
|
ADMIN: ${{ inputs.admin-merge && 'true' || '' }}
|
|
run: |
|
|
default=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)
|
|
pr=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --state open --json number --jq '.[0].number // empty')
|
|
if [ -z "$pr" ]; then
|
|
url=$(gh pr create --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --base "$default" \
|
|
--title "$SUBJECT" \
|
|
--body "Automated dependency update. The tests passed on the result of merging this branch into $default.")
|
|
pr=${url##*/}
|
|
fi
|
|
# GitHub needs a moment to work out whether the PR can merge.
|
|
for _ in $(seq 1 12); do
|
|
state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" --json mergeable --jq .mergeable)
|
|
[ "$state" != UNKNOWN ] && break
|
|
sleep 5
|
|
done
|
|
# --match-head-commit refuses to merge anything newer than the commit that was tested.
|
|
gh pr merge "$pr" --repo "$GITHUB_REPOSITORY" --squash --delete-branch \
|
|
--match-head-commit "$HEAD_SHA" \
|
|
--subject "$SUBJECT" \
|
|
--body "Automated dependency update. All tests passed." \
|
|
${ADMIN:+--admin}
|
|
echo "Merged #$pr ($BRANCH)." >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Report the failure
|
|
if: failure()
|
|
# Best effort: the summary is always written, the issue needs issues: write.
|
|
continue-on-error: true
|
|
env:
|
|
HEAD_SHA: ${{ steps.merge.outputs.head }}
|
|
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
run: |
|
|
echo "The tests failed for \`$BRANCH\`, so no PR was opened. Renovate retries on the next run." >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
log="$RUNNER_TEMP/test-output.log"
|
|
esc=$(printf '\033')
|
|
marker="<!-- renovate-autoupdate:$BRANCH -->"
|
|
body="$RUNNER_TEMP/failure-comment.md"
|
|
{
|
|
echo "$marker"
|
|
echo "### \`$BRANCH\` failed its tests"
|
|
echo
|
|
echo "Commit \`${HEAD_SHA:0:8}\`, [workflow run]($RUN_URL), $(date -u '+%Y-%m-%d %H:%M') UTC. No PR was opened."
|
|
echo
|
|
echo "<details open><summary>Test output, last lines</summary>"
|
|
echo
|
|
echo '`````'
|
|
if [ -s "$log" ]; then
|
|
sed -E "s/${esc}\[[0-9;]*[A-Za-z]//g" "$log" | tail -c 50000
|
|
else
|
|
echo "No output was captured. See the workflow run."
|
|
fi
|
|
echo '`````'
|
|
echo
|
|
echo "</details>"
|
|
} > "$body"
|
|
|
|
issue=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "\"$ISSUE_TITLE\" in:title" --json number,title \
|
|
--jq "[.[] | select(.title == \"$ISSUE_TITLE\")][0].number // empty")
|
|
if [ -z "$issue" ]; then
|
|
url=$(gh issue create --repo "$GITHUB_REPOSITORY" --title "$ISSUE_TITLE" \
|
|
--body "Updates that failed their tests, so no PR was opened. Each comment holds the output for one branch. Fix the cause on the branch or in the code. The workflow retries on every run, merges an update once it passes, and closes this issue when none fail.")
|
|
issue=${url##*/}
|
|
fi
|
|
id=$(gh api "repos/$GITHUB_REPOSITORY/issues/$issue/comments" --paginate \
|
|
--jq ".[] | select(.body | contains(\"$marker\")) | .id" | head -n 1)
|
|
if [ -n "$id" ]; then
|
|
gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -F body=@"$body" >/dev/null
|
|
else
|
|
gh issue comment "$issue" --repo "$GITHUB_REPOSITORY" --body-file "$body"
|
|
fi
|
|
|
|
tidy-failures:
|
|
name: Tidy the failure issue
|
|
needs: [renovate, test-and-merge]
|
|
if: always() && needs.renovate.result == 'success'
|
|
runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
|
|
timeout-minutes: 10
|
|
permissions:
|
|
issues: write
|
|
contents: read
|
|
steps:
|
|
- name: Remove fixed updates and close the issue when none fail
|
|
continue-on-error: true
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
issue=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "\"$ISSUE_TITLE\" in:title" --json number,title \
|
|
--jq "[.[] | select(.title == \"$ISSUE_TITLE\")][0].number // empty")
|
|
[ -n "$issue" ] || exit 0
|
|
branches=$(gh api --paginate "repos/$GITHUB_REPOSITORY/branches" --jq '.[].name')
|
|
remaining=0
|
|
while IFS=$'\t' read -r id branch; do
|
|
[ -n "$id" ] || continue
|
|
if printf '%s\n' "$branches" | grep -Fxq "$branch"; then
|
|
remaining=$((remaining + 1))
|
|
else
|
|
gh api -X DELETE "repos/$GITHUB_REPOSITORY/issues/comments/$id"
|
|
fi
|
|
done < <(gh api "repos/$GITHUB_REPOSITORY/issues/$issue/comments" --paginate \
|
|
--jq '.[] | select(.body | startswith("<!-- renovate-autoupdate:")) | [.id, (.body | split("\n")[0] | sub("^<!-- renovate-autoupdate:"; "") | sub(" -->$"; ""))] | @tsv')
|
|
if [ "$remaining" -eq 0 ]; then
|
|
gh issue close "$issue" --repo "$GITHUB_REPOSITORY" --comment "Every dependency update now passes its tests."
|
|
fi
|
|
|
|
release:
|
|
name: Dispatch the release
|
|
needs: [renovate, test-and-merge]
|
|
if: always() && needs.renovate.outputs.branches != '[]' && inputs.release-workflow != ''
|
|
runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
|
|
timeout-minutes: 10
|
|
permissions:
|
|
actions: write
|
|
contents: read
|
|
steps:
|
|
- name: Dispatch when the default branch moved
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
RELEASE_WORKFLOW: ${{ inputs.release-workflow }}
|
|
BASE_SHA: ${{ needs.renovate.outputs.base-sha }}
|
|
run: |
|
|
# A push made with github.token does not trigger workflows, so dispatch the release explicitly.
|
|
branch=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)
|
|
now=$(gh api "repos/$GITHUB_REPOSITORY/commits/$branch" --jq .sha)
|
|
if [ "$now" = "$BASE_SHA" ]; then
|
|
echo "Nothing was merged, so no release."
|
|
exit 0
|
|
fi
|
|
gh workflow run "$RELEASE_WORKFLOW" --repo "$GITHUB_REPOSITORY" --ref "$branch"
|