mirror of
https://github.com/lukaszraczylo/shared-actions.git
synced 2026-10-12 04:54:48 +00:00
lukaszraczylo
c12df22051
A Go major update changes the import path. Without rewriting imports the PR only added the new module to go.mod, the tests passed, and Renovate proposed it again. Rewrite the imports with gomodUpdateImportPaths so the build tests the actual update, and cap indirect dependencies at their current major, which the parent module decides.
502 lines
22 KiB
YAML
502 lines
22 KiB
YAML
name: Renovate Autoupdate
|
|
|
|
# Renovate prepares branches with every Go and npm/pnpm/yarn update and opens no PR.
|
|
# Each branch is merged into the default branch and tested. Only when the tests
|
|
# pass does the workflow open a PR and merge it. Replaces go-autoupdate.
|
|
# A renovate.json in the calling repository adds to these defaults.
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
go-version:
|
|
description: "Go version to use"
|
|
required: false
|
|
type: string
|
|
default: ">=1.24"
|
|
go-working-directory:
|
|
description: "Directory that holds go.mod"
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
node-version:
|
|
description: "Node.js version to use"
|
|
required: false
|
|
type: string
|
|
default: "22"
|
|
node-working-directory:
|
|
description: "Directory that holds package.json"
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
node-scripts:
|
|
description: "Comma-separated package.json scripts to run, in order. A script that does not exist is skipped."
|
|
required: false
|
|
type: string
|
|
default: "lint,typecheck,test,build"
|
|
require-node-tests:
|
|
description: "Fail when a Node project has no test script, so an untested update never merges"
|
|
required: false
|
|
type: boolean
|
|
default: true
|
|
major-updates:
|
|
description: "What to do with major updates: 'separate' gives each its own branch, tested and merged on its own, 'batch' puts them in the one batch, 'ignore' skips them."
|
|
required: false
|
|
type: string
|
|
default: "separate"
|
|
minimum-release-age:
|
|
description: "Skip releases younger than this, for example '2 days'"
|
|
required: false
|
|
type: string
|
|
default: "2 days"
|
|
renovate-version:
|
|
description: "Renovate version for the action"
|
|
required: false
|
|
type: string
|
|
default: "44"
|
|
release-workflow:
|
|
description: "Workflow file to dispatch after a merge, for example release.yaml. It must have a workflow_dispatch trigger and the caller needs actions: write. Empty means no dispatch."
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
admin-merge:
|
|
description: "Merge with --admin, which bypasses branch protection. The workflow token cannot do this, so leave it off unless you pass a token that can."
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
lfs:
|
|
description: "Enable Git LFS checkout (for repos with large files)"
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
runner:
|
|
description: "Runner label, or JSON object such as {\"group\":\"ci\",\"labels\":[\"linux\"]} to select a runner group. Falls back to vars.SHARED_ACTIONS_RUNNER, then ubuntu-latest."
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
|
|
concurrency:
|
|
group: renovate-autoupdate-${{ github.repository }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
BATCH_BRANCH: deps-autoupdate/batch
|
|
ISSUE_TITLE: Dependency updates failing tests
|
|
|
|
jobs:
|
|
renovate:
|
|
name: Prepare the updates
|
|
runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
|
|
timeout-minutes: 45
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
outputs:
|
|
branches: ${{ steps.list.outputs.branches }}
|
|
base-sha: ${{ steps.base.outputs.sha }}
|
|
steps:
|
|
- name: Record the default branch commit
|
|
id: base
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
branch=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)
|
|
echo "sha=$(gh api "repos/$GITHUB_REPOSITORY/commits/$branch" --jq .sha)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Write Renovate config
|
|
env:
|
|
MIN_AGE: ${{ inputs.minimum-release-age }}
|
|
MAJOR_UPDATES: ${{ inputs.major-updates }}
|
|
CONFIG_FILE: ${{ runner.temp }}/renovate-autoupdate-config.json
|
|
run: |
|
|
jq -n \
|
|
--arg repo "$GITHUB_REPOSITORY" \
|
|
--arg age "$MIN_AGE" \
|
|
--arg branch_prefix "${BATCH_BRANCH%%/*}/" \
|
|
--arg majors "$MAJOR_UPDATES" \
|
|
'
|
|
{
|
|
platform: "github",
|
|
repositories: [$repo],
|
|
onboarding: false,
|
|
requireConfig: "optional",
|
|
branchPrefix: $branch_prefix,
|
|
enabledManagers: ["gomod", "npm"],
|
|
dependencyDashboard: false,
|
|
# Branches only: with no dashboard, no PR is ever opened. The workflow opens it after the tests.
|
|
prCreation: "approval",
|
|
# A PR closed after a merge or by hand must not stop a later update of the same package.
|
|
recreateWhen: "always",
|
|
rebaseWhen: "behind-base-branch",
|
|
semanticCommits: "enabled",
|
|
semanticCommitType: "chore",
|
|
semanticCommitScope: "deps",
|
|
minimumReleaseAge: $age,
|
|
prConcurrentLimit: 0,
|
|
prHourlyLimit: 0,
|
|
branchConcurrentLimit: 0,
|
|
# A Go major update changes the import path: rewrite the imports, so the build tests the real update.
|
|
postUpdateOptions: ["gomodTidy", "gomodUpdateImportPaths"],
|
|
statusCheckNames: {
|
|
artifactError: null,
|
|
configValidation: null,
|
|
mergeConfidence: null,
|
|
minimumReleaseAge: null
|
|
},
|
|
packageRules: (
|
|
[
|
|
({
|
|
matchManagers: ["gomod", "npm"],
|
|
groupName: "dependencies",
|
|
groupSlug: "batch"
|
|
} + (if $majors == "batch" then {} else {matchUpdateTypes: ["minor", "patch", "pin", "pinDigest", "digest"]} end)),
|
|
{matchManagers: ["gomod"], matchDepTypes: ["indirect"], enabled: true},
|
|
# The parent module chooses the major version of an indirect dependency.
|
|
{matchManagers: ["gomod"], matchDepTypes: ["indirect"], allowedVersions: "<{{add major 1}}.0.0"},
|
|
{matchPackageNames: ["typescript"], allowedVersions: "<7"}
|
|
]
|
|
# Rules that disable by update type are ignored, but a version cap works.
|
|
+ (if $majors == "ignore" then [{matchManagers: ["gomod", "npm"], allowedVersions: "<{{add major 1}}.0.0"}] else [] end)
|
|
)
|
|
}' > "$CONFIG_FILE"
|
|
jq . "$CONFIG_FILE"
|
|
|
|
- name: Run Renovate
|
|
uses: renovatebot/[email protected]
|
|
with:
|
|
configurationFile: ${{ runner.temp }}/renovate-autoupdate-config.json
|
|
token: ${{ github.token }}
|
|
renovate-version: ${{ inputs.renovate-version }}
|
|
env:
|
|
LOG_LEVEL: info
|
|
|
|
- name: List the update branches
|
|
id: list
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
prefix="${BATCH_BRANCH%%/*}/"
|
|
all=$(gh api --paginate "repos/$GITHUB_REPOSITORY/branches" --jq '.[].name' | grep -F "$prefix" || true)
|
|
# The batch first, then each major update.
|
|
ordered=$({ printf '%s\n' "$all" | grep -Fx "$BATCH_BRANCH" || true; printf '%s\n' "$all" | grep -vFx "$BATCH_BRANCH" || true; } | sed '/^$/d')
|
|
json=$(printf '%s\n' "$ordered" | jq -R . | jq -sc 'map(select(length > 0))')
|
|
echo "branches=$json" >> "$GITHUB_OUTPUT"
|
|
echo "Update branches: $json"
|
|
|
|
test-and-merge:
|
|
name: Test and merge ${{ matrix.branch }}
|
|
needs: renovate
|
|
if: needs.renovate.outputs.branches != '[]'
|
|
runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: write
|
|
issues: write
|
|
pull-requests: write
|
|
strategy:
|
|
fail-fast: false
|
|
# One at a time, so each branch is tested on top of the ones merged before it.
|
|
max-parallel: 1
|
|
matrix:
|
|
branch: ${{ fromJSON(needs.renovate.outputs.branches) }}
|
|
env:
|
|
BRANCH: ${{ matrix.branch }}
|
|
GH_TOKEN: ${{ github.token }}
|
|
steps:
|
|
- name: Find the default branch
|
|
id: default
|
|
run: echo "branch=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)" >> "$GITHUB_OUTPUT"
|
|
|
|
# Not the triggering ref: a push or a manual run from another branch must still test the default branch.
|
|
- name: Checkout the default branch
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ steps.default.outputs.branch }}
|
|
fetch-depth: 0
|
|
lfs: ${{ inputs.lfs }}
|
|
|
|
- name: Merge the update branch locally
|
|
id: merge
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git fetch origin "$BRANCH"
|
|
echo "head=$(git rev-parse FETCH_HEAD)" >> "$GITHUB_OUTPUT"
|
|
echo "subject=$(git log -1 --format=%s FETCH_HEAD)" >> "$GITHUB_OUTPUT"
|
|
if git merge-base --is-ancestor FETCH_HEAD HEAD; then
|
|
echo "::notice::$BRANCH is already in the default branch."
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
elif git merge --no-ff --no-commit FETCH_HEAD; then
|
|
echo "skip=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
git merge --abort
|
|
echo "::warning::$BRANCH conflicts with the default branch. Renovate rebases it on the next run."
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Run workflow prepare script
|
|
if: steps.merge.outputs.skip != 'true'
|
|
shell: bash
|
|
run: |
|
|
if [ -f "./workflow-prepare.sh" ]; then
|
|
chmod +x ./workflow-prepare.sh
|
|
./workflow-prepare.sh
|
|
fi
|
|
|
|
- name: Detect project types
|
|
id: detect
|
|
if: steps.merge.outputs.skip != 'true'
|
|
env:
|
|
GO_DIR: ${{ inputs.go-working-directory }}
|
|
NODE_DIR: ${{ inputs.node-working-directory }}
|
|
run: |
|
|
go=false
|
|
node=false
|
|
pm=npm
|
|
if [ -f "$GO_DIR/go.mod" ]; then go=true; fi
|
|
if [ -f "$NODE_DIR/package.json" ]; then
|
|
node=true
|
|
if [ -f "$NODE_DIR/pnpm-lock.yaml" ]; then pm=pnpm
|
|
elif [ -f "$NODE_DIR/yarn.lock" ]; then pm=yarn
|
|
fi
|
|
fi
|
|
if [ "$go" = false ] && [ "$node" = false ]; then
|
|
echo "::error::Neither $GO_DIR/go.mod nor $NODE_DIR/package.json exists, so there is nothing to test."
|
|
exit 1
|
|
fi
|
|
{
|
|
echo "go=$go"
|
|
echo "node=$node"
|
|
echo "pm=$pm"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Setup Go
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.go == 'true'
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version: ${{ inputs.go-version }}
|
|
check-latest: true
|
|
cache: true
|
|
cache-dependency-path: ${{ inputs.go-working-directory }}/go.sum
|
|
|
|
- name: Build and test Go
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.go == 'true'
|
|
working-directory: ${{ inputs.go-working-directory }}
|
|
run: |
|
|
set -o pipefail
|
|
{
|
|
go mod verify
|
|
go build ./...
|
|
go test -race -cover ./...
|
|
} 2>&1 | tee -a "$RUNNER_TEMP/test-output.log"
|
|
|
|
- name: Setup Node.js
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ inputs.node-version }}
|
|
|
|
- name: Install Node dependencies
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
|
|
working-directory: ${{ inputs.node-working-directory }}
|
|
env:
|
|
PM: ${{ steps.detect.outputs.pm }}
|
|
run: |
|
|
set -o pipefail
|
|
{
|
|
# The lockfile must match what Renovate wrote: install without updating it.
|
|
case "$PM" in
|
|
pnpm | yarn)
|
|
command -v corepack >/dev/null || npm install --global corepack
|
|
corepack enable "$PM"
|
|
;;
|
|
esac
|
|
case "$PM" in
|
|
pnpm) pnpm install --frozen-lockfile ;;
|
|
yarn) yarn install --immutable ;;
|
|
npm)
|
|
if [ -f package-lock.json ]; then npm ci; else npm install; fi
|
|
;;
|
|
esac
|
|
} 2>&1 | tee -a "$RUNNER_TEMP/test-output.log"
|
|
|
|
- name: Run Node scripts
|
|
if: steps.merge.outputs.skip != 'true' && steps.detect.outputs.node == 'true'
|
|
working-directory: ${{ inputs.node-working-directory }}
|
|
env:
|
|
PM: ${{ steps.detect.outputs.pm }}
|
|
SCRIPTS: ${{ inputs.node-scripts }}
|
|
REQUIRE_TESTS: ${{ inputs.require-node-tests }}
|
|
run: |
|
|
set -o pipefail
|
|
log="$RUNNER_TEMP/test-output.log"
|
|
if [ "$REQUIRE_TESTS" = true ] && ! jq -e '.scripts.test' package.json >/dev/null; then
|
|
echo "::error::package.json has no test script. Add one, or set require-node-tests to false."
|
|
echo "package.json has no test script, so the update was not tested." >>"$log"
|
|
exit 1
|
|
fi
|
|
IFS=',' read -r -a scripts <<<"$SCRIPTS"
|
|
for script in "${scripts[@]}"; do
|
|
script=$(echo "$script" | xargs)
|
|
[ -n "$script" ] || continue
|
|
if jq -e --arg s "$script" '.scripts[$s]' package.json >/dev/null; then
|
|
echo "::group::$PM run $script"
|
|
"$PM" run "$script" 2>&1 | tee -a "$log"
|
|
echo "::endgroup::"
|
|
else
|
|
echo "::notice::No '$script' script, skipping."
|
|
fi
|
|
done
|
|
|
|
- name: Mark the tests as passed
|
|
if: steps.merge.outputs.skip != 'true'
|
|
run: touch "$RUNNER_TEMP/tests-passed"
|
|
|
|
- name: Open the PR and merge it
|
|
if: steps.merge.outputs.skip != 'true'
|
|
env:
|
|
HEAD_SHA: ${{ steps.merge.outputs.head }}
|
|
SUBJECT: ${{ steps.merge.outputs.subject }}
|
|
ADMIN: ${{ inputs.admin-merge && 'true' || '' }}
|
|
run: |
|
|
default=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)
|
|
pr=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --state open --json number --jq '.[0].number // empty')
|
|
if [ -z "$pr" ]; then
|
|
url=$(gh pr create --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --base "$default" \
|
|
--title "$SUBJECT" \
|
|
--body "Automated dependency update. The tests passed on the result of merging this branch into $default.")
|
|
pr=${url##*/}
|
|
fi
|
|
# GitHub needs a moment to work out whether the PR can merge.
|
|
for _ in $(seq 1 12); do
|
|
state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" --json mergeable --jq .mergeable)
|
|
[ "$state" != UNKNOWN ] && break
|
|
sleep 5
|
|
done
|
|
if [ "$state" = CONFLICTING ]; then
|
|
gh pr close "$pr" --repo "$GITHUB_REPOSITORY" \
|
|
--comment "The tests passed, but the branch conflicts with $default. Renovate rebases it on the next run."
|
|
echo "::warning::$BRANCH conflicts with $default, so PR #$pr was closed. Renovate rebases it on the next run."
|
|
echo "\`$BRANCH\` passed its tests but conflicts with \`$default\`. Renovate rebases it on the next run." >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
# --match-head-commit refuses to merge anything newer than the commit that was tested.
|
|
if ! gh pr merge "$pr" --repo "$GITHUB_REPOSITORY" --squash --delete-branch \
|
|
--match-head-commit "$HEAD_SHA" \
|
|
--subject "$SUBJECT" \
|
|
--body "Automated dependency update. All tests passed." \
|
|
${ADMIN:+--admin}; then
|
|
gh pr close "$pr" --repo "$GITHUB_REPOSITORY" --comment "The tests passed, but GitHub refused the merge. See the workflow run. The next run tries again."
|
|
exit 1
|
|
fi
|
|
echo "Merged #$pr ($BRANCH)." >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Report the failure
|
|
if: failure()
|
|
# Best effort: the summary is always written, the issue needs issues: write.
|
|
continue-on-error: true
|
|
env:
|
|
HEAD_SHA: ${{ steps.merge.outputs.head }}
|
|
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
run: |
|
|
if [ -e "$RUNNER_TEMP/tests-passed" ]; then
|
|
echo "The tests passed for \`$BRANCH\`, but the merge failed. See the log above. The next run tries again." >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
echo "The tests failed for \`$BRANCH\`, so no PR was opened. Renovate retries on the next run." >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
log="$RUNNER_TEMP/test-output.log"
|
|
esc=$(printf '\033')
|
|
marker="<!-- renovate-autoupdate:$BRANCH -->"
|
|
body="$RUNNER_TEMP/failure-comment.md"
|
|
{
|
|
echo "$marker"
|
|
echo "### \`$BRANCH\` failed its tests"
|
|
echo
|
|
echo "Commit \`${HEAD_SHA:0:8}\`, [workflow run]($RUN_URL), $(date -u '+%Y-%m-%d %H:%M') UTC. No PR was opened."
|
|
echo
|
|
echo "<details open><summary>Test output, last lines</summary>"
|
|
echo
|
|
echo '`````'
|
|
if [ -s "$log" ]; then
|
|
sed -E "s/${esc}\[[0-9;]*[A-Za-z]//g" "$log" | tail -c 50000
|
|
else
|
|
echo "No output was captured. See the workflow run."
|
|
fi
|
|
echo '`````'
|
|
echo
|
|
echo "</details>"
|
|
} > "$body"
|
|
|
|
issue=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "\"$ISSUE_TITLE\" in:title" --json number,title \
|
|
--jq "[.[] | select(.title == \"$ISSUE_TITLE\")][0].number // empty")
|
|
if [ -z "$issue" ]; then
|
|
url=$(gh issue create --repo "$GITHUB_REPOSITORY" --title "$ISSUE_TITLE" \
|
|
--body "Updates that failed their tests, so no PR was opened. Each comment holds the output for one branch. Fix the cause on the branch or in the code. The workflow retries on every run, merges an update once it passes, and closes this issue when none fail.")
|
|
issue=${url##*/}
|
|
fi
|
|
id=$(gh api "repos/$GITHUB_REPOSITORY/issues/$issue/comments" --paginate \
|
|
--jq ".[] | select(.body | contains(\"$marker\")) | .id" | head -n 1)
|
|
if [ -n "$id" ]; then
|
|
gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -F body=@"$body" >/dev/null
|
|
else
|
|
gh issue comment "$issue" --repo "$GITHUB_REPOSITORY" --body-file "$body"
|
|
fi
|
|
|
|
tidy-failures:
|
|
name: Tidy the failure issue
|
|
needs: [renovate, test-and-merge]
|
|
if: always() && needs.renovate.result == 'success'
|
|
runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
|
|
timeout-minutes: 10
|
|
permissions:
|
|
issues: write
|
|
contents: read
|
|
steps:
|
|
- name: Remove fixed updates and close the issue when none fail
|
|
continue-on-error: true
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
issue=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "\"$ISSUE_TITLE\" in:title" --json number,title \
|
|
--jq "[.[] | select(.title == \"$ISSUE_TITLE\")][0].number // empty")
|
|
[ -n "$issue" ] || exit 0
|
|
branches=$(gh api --paginate "repos/$GITHUB_REPOSITORY/branches" --jq '.[].name')
|
|
remaining=0
|
|
while IFS=$'\t' read -r id branch; do
|
|
[ -n "$id" ] || continue
|
|
if printf '%s\n' "$branches" | grep -Fxq "$branch"; then
|
|
remaining=$((remaining + 1))
|
|
else
|
|
gh api -X DELETE "repos/$GITHUB_REPOSITORY/issues/comments/$id"
|
|
fi
|
|
done < <(gh api "repos/$GITHUB_REPOSITORY/issues/$issue/comments" --paginate \
|
|
--jq '.[] | select(.body | startswith("<!-- renovate-autoupdate:")) | [.id, (.body | split("\n")[0] | sub("^<!-- renovate-autoupdate:"; "") | sub(" -->$"; ""))] | @tsv')
|
|
if [ "$remaining" -eq 0 ]; then
|
|
gh issue close "$issue" --repo "$GITHUB_REPOSITORY" --comment "Every dependency update now passes its tests."
|
|
fi
|
|
|
|
release:
|
|
name: Dispatch the release
|
|
needs: [renovate, test-and-merge]
|
|
if: always() && needs.renovate.outputs.branches != '[]' && inputs.release-workflow != ''
|
|
runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}
|
|
timeout-minutes: 10
|
|
permissions:
|
|
actions: write
|
|
contents: read
|
|
steps:
|
|
- name: Dispatch when the default branch moved
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
RELEASE_WORKFLOW: ${{ inputs.release-workflow }}
|
|
BASE_SHA: ${{ needs.renovate.outputs.base-sha }}
|
|
run: |
|
|
# A push made with github.token does not trigger workflows, so dispatch the release explicitly.
|
|
branch=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)
|
|
now=$(gh api "repos/$GITHUB_REPOSITORY/commits/$branch" --jq .sha)
|
|
if [ "$now" = "$BASE_SHA" ]; then
|
|
echo "Nothing was merged, so no release."
|
|
exit 0
|
|
fi
|
|
gh workflow run "$RELEASE_WORKFLOW" --repo "$GITHUB_REPOSITORY" --ref "$branch"
|