shared-actions/.github/workflows/go-autoupdate.yaml

name: Go Autoupdate

on:
  workflow_call:
    inputs:
      go-version:
        description: "Go version to use"
        required: false
        type: string
        default: ">=1.24"
      release-workflow:
        description: "Release workflow file to trigger (e.g., release.yml)"
        required: false
        type: string
        default: "release.yml"
      lfs:
        description: "Enable Git LFS checkout (for repos with large files)"
        required: false
        type: boolean
        default: false

      runner:
        description: "Runner label, or JSON object such as {\"group\":\"ci\",\"labels\":[\"linux\"]} to select a runner group. Falls back to vars.SHARED_ACTIONS_RUNNER, then ubuntu-latest."
        required: false
        type: string
        default: ""

concurrency:
  group: autoupdate-${{ github.repository }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  autoupdate:
    name: Update dependencies and test
    runs-on: ${{ fromJSON(startsWith(inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest', '{') && (inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest') || format('"{0}"', inputs.runner || vars.SHARED_ACTIONS_RUNNER || 'ubuntu-latest')) }}

    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          lfs: ${{ inputs.lfs }}

      - name: Run workflow prepare script
        shell: bash
        run: |
          if [ -f "./workflow-prepare.sh" ]; then
            chmod +x ./workflow-prepare.sh
            ./workflow-prepare.sh
          fi

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version: ${{ inputs.go-version }}
          check-latest: true
          cache: true

      - name: Update dependencies
        shell: bash
        run: |
          # Indirect modules can move ahead of their parents (for example
          # kube-openapi ahead of apimachinery), which breaks the build.
          update_all() { go get -u ./... && go mod tidy && go build ./...; }
          update_direct() {
            local mods=()
            while IFS= read -r m; do mods+=("$m"); done < <(go list -m -f '{{if and (not .Indirect) (not .Main)}}{{.Path}}@latest{{end}}' all)
            if [ "${#mods[@]}" -gt 0 ]; then go get "${mods[@]}"; fi
            go mod tidy
          }
          if ! update_all; then
            echo "::warning title=Full update failed::Falling back to direct dependencies only"
            git checkout -- go.mod go.sum
            update_direct
          fi

      - name: Run tests
        run: go test -race -cover ./...

      - name: Check for changes
        id: changes
        run: |
          if git diff --quiet go.mod go.sum; then
            echo "changes_detected=false" >> $GITHUB_OUTPUT
          else
            echo "changes_detected=true" >> $GITHUB_OUTPUT
          fi

      - name: Create Pull Request
        id: create-pr
        if: steps.changes.outputs.changes_detected == 'true'
        uses: peter-evans/create-pull-request@v8
        with:
          token: ${{ secrets.HOMEBREW_TAP_TOKEN || github.token }}
          commit-message: "Update go.mod and go.sum"
          title: "Update Go dependencies"
          body: |
            Automated dependency update.

            - Updated `go.mod` and `go.sum` via `go get -u ./...`
            - All tests passed
          branch: auto-update-go-deps
          delete-branch: true

      - name: Merge PR
        if: steps.create-pr.outputs.pull-request-number
        run: gh pr merge --squash --delete-branch --admin "${{ steps.create-pr.outputs.pull-request-number }}"
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN || github.token }}