dependency-updates.yml

# thinRoot dependency update automation
# yamllint disable rule:truthy
---
name: Dependency Updates

on:
  schedule:
    - cron: '0 2 * * *'  # run daily at 02:00 UTC
  workflow_dispatch:

concurrency:
  group: dependency-updates-${{ github.repository }}
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write

jobs:
  dependency-updates:
    name: check (${{ matrix.slug }})
    if: ${{ github.repository == 'jens-maus/thinRoot' }}
    runs-on: ubuntu-24.04
    env:
      BRANCH_PREFIX: pr/dependency-update-
    strategy:
      fail-fast: false
      matrix:
        include:
          - slug: buildroot
            script: scripts/update-buildroot.sh
            package: buildroot
            version_file: Makefile
            version_regex: '^BUILDROOT_VERSION=(.*)$'
          - slug: freerdp3
            script: scripts/update-freerdp3.sh
            package: freerdp3
            version_file: buildroot-external/package/freerdp3/freerdp3.mk
            version_regex: '^FREERDP3_VERSION = (.*)$'
          - slug: hotkeyd
            script: scripts/update-hotkeyd.sh
            package: hotkeyd
            version_file: buildroot-external/package/hotkeyd/hotkeyd.mk
            version_regex: '^HOTKEYD_VERSION = (.*)$'
          - slug: kernel-upstream
            script: scripts/update-kernel-upstream.sh
            package: linux
            version_file: buildroot-external/configs/generic-x86_64.config
            version_regex: '^BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="([^"]+)"$'
          - slug: qutselect
            script: scripts/update-qutselect.sh
            package: qutselect
            version_file: buildroot-external/package/qutselect/qutselect.mk
            version_regex: '^QUTSELECT_VERSION = (.*)$'
          - slug: rpi-eeprom
            script: scripts/update-rpi-eeprom.sh
            package: rpi-eeprom
            version_file: buildroot-external/package/rpi-eeprom/rpi-eeprom.mk
            version_regex: '^RPI_EEPROM_VERSION = (.*)$'
          - slug: rpi-firmware
            script: scripts/update-rpi-firmware.sh
            package: rpi-firmware
            version_file: buildroot-external/configs/rpi4.config
            version_regex: '^BR2_PACKAGE_RPI_FIRMWARE_VERSION="([^"]+)"$'
          - slug: rpi-kernel
            script: scripts/update-rpi-kernel.sh
            package: linux-rpi
            version_file: buildroot-external/configs/rpi4.config
            version_regex: '^BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github\.com/raspberrypi/linux/archive/([^"]+)\.tar\.gz"$'
          - slug: thinlinc
            script: scripts/update-thinlinc.sh
            package: thinlinc
            version_file: buildroot-external/package/thinlinc/thinlinc.mk
            version_regex: '^THINLINC_VERSION = (.*)$'

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install workflow dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends jq

      - name: Run dependency update script
        run: ./${{ matrix.script }}

      - name: Check for updated files
        id: changes
        run: |
          if git diff --quiet; then
            echo "changed=false" >>"${GITHUB_OUTPUT}"
          else
            echo "changed=true" >>"${GITHUB_OUTPUT}"
          fi

      - name: Resolve package and version metadata
        id: metadata
        if: steps.changes.outputs.changed == 'true'
        run: |
          previous_version=$(git --no-pager show "HEAD:${{ matrix.version_file }}" \
            | sed -nE 's|${{ matrix.version_regex }}|\1|p' \
            | head -n1)
          version=$(sed -nE 's|${{ matrix.version_regex }}|\1|p' '${{ matrix.version_file }}' | head -n1)
          if [[ -z "${version}" ]]; then
            version=$(git --no-pager diff -- '${{ matrix.version_file }}' \
              | sed -nE 's|^\+[^+]*[[:space:]=]+([0-9a-f]{40})$|\1|p' \
              | head -n1)
          fi

          if [[ "${version}" =~ ^[0-9a-f]{40}$ ]]; then
            version="${version:0:7}"
          fi

          if [[ "${previous_version}" =~ ^[0-9a-f]{40}$ ]]; then
            previous_version="${previous_version:0:7}"
          fi

          if [[ -z "${version}" ]]; then
            echo "::error::Failed to determine version for package '${{ matrix.package }}' from '${{ matrix.version_file }}'"
            exit 1
          fi

          if [[ -n "${previous_version}" && "${previous_version}" == "${version}" ]]; then
            echo "no_update=true" >>"${GITHUB_OUTPUT}"
            echo "Detected file changes but package version remained unchanged (${version}). Skipping PR creation."
            exit 0
          fi

          echo "package=${{ matrix.package }}" >>"${GITHUB_OUTPUT}"
          echo "previous_version=${previous_version}" >>"${GITHUB_OUTPUT}"
          echo "version=${version}" >>"${GITHUB_OUTPUT}"
          echo "no_update=false" >>"${GITHUB_OUTPUT}"

      - name: Check package patch apply status
        id: patch_check
        if: steps.changes.outputs.changed == 'true' && steps.metadata.outputs.no_update != 'true'
        env:
          PACKAGE: ${{ steps.metadata.outputs.package }}
        run: |
          echo "patch_warning=false" >>"${GITHUB_OUTPUT}"
          shopt -s nullglob
          package_patch_files=(buildroot-external/package/"${PACKAGE}"/*.patch)
          global_patch_files=(buildroot-external/patches/"${PACKAGE}"/*.patch)
          if [[ ${#package_patch_files[@]} -eq 0 && ${#global_patch_files[@]} -eq 0 ]]; then
            echo "No package/global patch files found for '${PACKAGE}', skipping patch apply check."
            exit 0
          fi

          make PRODUCT=generic-x86_64 build-generic-x86_64/.config
          if ! make -C build-generic-x86_64 "${PACKAGE}-dirclean" "${PACKAGE}-patch"; then
            echo "::warning::Patch apply check failed for package '${PACKAGE}'. The version bump likely requires patch updates."
            echo "patch_warning=true" >>"${GITHUB_OUTPUT}"
          fi

      - name: Compose PR body
        id: pr_body
        if: steps.changes.outputs.changed == 'true' && steps.metadata.outputs.no_update != 'true'
        run: |
          body_file="${RUNNER_TEMP}/pr_body.md"
          cat >"${body_file}" <<'PR_BODY'
          Dependency update generated by thinRoot nightly update check workflow.

          Updated component:
          - Name...........: `${{ matrix.slug }}`
          - Package........: `${{ steps.metadata.outputs.package }}`
          - Current version: `${{ steps.metadata.outputs.previous_version }}`
          - New version....: `${{ steps.metadata.outputs.version }}`
          PR_BODY
          if [[ "${{ steps.patch_check.outputs.patch_warning }}" == "true" ]]; then
            cat >>"${body_file}" <<'PR_WARNING'

          > [!WARNING]
          > Patch apply check failed for package `${{ steps.metadata.outputs.package }}`.
          > The version bump likely requires updates to existing patch files before this change can be merged.
          PR_WARNING
          fi
          echo "body_file=${body_file}" >>"${GITHUB_OUTPUT}"

      - name: Check for existing similar open PR
        id: duplicate
        if: steps.changes.outputs.changed == 'true' && steps.metadata.outputs.no_update != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          UPDATE_SLUG: ${{ matrix.slug }}
          PR_TITLE: "bump ${{ matrix.slug }} to ${{ steps.metadata.outputs.version }}"
        run: |
          AUTH_HEADER="Authorization: Bearer ${GH_TOKEN}"
          open_prs='[]'
          page=1
          while true; do
            page_prs=$(curl -fsSL \
              -H "${AUTH_HEADER}" \
              -H "Accept: application/vnd.github+json" \
              "https://api.github.com/repos/${{ github.repository }}/pulls?state=open&per_page=100&page=${page}")
            open_prs=$(jq -cn --argjson acc "${open_prs}" --argjson page_prs "${page_prs}" '$acc + $page_prs')
            page_count=$(echo "${page_prs}" | jq 'length')
            if [[ "${page_count}" -lt 100 ]]; then
              break
            fi
            page=$((page + 1))
          done

          count=$(echo "${open_prs}" | jq --arg title "${PR_TITLE}" \
            '[.[] | select(.title == $title)] | length')

          if [[ "${count}" -gt 0 ]]; then
            echo "skip=true" >>"${GITHUB_OUTPUT}"
            echo "Found existing open PR with the same change request title. Skipping PR creation."
          else
            echo "skip=false" >>"${GITHUB_OUTPUT}"
            stale_pr_numbers=$(echo "${open_prs}" | jq -r \
              --arg branch_prefix "${BRANCH_PREFIX}" \
              --arg slug "${UPDATE_SLUG}" \
              --arg title_prefix "bump ${UPDATE_SLUG} to " \
              '.[] | select(.head.ref | startswith($branch_prefix + $slug + "-")) | select(.title | startswith($title_prefix)) | .number')

            if [[ -n "${stale_pr_numbers}" ]]; then
              while IFS= read -r pr_number; do
                [[ -z "${pr_number}" ]] && continue
                curl -fsSL -X PATCH \
                  -H "${AUTH_HEADER}" \
                  -H "Accept: application/vnd.github+json" \
                  -H "Content-Type: application/json" \
                  "https://api.github.com/repos/${{ github.repository }}/pulls/${pr_number}" \
                  -d '{"state":"closed"}'
                echo "Closed stale open PR #${pr_number} for ${UPDATE_SLUG}."
              done <<< "${stale_pr_numbers}"
            fi
          fi

      - name: Create pull request
        if: steps.changes.outputs.changed == 'true' && steps.metadata.outputs.no_update != 'true' && steps.duplicate.outputs.skip != 'true'
        uses: peter-evans/create-pull-request@v8
        with:
          token: ${{ secrets.AUTO_MERGE_TOKEN != '' && secrets.AUTO_MERGE_TOKEN || github.token }}
          branch: ${{ env.BRANCH_PREFIX }}${{ matrix.slug }}-${{ steps.metadata.outputs.version }}
          delete-branch: true
          commit-message: "bump ${{ matrix.slug }} to ${{ steps.metadata.outputs.version }}"
          title: "bump ${{ matrix.slug }} to ${{ steps.metadata.outputs.version }}"
          body-path: ${{ steps.pr_body.outputs.body_file }}
          labels: dependencies