dependabot-sync-bazel-backfill.yml

name: dependabot-sync-bazel-backfill

on:
  workflow_dispatch:
    inputs:
      backfill_open_prs:
        description: "Sync all currently open Dependabot pom.xml PRs"
        required: true
        type: boolean
        default: false

jobs:
  sync-open-dependabot-prs:
    if: >-
      github.event_name == 'workflow_dispatch' &&
      github.event.inputs.backfill_open_prs == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
    env:
      BAZELISK_SKIP_VERSION_CHECK: "1"

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Java 17
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
        with:
          distribution: temurin
          java-version: 17

      - name: Install Bazelisk
        run: |
          mkdir -p "$HOME/.local/bin"
          curl -fsSL \
            https://github.com/bazelbuild/bazelisk/releases/download/v1.24.1/bazelisk-linux-amd64 \
            -o "$HOME/.local/bin/bazel"
          chmod +x "$HOME/.local/bin/bazel"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Preserve Bazel sync script
        run: |
          cp scripts/sync_bazel_dependencies.py "${RUNNER_TEMP}/sync_bazel_dependencies.py"

      - name: Sync all open Dependabot pom.xml PRs
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}"
          open_prs_json='[]'
          page=1
          while :; do
            page_json="$(curl -fsSL \
              -u "x-access-token:${GITHUB_TOKEN}" \
              -H "Accept: application/vnd.github+json" \
              "${api}/pulls?state=open&per_page=100&page=${page}")"
            open_prs_json="$(jq -s 'add' \
              <(printf '%s' "${open_prs_json}") \
              <(printf '%s' "${page_json}"))"
            if [[ "$(jq 'length' <<< "${page_json}")" -lt 100 ]]; then
              break
            fi
            page=$((page + 1))
          done

          while IFS=$'\t' read -r number head_ref head_repo base_ref author; do
            if [[ "${author}" != "dependabot[bot]" ]]; then
              continue
            fi
            if [[ "${base_ref}" != "master" ]]; then
              continue
            fi
            if [[ "${head_repo}" != "${GITHUB_REPOSITORY}" ]]; then
              echo "Skipping #${number}; head repo ${head_repo} is not ${GITHUB_REPOSITORY}."
              continue
            fi
            if [[ "${head_ref}" != "dependabot/"* ]]; then
              echo "Skipping #${number}; branch ${head_ref} is not a Dependabot branch."
              continue
            fi

            pr_files_json="$(curl -fsSL \
              -u "x-access-token:${GITHUB_TOKEN}" \
              -H "Accept: application/vnd.github+json" \
              "${api}/pulls/${number}/files?per_page=100")"
            if ! jq -e '.[] | select(.filename == "pom.xml")' >/dev/null <<< "${pr_files_json}"; then
              echo "Skipping #${number}; root pom.xml was not changed."
              continue
            fi

            echo "Processing Dependabot PR #${number} (${head_ref})"
            git fetch origin "${head_ref}"
            git checkout -B "dependabot-sync-work" "origin/${head_ref}"
            # Ensure each PR branch starts from a clean checkout before sync.
            git reset --hard
            git clean -fd

            python3 "${RUNNER_TEMP}/sync_bazel_dependencies.py" --root "$PWD"
            REPIN=1 bazel run @maven//:pin

            if git diff --quiet -- MODULE.bazel maven_install.json; then
              echo "No Bazel dependency changes needed for #${number}."
              continue
            fi

            git add MODULE.bazel maven_install.json
            git commit -m "Sync Bazel dependencies for Dependabot update (#${number})"
            git push origin "HEAD:${head_ref}"
          done < <(jq -r '.[] | [.number, .head.ref, .head.repo.full_name, .base.ref, .user.login] | @tsv' <<< "${open_prs_json}")