180 lines
8.0 KiB
YAML
180 lines
8.0 KiB
YAML
name: Watch upstream OpenCode
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "23 */6 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: opencode-upstream-watcher
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
open-compatibility-pr:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Resolve latest release
|
|
id: release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
release="$(gh api repos/anomalyco/opencode/releases/latest)"
|
|
tag="$(jq -r .tag_name <<<"$release")"
|
|
digest="$(docker buildx imagetools inspect "ghcr.io/anomalyco/opencode:${tag#v}" --format '{{json .Manifest}}' | jq -r .digest)"
|
|
image="ghcr.io/anomalyco/opencode@$digest"
|
|
published_at="$(jq -r .published_at <<<"$release")"
|
|
release_url="$(jq -r .html_url <<<"$release")"
|
|
current="$(jq -r .release_tag manifests/upstream.json)"
|
|
current_image="$(jq -r .image manifests/upstream.json)"
|
|
current_image_count="$(
|
|
jq \
|
|
--arg image "$image" \
|
|
'[.public_ci[]? | select(.image == $image)] | length' \
|
|
manifests/image-matrix.json
|
|
)"
|
|
ruby scripts/upstream_branch_name.rb "$tag" "$digest" >/dev/null
|
|
ruby -rtime -e 'Time.iso8601(ARGV.fetch(0))' "$published_at"
|
|
test "$release_url" = "https://github.com/anomalyco/opencode/releases/tag/$tag"
|
|
echo "tag=$tag" >> "$GITHUB_OUTPUT"
|
|
echo "digest=$digest" >> "$GITHUB_OUTPUT"
|
|
echo "published_at=$published_at" >> "$GITHUB_OUTPUT"
|
|
echo "release_url=$release_url" >> "$GITHUB_OUTPUT"
|
|
if [ "$tag" = "$current" ] && [ "$image" != "$current_image" ]; then
|
|
echo "same_tag_digest_changed=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "same_tag_digest_changed=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
if [ "$tag" = "$current" ] && [ "$image" = "$current_image" ] && [ "$current_image_count" -eq 1 ]; then
|
|
echo "changed=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "changed=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
- name: Resolve collision-safe compatibility branch
|
|
if: steps.release.outputs.changed == 'true'
|
|
id: branch
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ steps.release.outputs.tag }}
|
|
DIGEST: ${{ steps.release.outputs.digest }}
|
|
run: |
|
|
base_branch="$(ruby scripts/upstream_branch_name.rb "$TAG" "$DIGEST")"
|
|
expected_image="ghcr.io/anomalyco/opencode@$DIGEST"
|
|
open_branch=""
|
|
open_prs="$(
|
|
gh pr list --state open --base main --limit 1000 \
|
|
--json baseRefName,headRefName,headRefOid,headRepository,headRepositoryOwner,isCrossRepository
|
|
)"
|
|
while IFS=$'\t' read -r candidate_branch head_oid; do
|
|
[ -n "$candidate_branch" ] || continue
|
|
if ! candidate_upstream="$(
|
|
gh api \
|
|
-H "Accept: application/vnd.github.raw+json" \
|
|
"repos/$GITHUB_REPOSITORY/contents/manifests/upstream.json?ref=$head_oid" 2>/dev/null
|
|
)"; then
|
|
continue
|
|
fi
|
|
if ! candidate_matrix="$(
|
|
gh api \
|
|
-H "Accept: application/vnd.github.raw+json" \
|
|
"repos/$GITHUB_REPOSITORY/contents/manifests/image-matrix.json?ref=$head_oid" 2>/dev/null
|
|
)"; then
|
|
continue
|
|
fi
|
|
if jq -e \
|
|
--arg tag "$TAG" \
|
|
--arg image "$expected_image" \
|
|
'.release_tag == $tag and .image == $image' \
|
|
>/dev/null <<<"$candidate_upstream" &&
|
|
jq -e \
|
|
--arg image "$expected_image" \
|
|
'([.public_ci[]? | select(.image == $image)] | length) == 1' \
|
|
>/dev/null <<<"$candidate_matrix"; then
|
|
open_branch="$candidate_branch"
|
|
break
|
|
fi
|
|
done < <(
|
|
jq -r \
|
|
--arg base "$base_branch" \
|
|
--arg owner "${GITHUB_REPOSITORY%%/*}" \
|
|
--arg repository "${GITHUB_REPOSITORY#*/}" \
|
|
'.[] | select(
|
|
.baseRefName == "main" and
|
|
.isCrossRepository == false and
|
|
.headRepositoryOwner.login == $owner and
|
|
.headRepository.name == $repository and
|
|
(.headRefName == $base or (.headRefName | startswith($base + "-r")))
|
|
) | [.headRefName, .headRefOid] | @tsv' \
|
|
<<<"$open_prs"
|
|
)
|
|
if [ -n "$open_branch" ]; then
|
|
echo "branch=$open_branch" >> "$GITHUB_OUTPUT"
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
|
|
branch="$base_branch"
|
|
existing_count="$(
|
|
gh pr list --state all --base main --head "$base_branch" --limit 1000 \
|
|
--json baseRefName,headRepository,headRepositoryOwner,isCrossRepository |
|
|
jq \
|
|
--arg owner "${GITHUB_REPOSITORY%%/*}" \
|
|
--arg repository "${GITHUB_REPOSITORY#*/}" \
|
|
'[.[] | select(
|
|
.baseRefName == "main" and
|
|
.isCrossRepository == false and
|
|
.headRepositoryOwner.login == $owner and
|
|
.headRepository.name == $repository
|
|
)] | length'
|
|
)"
|
|
if [ "$existing_count" -gt 0 ] || git ls-remote --exit-code --heads origin "$base_branch" >/dev/null 2>&1; then
|
|
branch="$(ruby scripts/upstream_branch_name.rb "$TAG" "$DIGEST" "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}")"
|
|
fi
|
|
echo "branch=$branch" >> "$GITHUB_OUTPUT"
|
|
echo "skip=false" >> "$GITHUB_OUTPUT"
|
|
- name: Resolve immutable image and update manifests
|
|
if: steps.release.outputs.changed == 'true' && steps.branch.outputs.skip == 'false'
|
|
env:
|
|
TAG: ${{ steps.release.outputs.tag }}
|
|
PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
|
|
RELEASE_URL: ${{ steps.release.outputs.release_url }}
|
|
DIGEST: ${{ steps.release.outputs.digest }}
|
|
run: |
|
|
ruby scripts/record_upstream_candidate.rb "$TAG" "$PUBLISHED_AT" "$RELEASE_URL" "$DIGEST"
|
|
ruby test/repository_test.rb
|
|
ruby test/watcher_test.rb
|
|
- name: Open compatibility PR
|
|
if: steps.release.outputs.changed == 'true' && steps.branch.outputs.skip == 'false'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ steps.release.outputs.tag }}
|
|
DIGEST: ${{ steps.release.outputs.digest }}
|
|
BRANCH: ${{ steps.branch.outputs.branch }}
|
|
SAME_TAG_DIGEST_CHANGED: ${{ steps.release.outputs.same_tag_digest_changed }}
|
|
run: |
|
|
git config user.name "opencode-compat-bot"
|
|
git config user.email "opencode-compat-bot@users.noreply.github.com"
|
|
short_digest="${DIGEST#sha256:}"
|
|
short_digest="${short_digest:0:12}"
|
|
git switch -c "$BRANCH"
|
|
git add manifests/image-matrix.json manifests/upstream.json
|
|
git commit -m "Test OpenCode ${TAG} compatibility (${short_digest})"
|
|
git push --set-upstream origin "$BRANCH"
|
|
title="Test OpenCode ${TAG} compatibility (${short_digest})"
|
|
notice="Upstream watcher resolved ${TAG} to immutable OCI digest ${DIGEST}."
|
|
if [ "$SAME_TAG_DIGEST_CHANGED" = "true" ]; then
|
|
title="Review changed OCI digest for existing OpenCode ${TAG} (${short_digest})"
|
|
notice="Security-sensitive change: existing release ${TAG} now resolves to a different OCI digest, ${DIGEST}."
|
|
fi
|
|
gh pr create \
|
|
--base main \
|
|
--head "$BRANCH" \
|
|
--title "$title" \
|
|
--body "${notice} The watcher added it as a pending compatibility target. This PR only runs certification checks; promotion and consumer rollout remain manual."
|