weekly-update.yml

name: 🔁 Weekly update
run-name: Weekly update

# The runner applies dependency updates, installs, and fixes before PR creation.
# The PR App push starts downstream CI, which runs the required tests.

on:
  schedule:
    # Monday 09:00 UTC — the full weekly update.
    - cron: '0 9 * * 1'
    # Daily 08:00 UTC — soaked-exclusion promotion via the same runner.
    - cron: '0 8 * * *'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: weekly-update
  cancel-in-progress: false

jobs:
  check-updates:
    name: Check for updates
    runs-on: ubuntu-latest
    timeout-minutes: 10
    outputs:
      actionable: ${{ steps.gate.outputs.actionable }}
    steps:
      - name: Bootstrap checkout
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TRIGGER_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          git init -q
          git config --local advice.detachedHead false
          git remote remove origin 2>/dev/null || true
          git remote add origin "${SERVER_URL}/${REPOSITORY}"
          FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")
          if [ -n "${GITHUB_TOKEN}" ]; then
            AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
            git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"
          else
            git fetch "${FETCH_ARGS[@]}"
          fi
          git checkout -q --detach FETCH_HEAD

      - name: 'Set up and install'
        uses: ./.github/actions/fleet/setup-and-install
        with:
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
          # Reuse the PR App for a contents:read token scoped to wheelhouse.
          # Both credentials enable the private release fallback. Without the
          # key, hydration still pulls public GHCR anonymously.
          payload-token-client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}

      # The runner script IS the gate: exit 0 = actionable drift, 1 = no-op.
      - name: Run the check-updates gate
        id: gate
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          ACTIONABLE='true'
          node scripts/fleet/weekly-update.mts --check-updates || ACTIONABLE='false'
          # Report inline-action port drift (does not gate the update; a
          # behind port is reported for the weekly output).
          node scripts/fleet/sync-inline-action-pins.mts || true
          echo "actionable=${ACTIONABLE}" >> "$GITHUB_OUTPUT"

  update:
    name: Update dependencies
    needs: check-updates
    if: ${{ needs.check-updates.outputs.actionable == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
    steps:
      - name: Bootstrap checkout
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TRIGGER_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          git init -q
          git config --local advice.detachedHead false
          git remote remove origin 2>/dev/null || true
          git remote add origin "${SERVER_URL}/${REPOSITORY}"
          FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")
          if [ -n "${GITHUB_TOKEN}" ]; then
            AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
            git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"
          else
            git fetch "${FETCH_ARGS[@]}"
          fi
          git checkout -q --detach FETCH_HEAD

      - name: 'Set up and install'
        uses: ./.github/actions/fleet/setup-and-install
        with:
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
          # Reuse the PR App for a contents:read token scoped to wheelhouse.
          # Both credentials enable the private release fallback. Without the
          # key, hydration still pulls public GHCR anonymously.
          payload-token-client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}

      # Provision the on-device model (fail-open: ready=false just means the
      # decision leg clean-skips and the run stays deterministic-only).
      - name: 'Set up odai'
        uses: ./.github/actions/fleet/setup-odai
        with:
          allow-fill: 'false'
        id: odai

      - name: Run the weekly update
        shell: bash
        env:
          # Env-var indirection: expanding the expression inside `run:` is the
          # template-injection shape zizmor blocks.
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITHUB_TOKEN: ${{ github.token }}
          ODAI_READY: ${{ steps.odai.outputs.ready }}
          SERVER_URL: ${{ github.server_url }}
        run: |
          set -euo pipefail
          echo "on-device model ready: ${ODAI_READY}"
          AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
          git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch --quiet origin "${DEFAULT_BRANCH}"
          if git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" ls-remote --exit-code --heads origin refs/heads/weekly-update >/dev/null; then
            git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch --quiet origin +refs/heads/weekly-update:refs/remotes/origin/weekly-update
          else
            FETCH_STATUS=$?
            if [ "${FETCH_STATUS}" != 2 ]; then exit "${FETCH_STATUS}"; fi
          fi
          git checkout -B weekly-update "origin/${DEFAULT_BRANCH}"
          git config --local user.name 'socket-release-app[bot]'
          git config --local user.email 'socket-release-app[bot]@users.noreply.github.com'
          node scripts/fleet/weekly-update.mts

      - name: 'Mint PR token'
        id: pr-app
        uses: ./.github/actions/fleet/github-pr-app-token
        with:
          client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }}
          private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}
          repositories: ${{ github.event.repository.name }}

      - name: Commit update fixes
        shell: bash
        env:
          GH_TOKEN: ${{ steps.pr-app.outputs.token }}
          BASE: ${{ github.event.repository.default_branch }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail
          if [ "$(git branch --show-current)" != weekly-update ]; then
            echo "Refusing to commit outside the weekly-update branch." >&2
            exit 1
          fi
          git add --all
          node scripts/fleet/github/commit.mts \
            --parent "origin/${BASE}" --branch weekly-update --repo "${REPOSITORY}" \
            --message 'chore(deps): apply weekly update fixes'

      - name: Ensure dependency labels
        shell: bash
        env:
          GH_TOKEN: ${{ steps.pr-app.outputs.token }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail
          LABELS="$(gh api --paginate "repos/${REPOSITORY}/labels?per_page=100" --jq '.[].name')"
          if ! printf '%s\n' "$LABELS" | grep -Fxi dependencies >/dev/null; then
            gh label create dependencies --repo "$REPOSITORY" \
              --color 0366d6 --description 'Dependency updates'
          fi
          if ! printf '%s\n' "$LABELS" | grep -Fxi automation >/dev/null; then
            gh label create automation --repo "$REPOSITORY" \
              --color 1d76db --description 'Automated maintenance'
          fi

      - name: Push the branch and open or refresh the PR
        shell: bash
        env:
          GH_TOKEN: ${{ steps.pr-app.outputs.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          BASE: ${{ github.event.repository.default_branch }}
        run: |
          set -euo pipefail
          BRANCH=weekly-update
          DATE="$(date -u +%Y-%m-%d)"
          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

          # Nothing to say: the branch is identical to base, so there is no
          # update to offer. Close any stale PR rather than leaving an empty one.
          if git diff --quiet "origin/${BASE}..HEAD"; then
            echo "no diff against ${BASE} — nothing to update."
            gh pr close "${BRANCH}" --repo "${REPOSITORY}" --delete-branch 2>/dev/null \
              && echo "closed the now-empty PR." || true
            exit 0
          fi

          # Force-with-lease: the branch is ours and is rebuilt from base each
          # run, so a non-fast-forward push is EXPECTED. --force-with-lease
          # still refuses if someone else pushed to it since our fetch.
          AUTH_B64="$(printf 'x-access-token:%s' "${GH_TOKEN}" | base64 | tr -d '\n')"
          git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" \
            push --force-with-lease origin "HEAD:refs/heads/${BRANCH}"

          # Compose the body with the pure helper — never markdown surgery in
          # bash. It folds this run into a dated <details>, newest first, and
          # replaces any block already carrying today's date so a same-day
          # re-run stays idempotent.
          #
          # The fold's payload is the DEPENDENCY DELTA. Commit subjects alone
          # say nothing here: a dependency run squashes to one "chore(deps):
          # update dependencies", so a reviewer opening the fold needs the table
          # of what actually moved.
          #
          # pnpm-workspace.yaml is the file that matters. The fleet pins exact
          # versions and routes most of them through pnpm's catalog protocol,
          # so package.json reads `catalog:` on BOTH sides while the version it
          # resolves to moves in the catalog. Diffing the manifest alone would
          # render an empty table for exactly the updates this PR exists for.
          git show "origin/${BASE}:package.json" > /tmp/pkg-before.json 2>/dev/null || : > /tmp/pkg-before.json
          git show "HEAD:package.json" > /tmp/pkg-after.json 2>/dev/null || : > /tmp/pkg-after.json
          git show "origin/${BASE}:pnpm-workspace.yaml" > /tmp/ws-before.yaml 2>/dev/null || : > /tmp/ws-before.yaml
          git show "HEAD:pnpm-workspace.yaml" > /tmp/ws-after.yaml 2>/dev/null || : > /tmp/ws-after.yaml

          mapfile -t LINES < <(git log --format="- %s" "origin/${BASE}..HEAD" | head -50)
          LINE_ARGS=()
          for l in "${LINES[@]}"; do LINE_ARGS+=(--line "$l"); done

          BODY_ARGS=(
            --base "${BASE}" --date "${DATE}" --run-url "${RUN_URL}"
            --before-pkg /tmp/pkg-before.json --after-pkg /tmp/pkg-after.json
            --before-workspace /tmp/ws-before.yaml
            --after-workspace /tmp/ws-after.yaml
          )

          NUMBER="$(gh pr list --repo "${REPOSITORY}" --head "${BRANCH}" --state open --json number --jq ".[0].number // empty")"
          if [ -z "${NUMBER}" ]; then
            printf "" | node scripts/fleet/weekly-update/pr-body-cli.mts \
              "${BODY_ARGS[@]}" "${LINE_ARGS[@]}" > /tmp/pr-body.md
            gh pr create \
              --repo "${REPOSITORY}" \
              --head "${BRANCH}" \
              --base "${BASE}" \
              --title "chore(deps): rolling dependency update" \
              --body-file /tmp/pr-body.md \
              --label dependencies --label automation
            NUMBER="$(gh pr list --repo "${REPOSITORY}" --head "${BRANCH}" --state open --json number --jq ".[0].number // empty")"
          else
            gh pr view "${NUMBER}" --repo "${REPOSITORY}" --json body --jq .body \
              | node scripts/fleet/weekly-update/pr-body-cli.mts \
                  "${BODY_ARGS[@]}" "${LINE_ARGS[@]}" > /tmp/pr-body.md
            gh pr edit "${NUMBER}" --repo "${REPOSITORY}" --body-file /tmp/pr-body.md
            echo "refreshed PR #${NUMBER} with the ${DATE} entry."
          fi

          # Adopt the pre-rolling PRs. Switching to one branch does not
          # retroactively claim the PRs opened before the switch: they sit on
          # per-run branches, some named by an agent rather than a format
          # string, so --head cannot find them and they would simply pile up.
          # Identity is the label pair this workflow applies plus a bot author,
          # so a human's dependency PR is never touched.
          gh pr list --repo "${REPOSITORY}" --state open \
            --json number,headRefName,labels,author \
            | node scripts/fleet/weekly-update/superseded-cli.mts --branch "${BRANCH}" \
            | while read -r OLD; do
                [ -n "${OLD}" ] || continue
                [ "${OLD}" = "${NUMBER}" ] && continue
                gh pr close "${OLD}" --repo "${REPOSITORY}" --delete-branch \
                  --comment "Superseded by #${NUMBER}, the rolling dependency PR. Updates now land on one long-lived \`${BRANCH}\` branch, rebuilt from \`${BASE}\` each run, with every run recorded as a dated fold in that PR body." \
                  && echo "closed superseded PR #${OLD}." || true
              done