tools-update #641
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: tools-update | |
| on: | |
| schedule: | |
| - cron: "0 */6 * * *" | |
| workflow_dispatch: | |
| inputs: | |
| tool: | |
| description: "Tool to update (blank = all)" | |
| required: false | |
| type: choice | |
| options: | |
| - "" | |
| - delve | |
| - gofumpt | |
| - golangci-lint | |
| - gopls | |
| - govulncheck | |
| - staticcheck | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| setup: | |
| runs-on: ubuntu-24.04 | |
| name: setup | |
| outputs: | |
| matrix: ${{ steps.matrix.outputs.tools }} | |
| steps: | |
| - name: Build tool matrix | |
| id: matrix | |
| run: | | |
| tools='[ | |
| { "name": "delve", "module": "github.com/go-delve/delve", "sub-packages": "cmd/dlv" }, | |
| { "name": "gofumpt", "module": "mvdan.cc/gofumpt", "sub-packages": "." }, | |
| { "name": "golangci-lint", "module": "github.com/golangci/golangci-lint/v2", "sub-packages": "cmd/golangci-lint" }, | |
| { "name": "gopls", "module": "golang.org/x/tools/gopls", "sub-packages": "." }, | |
| { "name": "govulncheck", "module": "golang.org/x/vuln", "sub-packages": "cmd/govulncheck" }, | |
| { "name": "staticcheck", "module": "honnef.co/go/tools", "sub-packages": "cmd/staticcheck" } | |
| ]' | |
| if [ -n "${{ inputs.tool }}" ]; then | |
| tools=$(echo "$tools" | jq -c --arg name "${{ inputs.tool }}" '[.[] | select(.name == $name)]') | |
| fi | |
| echo "tools=$(echo "$tools" | jq -c)" >> "$GITHUB_OUTPUT" | |
| update: | |
| needs: setup | |
| runs-on: ubuntu-24.04 | |
| name: update / ${{ matrix.tool.name }} | |
| strategy: | |
| matrix: | |
| tool: ${{ fromJSON(needs.setup.outputs.matrix) }} | |
| fail-fast: false | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| token: ${{ secrets.GH_NSV }} | |
| - name: Setup Nix | |
| uses: ./.github/actions/setup-nix | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| cachix-token: ${{ secrets.GH_CACHIX }} | |
| - name: Detect Latest Version | |
| id: detect | |
| run: | | |
| version=$(nix run .#goscrape -- mod-proxy detect ${{ matrix.tool.module }} --include-prerelease) | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| - name: Check and Generate Manifest | |
| id: generate | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GH_NSV }} | |
| run: | | |
| version="${{ steps.detect.outputs.version }}" | |
| name="${{ matrix.tool.name }}" | |
| manifest="manifests/${name}/${version#v}.nix" | |
| branch="nix-tool-${name}-${version#v}" | |
| if [ -f "$manifest" ]; then | |
| echo "Manifest already exists for ${name} ${version}" | |
| exit 0 | |
| fi | |
| if gh pr list --head "$branch" --state open --json number --jq 'length' | grep -q '[1-9]'; then | |
| echo "PR already exists for ${name} ${version}" | |
| exit 0 | |
| fi | |
| nix run .#goscrape -- mod-proxy generate ${{ matrix.tool.module }} \ | |
| --sub-packages ${{ matrix.tool.sub-packages }} \ | |
| --versions "${version}" \ | |
| --output "manifests/${name}" | |
| echo "generated=true" >> "$GITHUB_OUTPUT" | |
| echo "version=${version}" >> "$GITHUB_OUTPUT" | |
| echo "manifest=${manifest}" >> "$GITHUB_OUTPUT" | |
| echo "branch=${branch}" >> "$GITHUB_OUTPUT" | |
| - name: GPG Import | |
| if: steps.generate.outputs.generated == 'true' | |
| uses: purpleclay/gpg-import-action@a39506c3eff9b02459e033e3551e556934f266fc # v0 | |
| with: | |
| key: ${{ secrets.GPG_PRIVATE_KEY }} | |
| passphrase: ${{ secrets.GPG_PASSPHRASE }} | |
| - name: Create PR | |
| if: steps.generate.outputs.generated == 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GH_NSV }} | |
| run: | | |
| name="${{ matrix.tool.name }}" | |
| version="${{ steps.generate.outputs.version }}" | |
| manifest="${{ steps.generate.outputs.manifest }}" | |
| branch="${{ steps.generate.outputs.branch }}" | |
| git checkout -b "$branch" | |
| git add "$manifest" "manifests/${name}/index.nix" | |
| git commit -s -m "chore(tool): generated nix manifest for ${name} ${version#v}" | |
| git push -u origin "$branch" | |
| gh pr create \ | |
| --title "chore(tool): add ${name} ${version#v} manifest" \ | |
| --body "Auto-generated nix manifest for ${name} ${version}." \ | |
| --base main \ | |
| --head "$branch" | |
| # enablePullRequestAutoMerge only succeeds while something is still | |
| # pending; if checks already completed by this point, the PR is | |
| # already mergeable and --auto is rejected, so merge directly. | |
| if ! gh pr merge --auto --squash "$branch"; then | |
| gh pr merge --squash "$branch" | |
| fi |