core-drift.yml

# SPDX-License-Identifier: Apache-2.0

# Nightly comparison of core main with the pinned core tag; keeps the single
# "Core main drift" issue current (mise run core:drift).
name: core-drift

on:
  schedule:
    - cron: "41 4 * * *"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: core-drift
  cancel-in-progress: false

jobs:
  drift:
    name: drift
    # The bot secrets live in the sdk-bot environment, which only main can
    # deploy to, so a pushed branch can't mint a bot token.
    environment: sdk-bot
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - id: app-token
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ secrets.SDK_BOT_CLIENT_ID }}
          private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}
          permission-issues: write

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6

      # Exit 1 with a report means drift; the issue records it. No report
      # means the check itself broke, which the failure step records.
      - name: Check drift against core main
        run: |
          mise run core:drift -- --out drift-report.md || true
          test -s drift-report.md
          cat drift-report.md >>"$GITHUB_STEP_SUMMARY"

      - name: Update the drift issue
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: mise run core:drift-issue -- drift-report.md

      - name: Report failure
        if: failure()
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: mise run core:report-failure -- core-drift "$RUN_URL"