core-watch.yml

# SPDX-License-Identifier: Apache-2.0

# Opens one update proposal per new core release tag
# (mise run core:bump).
name: core-watch

on:
  schedule:
    - cron: "17 * * * *"
  workflow_dispatch:
    inputs:
      tag:
        description: Core tag to propose (vX.Y.Z or vX.Y.Z-pre.N); empty proposes every new tag
        required: false
        default: ""

permissions:
  contents: read

concurrency:
  group: core-watch
  cancel-in-progress: false

jobs:
  watch:
    name: watch
    # The bot secrets live in the sdk-bot environment, which only main can
    # deploy to, so a pushed branch can't mint a bot token.
    environment: sdk-bot
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - id: app-token
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ secrets.SDK_BOT_CLIENT_ID }}
          private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write
          permission-issues: write

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}
          persist-credentials: true

      - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6

      - name: Set the bot identity
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        run: |
          set -euo pipefail
          id=$(gh api "users/${APP_SLUG}[bot]" --jq .id)
          git config user.name "${APP_SLUG}[bot]"
          git config user.email "${id}+${APP_SLUG}[bot]@users.noreply.github.com"

      - name: Propose new core tags
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          if [ -n "$INPUT_TAG" ]; then
            tags=$INPUT_TAG
          else
            tags=$(mise run --quiet core:tags)
          fi
          if [ -z "$tags" ]; then
            echo "No core tags newer than $(mise run --quiet core:version)."
            exit 0
          fi
          for t in $tags; do
            mise run core:bump -- "$t"
          done

      - name: Report failure
        if: failure()
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: mise run core:report-failure -- core-watch "$RUN_URL"