From 9d5bc3429c5a88fedc0821df0023dfa5268c9185 Mon Sep 17 00:00:00 2001 From: Caspar van Leeuwen Date: Wed, 12 Aug 2026 11:33:21 +0200 Subject: [PATCH] As a frist step towards the new workflow in https://github.com/EESSI/software-layer/pull/1353 , let's put a bot/software_layer_scripts_commit file in place and a GH action to update it automatically. This file is, for now, unused, but it allows us to already test the auto-updating --- .../update_software_layer_scripts_commit.yml | 104 ++++++++++++++++++ bot/software_layer_scripts_commit | 1 + 2 files changed, 105 insertions(+) create mode 100644 .github/workflows/update_software_layer_scripts_commit.yml create mode 100644 bot/software_layer_scripts_commit diff --git a/.github/workflows/update_software_layer_scripts_commit.yml b/.github/workflows/update_software_layer_scripts_commit.yml new file mode 100644 index 0000000000..16ba4f418d --- /dev/null +++ b/.github/workflows/update_software_layer_scripts_commit.yml @@ -0,0 +1,104 @@ +# documentation: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions +# +# Keeps bot/software_layer_scripts_commit in software-layer/main in sync with the latest +# commit on main of EESSI/software-layer-scripts. +# +# Triggers: +# - schedule (hourly): safety net; needs no credentials beyond the ephemeral GITHUB_TOKEN. +# - workflow_dispatch: manual runs, and remote triggering from EESSI/software-layer-scripts +# (see EESSI/.github/workflows/dispatch_software_layer_update.yml) via the workflow_dispatch API, +# using a fine-grained PAT with only "Actions: read & write" on this repo. +# +# Behavior: +# - Only acts when the stored SHA differs from the latest commit on software-layer-scripts main. +# - Recreates branch 'gh_action_update_software_layer_commit_sha' from software-layer's latest main and force-pushes it, +# so the PR never accumulates merge conflicts and the existing PR (if any) is updated in place. +# The force push is safe: the branch is bot-owned and fully regenerated on every run. +# - A PR is created only if none exists for the branch; on later updates a comment posts the new SHA. +# +# Permissions: +# - contents: write -> push to gh_action_update_software_layer_commit_sha +# - pull-requests: write -> create PR / comment on it +# main is branch-protected, so this token cannot touch main. +# +# Caveat: the pinned SHA is the raw tip of software-layer-scripts main. The check in +# test_software_layer_scripts.yml additionally requires the commit to be web-flow signed; +# if someone ever pushes directly to software-layer-scripts main (not via PR), the bot PR +# may fail that check until the next PR merge arrives. That should never happen because that branch +# is protected though. +name: Update bot/software_layer_scripts_commit +on: + schedule: + - cron: '0 * * * *' # hourly safety net + workflow_dispatch: {} # manual, or via API from software-layer-scripts +permissions: + contents: write # Needs to create a feature branch and push to it + pull-requests: write # Needs to create a PR, add comments on updates, etc +concurrency: # Prevent simultaneous runs from cron and workflow_dispatch + group: update-software-layer-scripts-commit + cancel-in-progress: true # Older run is cancelled, makes sure we get the most up-to-date SHA +jobs: + update: + runs-on: ubuntu-24.04 + steps: + - name: Check out software-layer (shallow) + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + + - name: Get latest commit on main of EESSI/software-layer-scripts + id: latest + env: + GH_TOKEN: ${{ github.token }} + run: | + SHA=$(gh api repos/EESSI/software-layer-scripts/commits/main --jq .sha) + echo "sha=$SHA" >> "$GITHUB_OUTPUT" + + - name: Compare with stored SHA + id: cmp + run: | + STORED=$(tr -d '[:space:]' < bot/software_layer_scripts_commit) + if [[ "$STORED" == "${{ steps.latest.outputs.sha }}" ]]; then + echo "changed=false" >> "$GITHUB_OUTPUT" + echo "Already up to date: $STORED" + else + echo "changed=true" >> "$GITHUB_OUTPUT" + echo "Stored: $STORED" + echo "Latest: ${{ steps.latest.outputs.sha }}" + fi + + - name: Update file and force-push gh_action_update_software_layer_commit_sha + if: steps.cmp.outputs.changed == 'true' + run: | + git checkout -B gh_action_update_software_layer_commit_sha origin/main + printf '%s\n' "${{ steps.latest.outputs.sha }}" > bot/software_layer_scripts_commit + git -c user.name='github-actions[bot]' \ + -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \ + commit -am "Update bot/software_layer_scripts_commit to ${{ steps.latest.outputs.sha }}" + git push --force origin gh_action_update_software_layer_commit_sha + + - name: Create PR, or comment with the new SHA + if: steps.cmp.outputs.changed == 'true' + env: + GH_TOKEN: ${{ github.token }} + PR_BODY: | + This PR is auto-generated by the + [`update_software_layer_scripts_commit` workflow](https://github.com/EESSI/software-layer/actions/workflows/update_software_layer_scripts_commit.yml) + ([workflow source](https://github.com/EESSI/software-layer/blob/main/.github/workflows/update_software_layer_scripts_commit.yml)). + + It pins `bot/software_layer_scripts_commit` to `${{ steps.latest.outputs.sha }}`, + the current tip of [`EESSI/software-layer-scripts`](https://github.com/EESSI/software-layer-scripts) `main`. + + If `bot/software_layer_scripts_commit` in this PR looks outdated, **DO NOT push updates to this branch manually**. + The bot keeps it up to date automatically; you can also rerun the workflow manually from + [the workflow page](https://github.com/EESSI/software-layer/actions/workflows/update_software_layer_scripts_commit.yml). + run: | + NEW_SHA="${{ steps.latest.outputs.sha }}" + PR_URL=$(gh pr list --head gh_action_update_software_layer_commit_sha --state open --json url --jq '.[0].url') + if [[ -n "$PR_URL" ]]; then + echo "PR already exists: $PR_URL" + gh pr comment "$PR_URL" --body \ + "Updated \`bot/software_layer_scripts_commit\` to \`$NEW_SHA\` (commit \`$(git rev-parse HEAD)\`)." + else + gh pr create --base main --head gh_action_update_software_layer_commit_sha \ + --title "Update bot/software_layer_scripts_commit" \ + --body "$PR_BODY" + fi diff --git a/bot/software_layer_scripts_commit b/bot/software_layer_scripts_commit new file mode 100644 index 0000000000..f81bd2b100 --- /dev/null +++ b/bot/software_layer_scripts_commit @@ -0,0 +1 @@ +89e670f2336a610827ef899ecad520af78b0a848