zigpy-ota/.github/workflows/update-dev-version-pointer.yml at dev · zigpy/zigpy-ota · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: Update dev channel version pointer

on:
  workflow_dispatch:
  push:
    branches:
      - dev
    paths:
      - ".github/SCHEMA.json"

# Default to no permissions; each job declares exactly what it needs
permissions: {}

concurrency:
  group: push-release-version
  cancel-in-progress: false

env:
  DEV_BASE_URL: https://raw.githubusercontent.com/zigpy/zigpy-ota/release/files/dev

jobs:
  update-dev-version-pointer:
    name: Update dev.json on release/version branch
    permissions: {}
    runs-on: ubuntu-slim
    timeout-minutes: 5
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          # Downscope the token to just what this workflow needs (without
          # permission-* inputs, it would carry all installation permissions)
          permission-contents: write

      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Load schema config
        run: |
          set -euo pipefail
          # Assign first so a jq failure fails the step (a process
          # substitution's exit status is invisible to set -e)
          keys=$(jq -r 'keys[]' .github/SCHEMA.json)
          if [ -z "$keys" ]; then
            echo "::error::SCHEMA.json has no keys"
            exit 1
          fi
          while IFS= read -r key; do
            value=$(jq -r --arg k "$key" '.[$k]' .github/SCHEMA.json)
            # A key outside [A-Za-z0-9_] or a multi-line value would define
            # arbitrary extra variables (e.g. PATH) for later steps
            # (while-read keeps a key with spaces intact so the guard catches it)
            if [[ ! "$key" =~ ^[A-Za-z0-9_]+$ ]] || [[ "$value" == *$'\n'* ]]; then
              echo "::error::Invalid SCHEMA.json entry for key '$key'"
              exit 1
            fi
            echo "SCHEMA_${key^^}=$value" >> "$GITHUB_ENV"
          done <<<"$keys"

      # Commits keep the zigpy-bot user identity for now; pushes authenticate
      # with the GitHub App installation token (the checkout credentials)
      - name: Configure git
        run: |
          set -euo pipefail
          git config --global user.name "zigpy-bot"
          git config --global user.email "247691930+zigpy-bot@users.noreply.github.com"

      - name: Update dev.json on release/version
        run: |
          set -euo pipefail
          # Construct dev channel URLs from schema filenames
          ZIGPY_URL="${DEV_BASE_URL}/${SCHEMA_ZIGPY_FILENAME}"
          Z2M_URL="${DEV_BASE_URL}/${SCHEMA_Z2M_FILENAME}"
          MARKDOWN_URL="${DEV_BASE_URL}/${SCHEMA_MARKDOWN_FILENAME}"

          # Switch to the release/version branch. It must already exist: it is created
          # once per repository as an orphan branch, never derived from the code tree
          # (e.g. git switch --orphan release/version && git commit --allow-empty -m "Init")
          if ! git ls-remote --exit-code --heads origin release/version > /dev/null 2>&1; then
            echo "::error::Branch release/version not found (or the remote could not be reached). It must be created manually, once, as an orphan branch."
            exit 1
          fi
          git fetch origin release/version:release/version
          git checkout release/version

          # Update dev.json (preserve existing schema keys, e.g. zigpy_v1 when adding zigpy_v2)
          if [ -f dev.json ]; then
            jq --arg zigpy_key "$SCHEMA_ZIGPY_SCHEMA_KEY" \
               --arg z2m_key "$SCHEMA_Z2M_SCHEMA_KEY" \
               --arg md_key "$SCHEMA_MARKDOWN_SCHEMA_KEY" \
               --arg zigpy_url "$ZIGPY_URL" \
               --arg z2m_url "$Z2M_URL" \
               --arg md_url "$MARKDOWN_URL" \
               '.schemas[$zigpy_key] = {version: "dev", url: $zigpy_url} | .schemas[$z2m_key] = {version: "dev", url: $z2m_url} | .schemas[$md_key] = {version: "dev", url: $md_url}' \
               dev.json > /tmp/dev.json
            mv /tmp/dev.json dev.json
          else
            jq -n \
              --arg zigpy_key "$SCHEMA_ZIGPY_SCHEMA_KEY" \
              --arg z2m_key "$SCHEMA_Z2M_SCHEMA_KEY" \
              --arg md_key "$SCHEMA_MARKDOWN_SCHEMA_KEY" \
              --arg zigpy_url "$ZIGPY_URL" \
              --arg z2m_url "$Z2M_URL" \
              --arg md_url "$MARKDOWN_URL" \
              '{schemas: {($zigpy_key): {version: "dev", url: $zigpy_url}, ($z2m_key): {version: "dev", url: $z2m_url}, ($md_key): {version: "dev", url: $md_url}}}' \
              > dev.json
          fi

          # Commit and push if changed. Retry once after a rebase: the version
          # pointer workflows push to this branch from a different concurrency group.
          git add dev.json
          git diff --staged --quiet || git commit -m "Update \`dev\` version pointer"
          git push origin release/version || {
            git pull --rebase origin release/version
            git push origin release/version
          }