sample-autonomous-cloud-coding-agents/.github/workflows/upgrade-main.yml at main · AshrafBen10/sample-autonomous-cloud-coding-agents · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: upgrade-main
# Scheduled dependency upgrade on main: `mise run upgrade` refreshes the Yarn
# workspaces and the agent uv lockfile WITHIN declared ranges/pins (exact pins
# — including the Cedar parity pair — are never rewritten; see mise.toml).
# Changes are shipped as a PR labeled 'auto-approve' so the auto-approve
# workflow approves it once the build workflow passes.
on:
  workflow_dispatch: {}
  schedule:
    - cron: 0 0 * * *
permissions:
  actions: none
  attestations: none
  checks: none
  contents: none
  deployments: none
  discussions: none
  id-token: none
  issues: none
  models: none
  packages: none
  pages: none
  pull-requests: none
  repository-projects: none
  security-events: none
  statuses: none
jobs:
  upgrade:
    name: Upgrade
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: github.repository == 'aws-samples/sample-autonomous-cloud-coding-agents'
    outputs:
      patch_created: ${{ steps.create_patch.outputs.patch_created }}
    env:
      MISE_EXPERIMENTAL: "1"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      AQUA_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: main
          persist-credentials: false

      - name: Install mise
        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
        with:
          cache: true

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22.x

      - name: Install dependencies
        run: mise run install

      - name: Upgrade dependencies
        run: mise run upgrade

      - name: Find mutations
        id: create_patch
        shell: bash
        run: |
          git add .
          git diff --staged --patch --exit-code > repo.patch || echo "patch_created=true" >> "$GITHUB_OUTPUT"

      - name: Upload patch
        if: steps.create_patch.outputs.patch_created
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: repo.patch
          path: repo.patch
          overwrite: true

  pr:
    name: Create Pull Request
    needs: upgrade
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: ${{ needs.upgrade.outputs.patch_created }}
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: main
          persist-credentials: false

      - name: Download patch
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: repo.patch
          path: ${{ runner.temp }}

      - name: Apply patch
        run: '[ -s ${{ runner.temp }}/repo.patch ] && git apply ${{ runner.temp }}/repo.patch || echo "Empty patch. Skipping."'

      - name: Set git identity
        run: |-
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Create Pull Request
        id: create-pr
        # AUTOMATION_GITHUB_TOKEN is a PAT (contents + pull-requests write):
        # PRs created with the default GITHUB_TOKEN do not trigger the build
        # workflow, which branch protection requires before auto-approve merges.
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ secrets.AUTOMATION_GITHUB_TOKEN }}
          commit-message: |-
            chore(deps): upgrade dependencies

            Upgrades project dependencies. See details in [workflow run].

            [Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

            ------

            *Automatically created by the "upgrade-main" workflow*
          branch: github-actions/upgrade-main
          title: "chore(deps): upgrade dependencies"
          body: |-
            Upgrades project dependencies. See details in [workflow run].

            [Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

            ------

            *Automatically created by the "upgrade-main" workflow*
          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
          committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
          signoff: true
          labels: auto-approve