reusable-update-npm.yaml

# Reusable workflow for updating vendored NPM packages.
# Caller workflows only need to define schedule/dispatch triggers,
# the three package identifiers, and a custom extract script.
#
# To add a new package, create a thin caller workflow — see any update-*.yaml for an example.

name: Reusable NPM Update

permissions:
  contents: write
  issues: write
  pull-requests: write

on:
  workflow_call:
    inputs:
      npm_package:
        description: 'NPM package name (e.g. exceljs, @ruffle-rs/ruffle)'
        required: true
        type: string
      target_dir:
        description: 'Target directory in the repo to vendor files into'
        required: true
        type: string
      branch_name:
        description: 'Branch name for the auto-update PR (e.g. auto-update/exceljs)'
        required: true
        type: string
      extract_script:
        description: 'Shell script to extract/copy files from $PKG_DIR into $TARGET_DIR'
        required: true
        type: string

jobs:
  update:
    runs-on: ubuntu-latest
    env:
      NPM_PACKAGE: ${{ inputs.npm_package }}
      TARGET_DIR: ${{ inputs.target_dir }}
      BRANCH_NAME: ${{ inputs.branch_name }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'

      - name: Fetch latest version
        id: fetch
        run: |
          LATEST=$(npm view "$NPM_PACKAGE" version 2>/dev/null)
          echo "version=$LATEST" >> "$GITHUB_OUTPUT"
          echo "Latest $NPM_PACKAGE version: $LATEST"

      - name: Download and extract package
        run: |
          set -euo pipefail
          TMP=$(mktemp -d)
          cd "$TMP"
          npm pack "$NPM_PACKAGE" > /dev/null 2>&1
          mkdir -p extracted
          tar -xzf *.tgz -C extracted
          cd -
          echo "PKG_DIR=$TMP/extracted/package" >> "$GITHUB_ENV"

      - name: Extract files
        run: |
          set -euo pipefail
          ${{ inputs.extract_script }}

      - name: Check for changes
        id: changes
        run: |
          if [[ -n $(git status --porcelain) ]]; then
            echo "has_changes=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
            echo "No changes detected."
          fi

      - name: Remove index.html for GenerateDirectoryTree regeneration
        if: steps.changes.outputs.has_changes == 'true'
        run: |
          find "$TARGET_DIR" -name 'index.html' -exec rm -f {} + 2>/dev/null || true

      - name: Import GPG key
        if: steps.changes.outputs.has_changes == 'true'
        uses: crazy-max/ghaction-import-gpg@v7
        with:
          gpg_private_key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.BOT_GPG_PASSPHRASE }}
          git_config_global: true
          git_user_signingkey: true
          git_commit_gpgsign: true

      - name: Setup CI Bot
        if: steps.changes.outputs.has_changes == 'true'
        run: |
          git config --global user.name "${{ secrets.BOT_USERNAME }}"
          git config --global user.email "${{ secrets.BOT_USEREMAIL }}"

      - name: Create Pull Request
        if: steps.changes.outputs.has_changes == 'true'
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.BOT_TOKEN }}
          commit-message: 'chore: update ${{ inputs.npm_package }} to ${{ steps.fetch.outputs.version }}'
          author: '${{ secrets.BOT_USERNAME }} <${{ secrets.BOT_USEREMAIL }}>'
          committer: '${{ secrets.BOT_USERNAME }} <${{ secrets.BOT_USEREMAIL }}>'
          branch: ${{ inputs.branch_name }}
          delete-branch: true
          title: 'chore: update `${{ inputs.npm_package }}` to ${{ steps.fetch.outputs.version }}'
          body: |
            ## Automated Update

            | Package | Version | Directory |
            |---------|---------|-----------|
            | `${{ inputs.npm_package }}` | `${{ steps.fetch.outputs.version }}` | `${{ inputs.target_dir }}/` |

            ---
            _Auto-generated by updating **`${{ inputs.npm_package }}`**. Please review before merging._
          labels: |
            automated
            dependencies