poetry-lock-command.yml

name: On-Demand Poetry Lock

on:
  workflow_dispatch:
    inputs:
      pr:
        description: "PR Number"
        type: string
        required: true
      comment-id:
        description: "Comment ID (Optional)"
        type: string
        required: false

jobs:
  poetry-lock-on-demand:
    name: On-Demand Poetry Lock
    strategy:
      matrix:
        python-version: ["3.10"]
        os: [Ubuntu]
      fail-fast: false

    runs-on: "${{ matrix.os }}-latest"
    steps:
      # Custom steps to fetch the PR and checkout the code:
      - name: Authenticate as GitHub App
        uses: actions/create-github-app-token@v2
        id: get-app-token
        with:
          owner: "airbytehq"
          repositories: "airbyte-python-cdk"
          app-id: ${{ secrets.OCTAVIA_BOT_APP_ID }}
          private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
      - name: Checkout Airbyte
        uses: actions/checkout@v4
        with:
          # Important that this is set so that CI checks are triggered again
          # Without this we would be forever waiting on required checks to pass
          token: ${{ steps.get-app-token.outputs.token }}

      - name: Checkout PR (${{ github.event.inputs.pr }})
        uses: dawidd6/action-checkout-pr@v1
        with:
          pr: ${{ github.event.inputs.pr }}

      - name: Check for blank or missing poetry.lock
        run: |
          if [ ! -s "poetry.lock" ]; then
            echo "poetry.lock missing or blank. Fetching from main branch..."
            git fetch origin main
            git checkout origin/main -- poetry.lock
            echo "Lock file restored from main."
          else
            echo "poetry.lock found. Proceeding."
          fi

      - name: Get PR info
        id: pr-info
        run: |
          PR_JSON=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.inputs.pr }})
          echo "repo=$(echo "$PR_JSON" | jq -r .head.repo.full_name)" >> $GITHUB_OUTPUT
          echo "branch=$(echo "$PR_JSON" | jq -r .head.ref)" >> $GITHUB_OUTPUT
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash

      - name: Create URL to the run output
        id: vars
        run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> $GITHUB_OUTPUT

      - name: Append comment with job run link
        id: first-comment-action
        uses: peter-evans/create-or-update-comment@v4
        with:
          comment-id: ${{ github.event.inputs.comment-id }}
          issue-number: ${{ github.event.inputs.pr }}
          body: |
            > **Poetry-Lock Job Info**
            >
            > This job attempts to re-lock dependencies using `poetry lock` command. If any changes
            > are made, those changes will be automatically committed and pushed back to the PR.
            >
            > Note: This job can only be run by maintainers. On PRs from forks, this command requires
            > that the PR author has enabled the `Allow edits from maintainers` option.
            >
            > `poetry lock` job started... [Check job output.][1]

            [1]: ${{ steps.vars.outputs.run-url }}

      - name: Set up Poetry
        uses: snok/install-poetry@v1
        with:
          version: "2.0.1"
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: "poetry"

      # Run `poetry lock`

      - name: Run `poetry lock`
        run: poetry lock

      # Check for changes in git

      - name: Check for changes
        id: git-diff
        run: |
          git diff --quiet && echo "No changes to commit" || echo "changes=true" >> $GITHUB_OUTPUT
        shell: bash

      # Commit changes (if any)

      - name: Commit changes
        if: steps.git-diff.outputs.changes == 'true'
        run: |
          git config --global user.name "octavia-squidington-iii"
          git config --global user.email "contact@airbyte.com"
          git add .
          git commit -m "Auto-commit `poetry lock` changes"

      - name: Push changes to '(${{ steps.pr-info.outputs.repo }})'
        if: steps.git-diff.outputs.changes == 'true'
        run: |
          git remote add contributor https://github.com/${{ steps.pr-info.outputs.repo }}.git
          git push contributor HEAD:${{ steps.pr-info.outputs.branch }}

      - name: Append success comment
        uses: peter-evans/create-or-update-comment@v4
        if: steps.git-diff.outputs.changes == 'true'
        with:
          comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
          reactions: hooray
          body: |
            > ✅ `poetry lock` applied successfully.

      - name: Append success comment (no-op)
        uses: peter-evans/create-or-update-comment@v4
        if: steps.git-diff.outputs.changes != 'true'
        with:
          comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
          reactions: "+1"
          body: |
            > 🟦 Job completed successfully (no changes).

      - name: Append failure comment
        uses: peter-evans/create-or-update-comment@v4
        if: failure()
        with:
          comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
          reactions: confused
          body: |
            > ❌ Job failed.