update-opencode-commit.yml

name: Update Opencode Commit

on:
  workflow_dispatch:
  schedule:
    - cron: "0 1-23/2 * * *"

permissions:
  contents: write
  issues: write    # Required for creating issues on CI failure

jobs:
  update-opencode-commit:
    name: Update Opencode Commit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Initialize opencode submodule
        run: |
          # .gitmodules tracks opencode with an SSH URL. Actions runners
          # typically lack SSH deploy keys, so rewrite to HTTPS inline.
          git -c url."https://github.com/".insteadOf=git@github.com: \
              -c url."https://github.com/".insteadOf=ssh://git@github.com/ \
              submodule update --init --recursive packages/opencode
          git submodule status --recursive

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      # Toolchain setup for running CI checks on the updated submodule.
      # Steps match ci-pre-publish.yml to ensure parity with normal CI.
      - name: Install Linux system dependencies
        run: |
          # Required by opencode-broker (libpam-sys links against -lpam).
          sudo apt-get update
          sudo apt-get install -y libpam0g-dev

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Install just
        uses: extractions/setup-just@v3

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: '20'

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Update opencode commit
        id: update
        run: |
          ./scripts/update-opencode-commit.sh

      # Validate the updated submodule before committing.
      # Auto-fix formatting first, then run the full CI check suite.
      # If checks fail, the workflow fails and the broken commit is never pushed.
      - name: Auto-format and run CI checks
        id: ci_checks
        if: steps.update.outputs.needs_update == 'true'
        run: |
          set -euo pipefail

          # Auto-fix formatting issues introduced by the submodule update
          just fmt || true

          # If formatting produced changes, stage and commit them
          if ! git diff --quiet; then
            git add -A
            git commit -m "style: auto-format after opencode submodule update" || true
          fi

          # Run the full CI check suite
          just ci-checks

      - name: Verify OCI description label
        id: verify_oci
        run: python3 scripts/extract-oci-description.py packages/core/src/docker/Dockerfile

      - name: Commit and push if changed
        id: commit_push
        run: |
          if git diff --quiet; then
            echo "No changes to commit."
            {
              echo "changed=false"
              echo "pushed=false"
              echo "commit_sha="
            } >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git add packages/core/src/docker/Dockerfile packages/opencode
          git commit -m "chore: update opencode commit"
          commit_sha="$(git rev-parse HEAD)"
          {
            echo "changed=true"
            echo "pushed=false"
            echo "commit_sha=${commit_sha}"
          } >> "$GITHUB_OUTPUT"
          git push
          echo "pushed=true" >> "$GITHUB_OUTPUT"

      - name: Write summary
        if: always()
        env:
          UPDATE_OUTCOME: ${{ steps.update.outcome }}
          CI_CHECKS_OUTCOME: ${{ steps.ci_checks.outcome }}
          VERIFY_OCI_OUTCOME: ${{ steps.verify_oci.outcome }}
          COMMIT_PUSH_OUTCOME: ${{ steps.commit_push.outcome }}
          SUBMODULE_BRANCH: ${{ steps.update.outputs.submodule_branch }}
          SUBMODULE_REPO_URL: ${{ steps.update.outputs.submodule_repo_url }}
          CURRENT_SUBMODULE_COMMIT: ${{ steps.update.outputs.current_submodule_commit }}
          LATEST_COMMIT: ${{ steps.update.outputs.latest_commit }}
          CURRENT_PIN_VALUE: ${{ steps.update.outputs.current_pin_value }}
          UPDATED_PIN_VALUE: ${{ steps.update.outputs.updated_pin_value }}
          NEEDS_UPDATE: ${{ steps.update.outputs.needs_update }}
          UPDATED: ${{ steps.update.outputs.updated }}
          CHANGED: ${{ steps.commit_push.outputs.changed }}
          PUSHED: ${{ steps.commit_push.outputs.pushed }}
          COMMIT_SHA: ${{ steps.commit_push.outputs.commit_sha }}
        run: |
          set -euo pipefail

          fallback() {
            local value="${1:-}"
            if [[ -z "${value}" ]]; then
              echo "n/a"
            else
              echo "${value}"
            fi
          }

          branch="$(fallback "${SUBMODULE_BRANCH:-}")"
          repo_url="$(fallback "${SUBMODULE_REPO_URL:-}")"
          current_submodule="$(fallback "${CURRENT_SUBMODULE_COMMIT:-}")"
          latest_submodule="$(fallback "${LATEST_COMMIT:-}")"
          current_pin="$(fallback "${CURRENT_PIN_VALUE:-}")"
          updated_pin="$(fallback "${UPDATED_PIN_VALUE:-}")"
          needs_update="$(fallback "${NEEDS_UPDATE:-}")"
          updated="$(fallback "${UPDATED:-}")"
          changed="$(fallback "${CHANGED:-}")"
          pushed="$(fallback "${PUSHED:-}")"

          superproject_repo_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
          commit_link="n/a"
          if [[ "${PUSHED:-}" == "true" && -n "${COMMIT_SHA:-}" ]]; then
            commit_link="${superproject_repo_url}/commit/${COMMIT_SHA}"
          fi

          compare_link="n/a"
          if [[ -n "${SUBMODULE_REPO_URL:-}" && -n "${CURRENT_SUBMODULE_COMMIT:-}" && -n "${LATEST_COMMIT:-}" && "${CURRENT_SUBMODULE_COMMIT}" != "${LATEST_COMMIT}" ]]; then
            compare_link="${SUBMODULE_REPO_URL}/compare/${CURRENT_SUBMODULE_COMMIT}...${LATEST_COMMIT}"
          fi

          status_line="ℹ️ No update needed"
          if [[ "${UPDATE_OUTCOME:-}" == "failure" || "${CI_CHECKS_OUTCOME:-}" == "failure" || "${VERIFY_OCI_OUTCOME:-}" == "failure" || "${COMMIT_PUSH_OUTCOME:-}" == "failure" || "${UPDATE_OUTCOME:-}" == "cancelled" || "${CI_CHECKS_OUTCOME:-}" == "cancelled" || "${VERIFY_OCI_OUTCOME:-}" == "cancelled" || "${COMMIT_PUSH_OUTCOME:-}" == "cancelled" ]]; then
            status_line="❌ Failed"
          elif [[ "${PUSHED:-}" == "true" ]]; then
            status_line="✅ Updated and pushed"
          fi

          {
            echo "## ${status_line}"
            echo ""
            echo "**Trigger:** \`${GITHUB_EVENT_NAME}\`"
            echo "**Ref:** \`${GITHUB_REF}\`"
            echo "**Actor:** \`${GITHUB_ACTOR}\`"
            echo ""
            echo "**Submodule branch:** \`${branch}\`"
            echo "**Submodule repo:** ${repo_url}"
            echo ""
            echo "**Submodule commit:** \`${current_submodule} -> ${latest_submodule}\`"
            echo "**Dockerfile pin:** \`${current_pin} -> ${updated_pin}\`"
            echo ""
            echo "**Update flags:**"
            echo "- needs_update: \`${needs_update}\`"
            echo "- updated: \`${updated}\`"
            echo "- changed: \`${changed}\`"
            echo "- pushed: \`${pushed}\`"
            echo ""
            echo "**Links:**"
            if [[ "${compare_link}" == "n/a" ]]; then
              echo "- submodule compare: n/a"
            else
              echo "- submodule compare: ${compare_link}"
            fi
            if [[ "${commit_link}" == "n/a" ]]; then
              echo "- pushed superproject commit: n/a"
            else
              echo "- pushed superproject commit: ${commit_link}"
            fi
            echo ""
            echo "**Step outcomes:**"
            echo "- update: \`${UPDATE_OUTCOME:-n/a}\`"
            echo "- ci_checks: \`${CI_CHECKS_OUTCOME:-n/a}\`"
            echo "- verify_oci: \`${VERIFY_OCI_OUTCOME:-n/a}\`"
            echo "- commit_push: \`${COMMIT_PUSH_OUTCOME:-n/a}\`"
          } >> "${GITHUB_STEP_SUMMARY}"

      - name: Create issue on CI failure
        if: failure() && steps.ci_checks.outcome == 'failure'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LATEST_COMMIT: ${{ steps.update.outputs.latest_commit }}
          SUBMODULE_REPO_URL: ${{ steps.update.outputs.submodule_repo_url }}
          SUBMODULE_BRANCH: ${{ steps.update.outputs.submodule_branch }}
        run: |
          set -euo pipefail
          run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
          commit_short="${LATEST_COMMIT:0:12}"
          commit_url="${SUBMODULE_REPO_URL:-}/commit/${LATEST_COMMIT:-unknown}"
          branch="${SUBMODULE_BRANCH:-dev}"

          body="## Automated submodule update failed CI checks

          The [update-opencode-commit workflow](${run_url}) attempted to update the
          opencode submodule to [\`${commit_short}\`](${commit_url}) from the
          \`${branch}\` branch, but \`just ci-checks\` failed after auto-formatting.

          ### What to do

          1. Check the [workflow run logs](${run_url}) for the specific failure
          2. Common causes:
             - **TypeScript typecheck failure** in a fork-* package — fix in the opencode fork and push to \`dev\`
             - **Rust clippy/build failure** in opencode-broker — fix in the fork
             - **Formatting issue** that \`just fmt\` couldn't resolve — manual fix needed
          3. After fixing, the next scheduled run (every 2 hours) will retry automatically

          ### Context

          - Submodule commit: [\`${commit_short}\`](${commit_url})
          - Fork branch: \`${branch}\`
          - Workflow run: [${GITHUB_RUN_ID}](${run_url})"

          gh issue create \
            --title "CI checks failed for opencode submodule update (${commit_short})" \
            --label "bug,automated" \
            --body "${body}"