[35]更新が必要なパッケージ情報をIssueに起票するPIpelineの作成

.github/labels.yml

@@ -35,6 +35,10 @@
   color: "ffffff"
   description: "This will not be worked on"
 
+- name: "package_updated"
+  color: "0e8a16"
+  description: "Packages that need to be updated"
+
 # <!-- This is an auto-generated label -->
 - name: "@apps/catalog"
   color: d4f227

.github/workflows/issue-dependabot.yml

@@ -0,0 +1,101 @@
+name: Issue-Dependbot
+
+on:
+  schedule:
+    - cron: "0 0 * * 1" # 日本標準時間 毎週月曜日の朝9:00
+
+env:
+  ISSUE_LABEL: package_update
+
+jobs:
+  dependbot:
+    runs-on: ubuntu-22.04
+    permissions:
+      issues: write
+    timeout-minutes: 5
+    steps:
+      # https://github.com/marketplace/actions/checkout
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - name: Setup Application Runtime
+        uses: ./.github/actions/setup-application-runtime
+
+      - name: Check for package updates
+        id: package
+        run: |
+          update=$(dart run ./tools/update_package.dart)
+
+          if [ -z "$update" ]; then
+            echo "No update"
+            exit 0;
+          fi
+
+          path="$GITHUB_WORKSPACE/package_$(date +%Y%m%d%H%M%S)"
+          echo "$update" > "$path"
+          echo "path=$path" >> "$GITHUB_OUTPUT"
+
+      - name: Get Issue Number
+        id: issue
+        if: "${{ steps.package.outputs.path != '' }}"
+        run: |
+          getIssueNumber() {
+            issue_numbers=$(gh issue list --label "$ISSUE_LABEL" --json number | jq '.[].number')
+
+            issue_numbers_length=$(echo "$issue_numbers" | grep -c .)
+            if [ "$issue_numbers_length" -gt 1 ]; then
+              echo "Multiple issues exist. Please check the issue."
+              exit 1
+            elif [ "$issue_numbers_length" -eq 0 ]; then
+              issue_url=$(gh issue create --title "Update package" --label "$ISSUE_LABEL" --body-file ./tools/templates/issue_improve.md)
+              issue_number=$(echo "$issue_url" | sed -E 's/.*\/issues\/([0-9]+)$/\1/')
+              echo "$issue_number"
+            else
+              echo "$issue_numbers"
+            fi
+          }
+
+          issue_number=$(getIssueNumber)
+
+          echo "Issue Number: $issue_number"
+          echo "number=$issue_number" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Get the latest issue comment
+        id: latest
+        run: |
+          comment=$(gh issue view "${{ steps.issue.outputs.number }}" --json comments -q '.comments | last.body')
+
+          path="$GITHUB_WORKSPACE/comment_$(date +%Y%m%d%H%M%S)"
+          echo "$comment" > "$path"
+          echo "path=$path" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check if the latest comment is the same as the current comment
+        id: comment_check
+        run: |
+          package_comment=$(cat "${{ steps.package.outputs.path }}")
+          latest_comment=$(cat "${{ steps.latest.outputs.path }}")
+
+          if [[ "$package_comment" == "$latest_comment" ]]; then
+            echo "The latest comment is the same as the current comment"
+            exit 0
+          fi
+
+          echo "The latest comment is different from the current comment"
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+
+      - name: Comment
+        if: ${{ steps.comment_check.outputs.changed == 'true' }}
+        run: gh issue comment "${{ steps.issue.outputs.number  }}" --body-file "${{ steps.package.outputs.path }}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+
+
+
+
+
+

tools/model/package_info.dart

@@ -0,0 +1,137 @@
+enum Kind {
+  transitive,
+  dev,
+  direct;
+
+  const Kind();
+
+  factory Kind.fromString(String value) {
+    for (final kind in Kind.values) {
+      if (value == kind.name) {
+        return kind;
+      }
+    }
+
+    throw ArgumentError('Kind donse not have $value');
+  }
+}
+
+extension ExtString on String {
+  String substringIgnores({List<String> ignores = const ['-', '+']}) {
+    for (final pattern in ignores) {
+      final index = indexOf(pattern);
+      if (index != -1) {
+        return substring(0, index);
+      }
+    }
+
+    return this;
+  }
+}
+
+class PackageInfo {
+  const PackageInfo({required this.packages});
+
+  factory PackageInfo.fromJson(Map<String, dynamic> data) => PackageInfo(
+        packages: (data['packages'] as List<dynamic>)
+            .map((e) => Package.fromJson(e as Map<String, dynamic>))
+            .toList(),
+      );
+
+  final List<Package> packages;
+
+  Map<String, dynamic> toJson() => {
+        'packages': packages.map((e) => e.toJson()).toList(),
+      };
+}
+
+class Package {
+  const Package({
+    required this.package,
+    required this.kind,
+    required this.isDiscontinued,
+    required this.isCurrentRetracted,
+    required this.isCurrentAffectedByAdvisory,
+    required this.current,
+    required this.upgradable,
+    required this.resolvable,
+    required this.latest,
+  });
+
+  factory Package.fromJson(Map<String, dynamic> data) => Package(
+        package: data['package'] as String,
+        kind: Kind.fromString(data['kind'] as String),
+        isDiscontinued: data['isDiscontinued'] as bool,
+        isCurrentRetracted: data['isCurrentRetracted'] as bool,
+        isCurrentAffectedByAdvisory:
+            data['isCurrentAffectedByAdvisory'] as bool,
+        current: data['current'] == null
+            ? null
+            : Version.fromJson(data['current'] as Map<String, dynamic>),
+        upgradable:
+            Version.fromJson(data['upgradable'] as Map<String, dynamic>),
+        resolvable:
+            Version.fromJson(data['resolvable'] as Map<String, dynamic>),
+        latest: Version.fromJson(data['latest'] as Map<String, dynamic>),
+      );
+
+  final String package;
+  final Kind kind;
+  final bool isDiscontinued;
+  final bool isCurrentRetracted;
+  final bool isCurrentAffectedByAdvisory;
+  final Version? current;
+  final Version upgradable;
+  final Version resolvable;
+  final Version latest;
+
+  Map<String, dynamic> toJson() => {
+        'package': package,
+        'kind': kind,
+        'isDiscontinued': isDiscontinued,
+        'isCurrentRetracted': isCurrentRetracted,
+        'isCurrentAffectedByAdvisory': isCurrentAffectedByAdvisory,
+        'current': current?.toJson(),
+        'upgradable': upgradable.toJson(),
+        'resolvable': resolvable.toJson(),
+        'latest': latest.toJson(),
+      };
+}
+
+class Version implements Comparable<Version> {
+  const Version({required this.version});
+
+  factory Version.fromJson(Map<String, dynamic> data) => Version(
+        version: data['version'] as String,
+      );
+
+  final String version;
+
+  Map<String, dynamic> toJson() => {
+        'version': version,
+      };
+
+  @override
+  int compareTo(Version other) {
+    final currentVersion = version.substringIgnores().split('.');
+
+    final resolvableVersion = other.version.substringIgnores().split('.');
+    if (resolvableVersion.length != 3) {
+      throw ArgumentError('${other.version} is not forma: x.x.x');
+    }
+
+    for (var index = 0; index < 3; index++) {
+      final currentNum = int.parse(currentVersion[index]);
+      final resolvableNum = int.parse(resolvableVersion[index]);
+
+      final compare = currentNum.compareTo(resolvableNum);
+      if (compare == 0) {
+        continue;
+      }
+
+      return compare;
+    }
+
+    return 0;
+  }
+}

tools/templates/issue_improve.md

@@ -0,0 +1,18 @@
+## これに関する既存の Issue はありますか？
+
+検索して、既存の Issue の有無を確認してください。
+
+- [x] 既存の Issue はありませんでした (必須)
+
+---
+
+## 背景
+
+パッケージのversionが古く、セキュリティリスクや新機能による改善ができない状況です。
+
+---
+
+## 提案の詳細
+
+どのように改善するかについて、具体的に説明してください。
+`github-actions` が作成した最新のコメントに記載されたパッケージを更新してください。

tools/update_package.dart

@@ -0,0 +1,54 @@
+import 'dart:convert';
+import 'dart:io';
+import 'model/package_info.dart';
+
+/// dart pub outdated を時加工し、パッケージの更新有無を取得する
+Future<void> main() async {
+  const executable = 'dart';
+  const arguments = ['pub', 'outdated', '--json'];
+
+  final json = await Process.run(executable, arguments).then(
+    (e) => e.stdout as String,
+  );
+
+  if (json.isEmpty) {
+    throw ProcessException(
+      executable,
+      arguments,
+      'Failed to execute $executable $arguments',
+    );
+  }
+
+  final packageInfo =
+      PackageInfo.fromJson(jsonDecode(json) as Map<String, dynamic>);
+
+  final shouldUpdatePkg = packageInfo.packages.where((pkg) {
+    if (pkg.current != null && pkg.kind != Kind.transitive) {
+      // 依存関係で追加されたパッケージ以外 && パッケージが最新以外の内容を取得
+      return pkg.current!.compareTo(pkg.resolvable) != 0;
+    }
+
+    return false;
+  });
+
+  if (shouldUpdatePkg.isEmpty) {
+    return;
+  }
+
+  final rows = [
+    '''
+## Update package
+| package | current | resolvable |
+| :---    | :---    | :---       |
+  '''
+  ];
+
+  for (final pkg in shouldUpdatePkg) {
+    final row =
+        '''| ${pkg.package} | ${pkg.current?.version ?? 'null'} | ${pkg.resolvable.version} | \n''';
+
+    rows.add(row);
+  }
+
+  stdout.writeln(rows.join().trim());
+}