cron-weekly-update.yml

name: 'cron: weekly update'
run-name: 'cron: weekly update'

# The runner applies dependency updates, installs, and fixes before PR creation.
# The Release App push starts downstream CI, which runs the required tests.

on:
  schedule:
    # Monday 09:00 UTC — the full weekly update.
    - cron: '0 9 * * 1'
    # Daily 08:00 UTC — soaked-exclusion promotion via the same runner.
    - cron: '0 8 * * *'
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: weekly-update
  cancel-in-progress: false

cache-mode: none

jobs:
  check-updates:
    name: Check for updates
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    outputs:
      actionable: ${{ steps.gate.outputs.actionable }}
    steps:
      - name: Bootstrap checkout
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TRIGGER_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          git init -q
          git config --local advice.detachedHead false
          git remote remove origin 2>/dev/null || true
          git remote add origin "${SERVER_URL}/${REPOSITORY}"
          FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")
          if [ -n "${GITHUB_TOKEN}" ]; then
            AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
            export GIT_CONFIG_COUNT=1
            export GIT_CONFIG_KEY_0="http.${SERVER_URL}/.extraheader"
            export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${AUTH_B64}"
            git fetch "${FETCH_ARGS[@]}"
          else
            git fetch "${FETCH_ARGS[@]}"
          fi
          git checkout -q --detach FETCH_HEAD

      - name: 'Set up and install'
        uses: ./.github/actions/fleet/setup-and-install
        with:
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
          # Reuse the Release App for a contents:read token scoped to wheelhouse.
          # Both credentials enable the private release fallback. Without the
          # key, hydration still pulls public GHCR anonymously.
          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}

      # The runner script IS the gate: exit 0 = actionable drift, 1 = no-op.
      - name: Run the check-updates gate
        id: gate
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          ACTIONABLE='true'
          node scripts/fleet/weekly-update.mts --check-updates || ACTIONABLE='false'
          # Report inline-action port drift (does not gate the update; a
          # behind port is reported for the weekly output).
          node scripts/fleet/sync-inline-action-pins.mts || true
          echo "actionable=${ACTIONABLE}" >> "$GITHUB_OUTPUT"

  update:
    cache-mode: read
    name: Update dependencies
    needs: check-updates
    if: ${{ needs.check-updates.outputs.actionable == 'true' }}
    runs-on: ${{ vars.ODAI_RUNNER || 'ubuntu-26.04' }}
    timeout-minutes: 45
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Bootstrap checkout
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TRIGGER_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          git init -q
          git config --local advice.detachedHead false
          git remote remove origin 2>/dev/null || true
          git remote add origin "${SERVER_URL}/${REPOSITORY}"
          FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}")
          if [ -n "${GITHUB_TOKEN}" ]; then
            AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
            export GIT_CONFIG_COUNT=1
            export GIT_CONFIG_KEY_0="http.${SERVER_URL}/.extraheader"
            export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${AUTH_B64}"
            git fetch "${FETCH_ARGS[@]}"
          else
            git fetch "${FETCH_ARGS[@]}"
          fi
          git checkout -q --detach FETCH_HEAD

      - name: 'Set up and install'
        uses: ./.github/actions/fleet/setup-and-install
        with:
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
          # Reuse the Release App for a contents:read token scoped to wheelhouse.
          # Both credentials enable the private release fallback. Without the
          # key, hydration still pulls public GHCR anonymously.
          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}

      - name: 'Set up odai'
        uses: ./.github/actions/fleet/setup-odai
        with:
          allow-fill: 'true'
          require-ready: 'true'
        id: odai

      - name: 'Mint PR branch token'
        id: pr-branch-app
        uses: ./.github/actions/fleet/github-pr-branch-app-token
        with:
          client-id: ${{ secrets.SOCKET_PR_CLIENT_ID || vars.SOCKET_PR_CLIENT_ID }}
          private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}
          repositories: ${{ github.event.repository.name }}

      - name: Run the weekly update
        shell: bash
        env:
          # Env-var indirection: expanding the expression inside `run:` is the
          # template-injection shape zizmor blocks.
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITHUB_TOKEN: ${{ github.token }}
          ODAI_READY: ${{ steps.odai.outputs.ready }}
          PR_APP_SLUG: ${{ steps.pr-branch-app.outputs.slug }}
          SERVER_URL: ${{ github.server_url }}
        run: |
          set -euo pipefail
          echo "on-device model ready: ${ODAI_READY}"
          AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
          export GIT_CONFIG_COUNT=1
          export GIT_CONFIG_KEY_0="http.${SERVER_URL}/.extraheader"
          export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${AUTH_B64}"
          git fetch --quiet origin "${DEFAULT_BRANCH}"
          if git ls-remote --exit-code --heads origin refs/heads/weekly-update >/dev/null; then
            git fetch --quiet origin +refs/heads/weekly-update:refs/remotes/origin/weekly-update
          else
            FETCH_STATUS=$?
            if [ "${FETCH_STATUS}" != 2 ]; then exit "${FETCH_STATUS}"; fi
          fi
          git checkout -B weekly-update "origin/${DEFAULT_BRANCH}"
          git config --local user.name "${PR_APP_SLUG}[bot]"
          git config --local user.email "${PR_APP_SLUG}[bot]@users.noreply.github.com"
          node scripts/fleet/weekly-update.mts

      - name: Validate PR branch delivery
        shell: bash
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          node scripts/fleet/weekly-update.mts --validate-delivery \
            --branch weekly-update \
            --default-branch "${DEFAULT_BRANCH}" \
            --base-ref "origin/${DEFAULT_BRANCH}"

      - name: 'Mint PR token'
        id: pr-app
        uses: ./.github/actions/fleet/github-pr-app-token
        with:
          client-id: ${{ secrets.SOCKET_PR_CLIENT_ID || vars.SOCKET_PR_CLIENT_ID }}
          private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}
          repositories: ${{ github.event.repository.name }}

      - name: Commit update fixes
        shell: bash
        env:
          GH_TOKEN: ${{ steps.pr-branch-app.outputs.token }}
          BASE: ${{ github.event.repository.default_branch }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail
          git add --all
          node scripts/fleet/github/commit.mts \
            --parent "origin/${BASE}" --branch weekly-update --repo "${REPOSITORY}" \
            --message 'chore(deps): apply weekly update fixes'

      - name: Ensure dependency labels
        shell: bash
        env:
          GH_TOKEN: ${{ steps.pr-app.outputs.token }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail
          LABELS="$(gh api --paginate "repos/${REPOSITORY}/labels?per_page=100" --jq '.[].name')"
          if ! printf '%s\n' "$LABELS" | grep -Fxi dependencies >/dev/null; then
            gh label create dependencies --repo "$REPOSITORY" \
              --color 0366d6 --description 'Dependency updates'
          fi
          if ! printf '%s\n' "$LABELS" | grep -Fxi automation >/dev/null; then
            gh label create automation --repo "$REPOSITORY" \
              --color 1d76db --description 'Automated maintenance'
          fi

      - name: Push the branch and open or refresh the PR
        shell: bash
        env:
          GH_TOKEN: ${{ steps.pr-app.outputs.token }}
          BRANCH_TOKEN: ${{ steps.pr-branch-app.outputs.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          BASE: ${{ github.event.repository.default_branch }}
        run: |
          set -euo pipefail
          BRANCH=weekly-update
          DATE="$(date -u +%Y-%m-%d)"
          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

          # Nothing to say: the branch is identical to base, so there is no
          # update to offer. Close any stale PR rather than leaving an empty one.
          if git diff --quiet "origin/${BASE}..HEAD"; then
            echo "no diff against ${BASE} — nothing to update."
            gh pr close "${BRANCH}" --repo "${REPOSITORY}" 2>/dev/null \
              && echo "closed the now-empty PR." || true
            REMOTE_BRANCH_COUNT="$(GH_TOKEN="${BRANCH_TOKEN}" gh api \
              "repos/${REPOSITORY}/git/matching-refs/heads/${BRANCH}" \
              --jq 'map(select(.ref == "refs/heads/weekly-update")) | length')"
            if [ "${REMOTE_BRANCH_COUNT}" -gt 0 ]; then
              node scripts/fleet/weekly-update.mts --validate-branch-delete \
                --branch "${BRANCH}" --default-branch "${BASE}" --owned
              GH_TOKEN="${BRANCH_TOKEN}" gh api --method DELETE \
                "repos/${REPOSITORY}/git/refs/heads/${BRANCH}"
            fi
            exit 0
          fi

          # Force-with-lease: the branch is ours and is rebuilt from base each
          # run, so a non-fast-forward push is EXPECTED. --force-with-lease
          # still refuses if someone else pushed to it since our fetch.
          AUTH_B64="$(printf 'x-access-token:%s' "${BRANCH_TOKEN}" | base64 | tr -d '\n')"
          export GIT_CONFIG_COUNT=1
          export GIT_CONFIG_KEY_0="http.${SERVER_URL}/.extraheader"
          export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${AUTH_B64}"
          git \
            push --no-verify --force-with-lease origin "HEAD:refs/heads/${BRANCH}"

          # Compose the body with the pure helper — never markdown surgery in
          # bash. It folds this run into a dated <details>, newest first, and
          # replaces any block already carrying today's date so a same-day
          # re-run stays idempotent.
          #
          # The fold's payload is the DEPENDENCY DELTA. Commit subjects alone
          # say nothing here: a dependency run squashes to one "chore(deps):
          # update dependencies", so a reviewer opening the fold needs the table
          # of what actually moved.
          #
          # pnpm-workspace.yaml is the file that matters. The fleet pins exact
          # versions and routes most of them through pnpm's catalog protocol,
          # so package.json reads `catalog:` on BOTH sides while the version it
          # resolves to moves in the catalog. Diffing the manifest alone would
          # render an empty table for exactly the updates this PR exists for.
          git show "origin/${BASE}:package.json" > /tmp/pkg-before.json 2>/dev/null || : > /tmp/pkg-before.json
          git show "HEAD:package.json" > /tmp/pkg-after.json 2>/dev/null || : > /tmp/pkg-after.json
          git show "origin/${BASE}:pnpm-workspace.yaml" > /tmp/ws-before.yaml 2>/dev/null || : > /tmp/ws-before.yaml
          git show "HEAD:pnpm-workspace.yaml" > /tmp/ws-after.yaml 2>/dev/null || : > /tmp/ws-after.yaml

          mapfile -t LINES < <(git log --format="- %s" "origin/${BASE}..HEAD" | head -50)
          LINE_ARGS=()
          for l in "${LINES[@]}"; do LINE_ARGS+=(--line "$l"); done

          BODY_ARGS=(
            --base "${BASE}" --date "${DATE}" --run-url "${RUN_URL}"
            --before-pkg /tmp/pkg-before.json --after-pkg /tmp/pkg-after.json
            --before-workspace /tmp/ws-before.yaml
            --after-workspace /tmp/ws-after.yaml
          )

          NUMBER="$(gh pr list --repo "${REPOSITORY}" --head "${BRANCH}" --state open --json number --jq ".[0].number // empty")"
          if [ -z "${NUMBER}" ]; then
            printf "" | node scripts/fleet/weekly-update/pr-body-cli.mts \
              "${BODY_ARGS[@]}" "${LINE_ARGS[@]}" > /tmp/pr-body.md
            if ! NUMBER="$(gh api --method POST "repos/${REPOSITORY}/pulls" \
              -f "head=${BRANCH}" \
              -f "base=${BASE}" \
              -f 'title=chore(deps): rolling dependency update' \
              -F body=@/tmp/pr-body.md --jq .number)"; then
              printf '%s\n' "${NUMBER}" >&2
              exit 1
            fi
            gh api --method POST "repos/${REPOSITORY}/issues/${NUMBER}/labels" \
              -f 'labels[]=dependencies' -f 'labels[]=automation' --silent
          else
            gh pr view "${NUMBER}" --repo "${REPOSITORY}" --json body --jq .body \
              | node scripts/fleet/weekly-update/pr-body-cli.mts \
                  "${BODY_ARGS[@]}" "${LINE_ARGS[@]}" > /tmp/pr-body.md
            gh api --method PATCH "repos/${REPOSITORY}/pulls/${NUMBER}" \
              -F body=@/tmp/pr-body.md --silent
            echo "refreshed PR #${NUMBER} with the ${DATE} entry."
          fi

          # Adopt the pre-rolling PRs. Switching to one branch does not
          # retroactively claim the PRs opened before the switch: they sit on
          # per-run branches, some named by an agent rather than a format
          # string, so --head cannot find them and they would simply pile up.
          # Identity is the label pair this workflow applies plus a bot author,
          # so a human's dependency PR is never touched.
          gh pr list --repo "${REPOSITORY}" --state open \
            --json number,headRefName,isCrossRepository,labels,author \
            | node scripts/fleet/weekly-update/superseded-cli.mts --branch "${BRANCH}" \
            | while IFS=$'\t' read -r OLD OLD_HEAD SAME_REPOSITORY_HEAD; do
                [ -n "${OLD}" ] || continue
                [ "${OLD}" = "${NUMBER}" ] && continue
                [ -n "${OLD_HEAD}" ] || { echo "missing head ref for PR #${OLD}." >&2; exit 1; }
                gh pr close "${OLD}" --repo "${REPOSITORY}" \
                  --comment "Superseded by #${NUMBER}, the rolling dependency PR. Updates now land on one long-lived \`${BRANCH}\` branch, rebuilt from \`${BASE}\` each run, with every run recorded as a dated fold in that PR body." \
                echo "closed superseded PR #${OLD}."
                if [ "${SAME_REPOSITORY_HEAD}" = true ]; then
                  node scripts/fleet/weekly-update.mts --validate-branch-delete \
                    --branch "${OLD_HEAD}" --default-branch "${BASE}" --owned
                  GH_TOKEN="${BRANCH_TOKEN}" gh api --method DELETE \
                    "repos/${REPOSITORY}/git/refs/heads/${OLD_HEAD}"
                fi
              done