Merge pull request #663 from omacom/ci/sync-pr-churn

Keep sync PRs building across bot pushes

.github/workflows/build-pr.yml

@@ -20,9 +20,16 @@ on:
         description: "Space-separated package directories to build"
         required: true
 
+# A new push normally cancels the PR's in-flight build. The sync bots'
+# branches (auto/sync-*) are the exception: they are force-pushed with fresh
+# upstream releases several times a day, which kept cancelling multi-hour
+# aarch64 builds before they could finish. There the newest run waits
+# instead (GitHub keeps at most one pending run per group, replacing older
+# pending ones), and when it starts it reuses every artifact the finished
+# build uploaded, so only packages whose tree changed are built again.
 concurrency:
   group: build-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.head_ref, 'auto/sync-')) }}
 
 jobs:
   # Builds cost real machines, so they run only for trusted authors:

.github/workflows/sync-rebuilds.yml

@@ -17,6 +17,12 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+    outputs:
+      branch: ${{ steps.branch.outputs.branch }}
+      pushed_at: ${{ steps.pushed.outputs.at }}
+      number: ${{ steps.cpr.outputs.pull-request-number }}
+      operation: ${{ steps.cpr.outputs.pull-request-operation }}
+      head_sha: ${{ steps.cpr.outputs.pull-request-head-sha }}
 
     steps:
       - name: Checkout repository
@@ -24,6 +30,17 @@ jobs:
         with:
           persist-credentials: false
 
+      # A scoped dispatch regenerates only the named packages. Pushed to the
+      # shared branch, that would replace every other pending update in its
+      # PR, so it gets a branch and PR of its own.
+      - name: Choose the PR branch
+        id: branch
+        env:
+          PACKAGES: ${{ github.event.inputs.packages }}
+        run: |
+          read -r -a package_args <<< "${PACKAGES:-}"
+          .github/scripts/sync-pr-branch.sh auto/sync-rebuilds "${package_args[@]}" | tee -a "$GITHUB_OUTPUT"
+
       # Runs in an Arch container against the mirror the x86_64 builder itself
       # uses, because the question being asked is what that builder will link
       # against and a different mirror can be hours ahead of it. Recording a
@@ -68,13 +85,21 @@ jobs:
             echo "has_changes=true" >> "$GITHUB_OUTPUT"
           fi
 
+      # Runs created by this push are newer than this; the approve job
+      # waits for them. A minute's slack absorbs runner clock skew.
+      - name: Record push time
+        if: steps.changes.outputs.has_changes == 'true'
+        id: pushed
+        run: echo "at=$(date -u -d '-1 minute' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+
       - name: Create Pull Request
         if: steps.changes.outputs.has_changes == 'true'
+        id: cpr
         uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'chore: rebuild against updated dependencies'
-          title: 'chore: rebuild against updated dependencies'
+          title: "chore: rebuild against updated dependencies${{ steps.branch.outputs.scope && format(' ({0})', steps.branch.outputs.scope) || '' }}"
           body: |
             Automated pkgrel bump for packages that link against a dependency
             which has moved in the official repositories.
@@ -84,7 +109,7 @@ jobs:
             bump is what makes the rebuilt package an upgrade pacman will offer;
             without it the build produces the version already published and no
             one receives it.
-          branch: auto/sync-rebuilds
+          branch: ${{ steps.branch.outputs.branch }}
           delete-branch: true
           labels: automated
           reviewers: ryanrhughes
@@ -100,3 +125,35 @@ jobs:
               "🔴 <strong>Rebuild trigger sync failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
               '{content: $content}')" \
             "$BASECAMP_CHATBOT_URL"
+
+  # GitHub holds pull_request runs from a GITHUB_TOKEN push for approval and
+  # creates no pull_request_target run for it, so approve-pr.yml never sees
+  # the sync's own pushes. Once a maintainer has labelled the PR
+  # build-approved, release the held runs for the commit just pushed. A
+  # separate job, so the sync container's token never holds actions: write.
+  approve:
+    needs: sync
+    if: ${{ !cancelled() && needs.sync.outputs.operation == 'updated' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Release held build and test runs if build-approved
+        uses: actions/github-script@v7
+        env:
+          NUMBER: ${{ needs.sync.outputs.number }}
+          BRANCH: ${{ needs.sync.outputs.branch }}
+          HEAD_SHA: ${{ needs.sync.outputs.head_sha }}
+          SINCE: ${{ needs.sync.outputs.pushed_at }}
+        with:
+          script: |
+            const approve = require('./.github/scripts/approve-sync-push.cjs');
+            const { NUMBER, BRANCH, HEAD_SHA, SINCE } = process.env;
+            await approve({ github, context, core, number: Number(NUMBER),
+              branch: BRANCH, headSha: HEAD_SHA, since: SINCE });

.github/workflows/sync-upstream.yml

@@ -17,6 +17,12 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+    outputs:
+      branch: ${{ steps.branch.outputs.branch }}
+      pushed_at: ${{ steps.pushed.outputs.at }}
+      number: ${{ steps.cpr.outputs.pull-request-number }}
+      operation: ${{ steps.cpr.outputs.pull-request-operation }}
+      head_sha: ${{ steps.cpr.outputs.pull-request-head-sha }}
 
     steps:
       - name: Checkout repository
@@ -24,6 +30,17 @@ jobs:
         with:
           persist-credentials: false
 
+      # A scoped dispatch regenerates only the named packages. Pushed to the
+      # shared branch, that would replace every other pending update in its
+      # PR, so it gets a branch and PR of its own.
+      - name: Choose the PR branch
+        id: branch
+        env:
+          PACKAGES: ${{ github.event.inputs.packages }}
+        run: |
+          read -r -a package_args <<< "${PACKAGES:-}"
+          .github/scripts/sync-pr-branch.sh auto/sync-upstream "${package_args[@]}" | tee -a "$GITHUB_OUTPUT"
+
       # Runs in an Arch container for vercmp: whether a release is an upgrade has
       # to be decided by the same comparator pacman will use on users' machines.
       - name: Update packages from upstream release feeds
@@ -72,13 +89,21 @@ jobs:
             echo "has_changes=true" >> "$GITHUB_OUTPUT"
           fi
 
+      # Runs created by this push are newer than this; the approve job
+      # waits for them. A minute's slack absorbs runner clock skew.
+      - name: Record push time
+        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
+        id: pushed
+        run: echo "at=$(date -u -d '-1 minute' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+
       - name: Create Pull Request
         if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
+        id: cpr
         uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'chore: sync upstream releases'
-          title: 'chore: sync upstream releases'
+          title: "chore: sync upstream releases${{ steps.branch.outputs.scope && format(' ({0})', steps.branch.outputs.scope) || '' }}"
           body: |
             Automated update of packages that track an upstream vendor release
             feed rather than the AUR.
@@ -86,7 +111,7 @@ jobs:
             Release watches and providers are declared in `.omarchy/package.json`;
             exceptional feeds use `.omarchy/upstream.sh`. Failed package updates
             are left untouched; check the workflow result for outstanding failures.
-          branch: auto/sync-upstream
+          branch: ${{ steps.branch.outputs.branch }}
           delete-branch: true
           labels: automated
           reviewers: ryanrhughes
@@ -102,3 +127,35 @@ jobs:
               "🔴 <strong>Upstream sync failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
               '{content: $content}')" \
             "$BASECAMP_CHATBOT_URL"
+
+  # GitHub holds pull_request runs from a GITHUB_TOKEN push for approval and
+  # creates no pull_request_target run for it, so approve-pr.yml never sees
+  # the sync's own pushes. Once a maintainer has labelled the PR
+  # build-approved, release the held runs for the commit just pushed. A
+  # separate job, so the sync container's token never holds actions: write.
+  approve:
+    needs: sync
+    if: ${{ !cancelled() && needs.sync.outputs.operation == 'updated' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Release held build and test runs if build-approved
+        uses: actions/github-script@v7
+        env:
+          NUMBER: ${{ needs.sync.outputs.number }}
+          BRANCH: ${{ needs.sync.outputs.branch }}
+          HEAD_SHA: ${{ needs.sync.outputs.head_sha }}
+          SINCE: ${{ needs.sync.outputs.pushed_at }}
+        with:
+          script: |
+            const approve = require('./.github/scripts/approve-sync-push.cjs');
+            const { NUMBER, BRANCH, HEAD_SHA, SINCE } = process.env;
+            await approve({ github, context, core, number: Number(NUMBER),
+              branch: BRANCH, headSha: HEAD_SHA, since: SINCE });