ZacharyZhang-NY/omarchy-pkgs
1
0 Fork 0
Code Issues Pull Requests Actions 10 Packages Projects Releases Wiki Activity

Open one auto-merging PR per package from every sync workflow

Browse Source 
sync-upstream.yml, sync-rebuilds.yml and track-branches.yml each opened one
batch PR, so one package with a failing build held back every other update
in it (#788, #837). All three now group their changes with
package-pr-groups.sh and hand them to package-prs.yml, which opens a PR per
package and arms auto-merge. Packages pinned from the same upstream branch
still share one. Green packages land on their own and only the failures stay
open; a red PR conflicting with master, and each lane's old batch PR, get
closed.

sync-upstream.yml loses its human-merged lane: it now pushes with the PAT
like the other two, so its builds start without an approval hold and its PRs
auto-merge when green. min_release_age still quarantines fresh releases. Its
approve job, approve-sync-push.cjs, and auto-merge-pr.cjs's exception for
auto/sync-upstream go with it.
This commit is contained in:
Ryan Hughes committed 2026-10-09 18:20:57 -04:00
1 parent a7f730d1e6
commit ba7561a34c
11 files changed
+424 -467
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/track-branches.yml
+36 -138
View File
@@ -1,21 +1,21 @@
name: Track upstream branches
# The unattended lane. Packages marked "auto_merge": true update without a
# human: some follow a moving upstream branch (omarchy-dev and
# omarchy-settings-dev on quattro, omasnap-git on main) rather than tagged
# releases, so nothing in this repository changes when their source does;
# the rest are release feeds trusted to ship unreviewed (browsers, large
# vendors, Omacom's own projects). This workflow makes each new branch tip a commit pin
# in the recipe, which publish.yml then treats like any other version bump:
# the PR builds on the droplets, auto-merge lands it when `result` is green,
# and the merge publishes the artifacts. A tip that fails to build stays an
# unmerged red PR that the next tick supersedes.
# The hourly lane. Packages marked "auto_merge": true update here instead of
# in sync-upstream.yml's 6-hourly run: some follow a moving upstream branch
# (omarchy-dev and omarchy-settings-dev on quattro, omasnap-git on main)
# rather than tagged releases, so nothing in this repository changes when
# their source does; the rest are release feeds worth shipping within the
# hour (browsers, large vendors, Omacom's own projects). This workflow makes
# each new branch tip a commit pin in the recipe, which publish.yml then
# treats like any other version bump: the PR builds on the droplets,
# auto-merge lands it when `result` is green, and the merge publishes the
# artifacts. A tip that fails to build stays an unmerged red PR that the next
# tick supersedes.
#
# One PR per package, on auto/track-branches-<package>. Packages pinned from
# the same upstream branch (omarchy-dev and omarchy-settings-dev) share one,
# because sync-upstream moves them in lockstep. A single batch PR let one
# package with a broken build hold every other package back: omasnap-git's
# smoke suite kept the quattro pins unmerged for four days (#788).
# One PR per package, on auto/track-branches-<package>, opened by
# package-prs.yml. Packages pinned from the same upstream branch
# (omarchy-dev and omarchy-settings-dev) share one, because sync-upstream
# moves them in lockstep.
#
# The PR and auto-merge use the PAT in PKGS_BOT_TOKEN so they trigger the
# build and publish workflows. The built-in GITHUB_TOKEN cannot drive this
@@ -64,7 +64,7 @@ jobs:
with:
persist-credentials: false
# Same container as the reviewed sync: vercmp decides whether a pin is
# Same container as sync-upstream.yml: vercmp decides whether a pin is
# an upgrade with the comparator pacman uses on users' machines.
- name: Pin tracked branches to their current tips
id: sync
@@ -98,147 +98,45 @@ jobs:
PACKAGES: ${{ github.event.inputs.packages }}
UPSTREAM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# The PR a pin rides: one per package, or one per upstream branch for
# packages that must move together. The pins travel to the PR jobs as
# a patch, so the upstream feeds are read once and every PR is cut
# from the same answers.
- name: Group the pins into PRs
if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
id: groups
run: |
git diff --binary -- pkgbuilds > "$RUNNER_TEMP/pins.patch"
declare -A members=()
while IFS= read -r package; do
key=$(jq -r '(.upstream.watch? | objects | select(has("git_branch")) | "\(.git_branch)#\(.branch)") // empty' \
"pkgbuilds/$package/.omarchy/package.json" 2>/dev/null || true)
members["${key:-$package}"]+="$package "
done < <(git diff --name-only -- pkgbuilds | cut -d/ -f2 | sort -u)
groups='[]'
for key in "${!members[@]}"; do
read -r -a packages <<<"${members[$key]}"
branch=$(.github/scripts/sync-pr-branch.sh auto/track-branches "${packages[@]}" | sed -n 's/^branch=//p')
groups=$(jq -c --arg branch "$branch" --arg packages "${packages[*]}" \
'. + [{branch: $branch, packages: $packages}] | sort_by(.branch)' <<<"$groups")
done
groups=$(.github/scripts/package-pr-groups.sh auto/track-branches "$RUNNER_TEMP/pins.patch")
echo "groups=$groups" >> "$GITHUB_OUTPUT"
jq -r '.[] | "- `\(.branch)`: \(.packages)"' <<<"$groups" | sed '1i ### Tracker PRs' >> "$GITHUB_STEP_SUMMARY"
- name: Hand the pins to the PR jobs
if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
uses: actions/upload-artifact@v4
with:
name: pins
name: package-pins
path: ${{ runner.temp }}/pins.patch
retention-days: 1
# A tracker PR that this run did not refresh and that conflicts with
# master is stale: master moved its packages on without it. Close it
# rather than leave a red PR behind. Whether a PR was refreshed is not
# enough on its own, since a feed that failed this run (one of fifty
# timing out is routine) leaves a still-valid PR unrefreshed too. The
# old single auto/track-branches PR is retired outright: the per-package
# PRs replace it.
- name: Close superseded tracker PRs
if: ${{ !cancelled() && steps.groups.outcome == 'success' }}
env:
GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
GROUPS_JSON: ${{ steps.groups.outputs.groups }}
run: |
gh pr list -R "${{ github.repository }}" --state open --limit 200 --json number,headRefName,mergeable \
--jq '.[] | select(.headRefName | startswith("auto/track-branches")) | "\(.number) \(.headRefName) \(.mergeable)"' |
while read -r number branch mergeable; do
jq -e --arg branch "$branch" 'any(.[]; .branch == $branch)' <<<"$GROUPS_JSON" >/dev/null && continue
[[ $branch == auto/track-branches || $mergeable == CONFLICTING ]] || continue
echo "closing #$number ($branch): superseded"
gh pr close "$number" -R "${{ github.repository }}" --delete-branch \
--comment "Superseded: master has moved these packages on, or a per-package tracker PR carries them now."
done
pr:
prs:
needs: track
if: ${{ !cancelled() && needs.track.outputs.groups != '' && needs.track.outputs.groups != '[]' }}
runs-on: ubuntu-latest
if: ${{ !cancelled() && needs.track.outputs.groups != '' }}
permissions:
contents: read
strategy:
fail-fast: false
max-parallel: 4
matrix:
group: ${{ fromJSON(needs.track.outputs.groups) }}
uses: ./.github/workflows/package-prs.yml
with:
groups: ${{ needs.track.outputs.groups }}
prefix: auto/track-branches
title: Track upstream branches
body: |
Automated pin of a package that follows a moving upstream branch or a
trusted release feed (`"auto_merge": true` in `.omarchy/package.json`).
Its recipe now points at the newest upstream release, or the newest
branch tip whose commit timestamp is at least `min_release_age` old.
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
persist-credentials: false
- name: Fetch the pins
uses: actions/download-artifact@v4
with:
name: pins
path: ${{ runner.temp }}
- name: Apply this PR's pins
env:
PACKAGES: ${{ matrix.group.packages }}
run: |
read -r -a packages <<<"$PACKAGES"
git apply $(printf -- '--include=pkgbuilds/%s/* ' "${packages[@]}") "$RUNNER_TEMP/pins.patch"
git status --porcelain
{
echo "### Pinned"
git diff --unified=0 -- 'pkgbuilds/*/PKGBUILD' | grep -E '^\+(pkgver|_commit)=' | sed 's/^+/- /'
} >> "$GITHUB_STEP_SUMMARY"
# The PR title names what moved, so the merged history reads like a
# changelog: "Track upstream branches: omarchy-dev 4.0.0.r6520.g1a2b3c4, ...".
- name: Describe the pins
id: describe
run: |
title=$(git diff --unified=0 -- 'pkgbuilds/*/PKGBUILD' \
| awk '/^\+\+\+ b\/pkgbuilds\//{split($2,p,"/"); pkg=p[3]} /^\+pkgver=/{sub(/^\+pkgver=/,""); printf "%s %s, ", pkg, $0}' \
| sed 's/, $//')
echo "title=Track upstream branches: ${title}" >> "$GITHUB_OUTPUT"
- name: Open or update the tracking PR
id: pr
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
token: ${{ secrets.PKGS_BOT_TOKEN }}
commit-message: ${{ steps.describe.outputs.title }}
title: ${{ steps.describe.outputs.title }}
body: |
Automated pin of packages that follow a moving upstream branch
or a trusted release feed (`"auto_merge": true` in
`.omarchy/package.json`). Each package's recipe now points at the
newest upstream release, or the newest branch tip whose commit
timestamp is at least `min_release_age` old.
This PR auto-merges once the build checks pass. A failing build
leaves it open without holding back any other package; the next
tracker run replaces it with the newer tip.
branch: ${{ matrix.group.branch }}
delete-branch: true
labels: automated
# Auto-merge, not a direct merge: branch protection still has to see
# `result`, `self-tests` and `build-isolation` green, and this lane
# inherits every rule the reviewed lane has except the human.
- name: Enable auto-merge
if: ${{ steps.pr.outputs.pull-request-number != '' }}
env:
GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
PR: ${{ steps.pr.outputs.pull-request-number }}
run: |
# Idempotent across re-runs of an updated PR: enabling twice errors.
if [[ "$(gh pr view "$PR" -R "${{ github.repository }}" --json autoMergeRequest --jq '.autoMergeRequest != null')" == true ]]; then
echo "auto-merge already enabled on #$PR"
exit 0
fi
gh pr merge --auto --merge "$PR" -R "${{ github.repository }}"
This PR auto-merges once the build checks pass. A failing build leaves
it open without holding back any other package; the next tracker run
replaces it with the newer tip.
secrets:
PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
notify:
needs: [track, pr]
needs: [track, prs]
if: ${{ failure() }}
runs-on: ubuntu-latest
steps: