omarchy-pkgs/.github/workflows/sync-rebuilds.yml

name: Sync Rebuild Triggers

# Rebuilds ride the unattended lane, like track-branches.yml: each package's
# pkgrel bump gets its own PR on auto/sync-rebuilds-<package>, opened by
# package-prs.yml. It builds on the droplets, auto-merge lands it once
# `result`, `self-tests` and `build-isolation` are green, and the merge
# publishes. A rebuild that fails stays an unmerged red PR for a maintainer
# without holding back any other package.
#
# The PR and auto-merge use the PAT in PKGS_BOT_TOKEN, because a merge made
# with the built-in GITHUB_TOKEN does not start publish.yml, and its pushes
# are held for approval instead of building.

on:
  schedule:
    # Every 6 hours, off the hour to dodge the scheduling backlog at :00
    - cron: '40 */6 * * *'
  workflow_dispatch:
    inputs:
      packages:
        description: 'Specific packages to update (space-separated, leave empty for all)'
        required: false
        default: ''

# One sync at a time: two runs racing on one auto/sync-rebuilds-* branch
# would each force-push their own bump over the other's.
concurrency:
  group: sync-rebuilds
  cancel-in-progress: false

jobs:
  sync:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      groups: ${{ steps.groups.outputs.groups }}

    steps:
      - name: Require the bot token
        env:
          PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
        run: |
          if [[ -z "$PKGS_BOT_TOKEN" ]]; then
            echo "::error::Set PKGS_BOT_TOKEN to a PAT with Contents: write and Pull requests: write on this repository, owned by an account trusted to trigger builds."
            exit 1
          fi

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      # Runs in an Arch container against the mirror the x86_64 builder itself
      # uses, because the question being asked is what that builder will link
      # against and a different mirror can be hours ahead of it. Recording a
      # version the build never saw is the one failure this command must not
      # have: nothing re-fires once the record matches.
      - name: Bump pkgrel for packages whose dependencies moved
        id: sync
        run: |
          docker run --rm \
            -e PACKAGES="$PACKAGES" \
            -e HOST_UID="$(id -u)" \
            -e HOST_GID="$(id -g)" \
            -v "$PWD/bin:/workspace/bin:ro" \
            -v "$PWD/helpers:/workspace/helpers:ro" \
            -v "$PWD/pkgbuilds:/workspace/pkgbuilds" \
            -w /workspace \
            ghcr.io/archlinux/archlinux:base-devel bash -lc '
              set -euo pipefail

              printf "Server = https://mirror.omarchy.org/\$repo/os/\$arch\n" > /etc/pacman.d/mirrorlist
              pacman -Syu --noconfirm jq

              groupadd -g "$HOST_GID" runner
              useradd -m -u "$HOST_UID" -g "$HOST_GID" runner
              chown -R runner:runner /workspace/pkgbuilds

              if [[ -n "${PACKAGES:-}" ]]; then
                read -r -a package_args <<< "$PACKAGES"
                runuser -u runner -- ./bin/sync-rebuilds "${package_args[@]}"
              else
                runuser -u runner -- ./bin/sync-rebuilds
              fi
            '
        env:
          PACKAGES: ${{ github.event.inputs.packages }}

      - name: Group the bumps into PRs
        if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
        id: groups
        run: |
          groups=$(.github/scripts/package-pr-groups.sh auto/sync-rebuilds "$RUNNER_TEMP/pins.patch")
          echo "groups=$groups" >> "$GITHUB_OUTPUT"

      - name: Hand the bumps to the PR jobs
        if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
        uses: actions/upload-artifact@v4
        with:
          name: package-pins
          path: ${{ runner.temp }}/pins.patch
          retention-days: 1

  prs:
    needs: sync
    if: ${{ !cancelled() && needs.sync.outputs.groups != '' }}
    permissions:
      contents: read
    uses: ./.github/workflows/package-prs.yml
    with:
      groups: ${{ needs.sync.outputs.groups }}
      prefix: auto/sync-rebuilds
      title: Rebuild against updated dependencies
      body: |
        Automated pkgrel bump for a package that links against a dependency
        which has moved in the official repositories.

        Each package names those dependencies in `rebuild_on` and carries the
        versions its current pkgrel was bumped for in `rebuilt_against`. The
        bump is what makes the rebuilt package an upgrade pacman will offer;
        without it the build produces the version already published and no
        one receives it.

        This PR auto-merges once the build checks pass. A failing rebuild
        leaves it open for a maintainer without holding back any other package.
    secrets:
      PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}

  notify:
    needs: [sync, prs]
    if: ${{ failure() }}
    runs-on: ubuntu-latest
    steps:
      - name: Notify Basecamp on failure
        if: ${{ env.BASECAMP_CHATBOT_URL != '' }}
        env:
          BASECAMP_CHATBOT_URL: ${{ secrets.BASECAMP_CHATBOT_URL }}
        run: |
          curl -s -o /dev/null \
            -H "Content-Type: application/json" \
            -d "$(jq -n --arg content \
              "🔴 <strong>Rebuild trigger sync failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
              '{content: $content}')" \
            "$BASECAMP_CHATBOT_URL"