omarchy-pkgs/.github/workflows/track-branches.yml

name: Track upstream branches

# The hourly lane. Packages marked "auto_merge": true update here instead of
# in sync-upstream.yml's 6-hourly run: some follow a moving upstream branch
# (omarchy-dev and omarchy-settings-dev on quattro, omasnap-git on main)
# rather than tagged releases, so nothing in this repository changes when
# their source does; the rest are release feeds worth shipping within the
# hour (browsers, large vendors, Omacom's own projects). This workflow makes
# each new branch tip a commit pin in the recipe, which publish.yml then
# treats like any other version bump: the PR builds on the droplets,
# auto-merge lands it when `result` is green, and the merge publishes the
# artifacts. A tip that fails to build stays an unmerged red PR that the next
# tick supersedes.
#
# One PR per package, on auto/track-branches-<package>, opened by
# package-prs.yml. Packages pinned from the same upstream branch
# (omarchy-dev and omarchy-settings-dev) share one, because sync-upstream
# moves them in lockstep.
#
# The PR and auto-merge use the PAT in PKGS_BOT_TOKEN so they trigger the
# build and publish workflows. The built-in GITHUB_TOKEN cannot drive this
# unattended chain. The PAT needs Contents: write and Pull requests: write
# on this repository, and its owner must be trusted by the build workflow.

on:
  schedule:
    # Hourly, off the hour to dodge the scheduling backlog at :00. GitHub
    # drops scheduled runs under load: the old every-2-hours entry fired
    # every 6 to 9 hours in practice.
    - cron: '35 * * * *'
  workflow_dispatch:
    inputs:
      packages:
        description: 'Specific packages to track (space-separated, leave empty for every auto_merge package)'
        required: false
        default: ''

# One tracker at a time: two runs racing on one auto/track-branches-* branch
# would each force-push their own pin over the other's.
concurrency:
  group: track-branches
  cancel-in-progress: false

jobs:
  track:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      groups: ${{ steps.groups.outputs.groups }}

    steps:
      - name: Require the tracking token
        env:
          PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
        run: |
          if [[ -z "$PKGS_BOT_TOKEN" ]]; then
            echo "::error::Set PKGS_BOT_TOKEN to a PAT with Contents: write and Pull requests: write on this repository, owned by an account trusted to trigger builds."
            exit 1
          fi

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      # Same container as sync-upstream.yml: vercmp decides whether a pin is
      # an upgrade with the comparator pacman uses on users' machines.
      - name: Pin tracked branches to their current tips
        id: sync
        run: |
          docker run --rm \
            -e PACKAGES="$PACKAGES" \
            -e UPSTREAM_GITHUB_TOKEN="$UPSTREAM_GITHUB_TOKEN" \
            -e HOST_UID="$(id -u)" \
            -e HOST_GID="$(id -g)" \
            -v "$PWD/bin:/workspace/bin:ro" \
            -v "$PWD/helpers:/workspace/helpers:ro" \
            -v "$PWD/pkgbuilds:/workspace/pkgbuilds" \
            -w /workspace \
            ghcr.io/archlinux/archlinux:base-devel bash -lc '
              set -euo pipefail

              pacman -Syu --noconfirm git jq python libarchive

              groupadd -g "$HOST_GID" runner
              useradd -m -u "$HOST_UID" -g "$HOST_GID" runner
              chown -R runner:runner /workspace/pkgbuilds

              if [[ -n "${PACKAGES:-}" ]]; then
                read -r -a package_args <<< "$PACKAGES"
                runuser -u runner -- ./bin/sync-upstream --lane auto-merge "${package_args[@]}"
              else
                runuser -u runner -- ./bin/sync-upstream --lane auto-merge
              fi
            '
        env:
          PACKAGES: ${{ github.event.inputs.packages }}
          UPSTREAM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Group the pins into PRs
        if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
        id: groups
        run: |
          groups=$(.github/scripts/package-pr-groups.sh auto/track-branches "$RUNNER_TEMP/pins.patch")
          echo "groups=$groups" >> "$GITHUB_OUTPUT"

      - name: Hand the pins to the PR jobs
        if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
        uses: actions/upload-artifact@v4
        with:
          name: package-pins
          path: ${{ runner.temp }}/pins.patch
          retention-days: 1

  prs:
    needs: track
    if: ${{ !cancelled() && needs.track.outputs.groups != '' }}
    permissions:
      contents: read
    uses: ./.github/workflows/package-prs.yml
    with:
      groups: ${{ needs.track.outputs.groups }}
      prefix: auto/track-branches
      title: Track upstream branches
      body: |
        Automated pin of a package that follows a moving upstream branch or a
        trusted release feed (`"auto_merge": true` in `.omarchy/package.json`).
        Its recipe now points at the newest upstream release, or the newest
        branch tip whose commit timestamp is at least `min_release_age` old.

        This PR auto-merges once the build checks pass. A failing build leaves
        it open without holding back any other package; the next tracker run
        replaces it with the newer tip.
    secrets:
      PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}

  notify:
    needs: [track, prs]
    if: ${{ failure() }}
    runs-on: ubuntu-latest
    steps:
      - name: Notify Basecamp on failure
        if: ${{ env.BASECAMP_CHATBOT_URL != '' }}
        env:
          BASECAMP_CHATBOT_URL: ${{ secrets.BASECAMP_CHATBOT_URL }}
        run: |
          curl -s -o /dev/null \
            -H "Content-Type: application/json" \
            -d "$(jq -n --arg content \
              "🔴 <strong>Branch tracking failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
              '{content: $content}')" \
            "$BASECAMP_CHATBOT_URL"