omarchy-pkgs/.github/workflows/sync-upstream.yml

name: Sync Upstream Releases

# Bumps every package whose upstream release feed has moved, except the
# "auto_merge": true packages that track-branches.yml checks hourly. Each
# package gets its own PR on auto/sync-upstream-<package>, opened by
# package-prs.yml: the PR builds on the droplets, auto-merge lands it when
# `result` is green, and the merge publishes. A package that fails to build
# stays an open red PR for a maintainer without holding back any other; the
# next run updates it if upstream moves again. `min_release_age` still
# quarantines fresh releases before they are proposed.
#
# The PRs and auto-merge use the PAT in PKGS_BOT_TOKEN, so their pushes
# build without an approval hold and their merges start publish.yml.

on:
  schedule:
    # Every 6 hours, off the hour to dodge the scheduling backlog at :00
    - cron: '20 */6 * * *'
  workflow_dispatch:
    inputs:
      packages:
        description: 'Specific packages to update (space-separated, leave empty for all)'
        required: false
        default: ''

# One sync at a time: two runs racing on one auto/sync-upstream-* branch
# would each force-push their own update over the other's.
concurrency:
  group: sync-upstream
  cancel-in-progress: false

jobs:
  sync:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      groups: ${{ steps.groups.outputs.groups }}

    steps:
      - name: Require the bot token
        env:
          PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
        run: |
          if [[ -z "$PKGS_BOT_TOKEN" ]]; then
            echo "::error::Set PKGS_BOT_TOKEN to a PAT with Contents: write and Pull requests: write on this repository, owned by an account trusted to trigger builds."
            exit 1
          fi

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      # Runs in an Arch container for vercmp: whether a release is an upgrade has
      # to be decided by the same comparator pacman will use on users' machines.
      - name: Update packages from upstream release feeds
        id: sync
        run: |
          docker run --rm \
            -e PACKAGES="$PACKAGES" \
            -e UPSTREAM_GITHUB_TOKEN="$UPSTREAM_GITHUB_TOKEN" \
            -e HOST_UID="$(id -u)" \
            -e HOST_GID="$(id -g)" \
            -v "$PWD/bin:/workspace/bin:ro" \
            -v "$PWD/helpers:/workspace/helpers:ro" \
            -v "$PWD/pkgbuilds:/workspace/pkgbuilds" \
            -w /workspace \
            ghcr.io/archlinux/archlinux:base-devel bash -lc '
              set -euo pipefail

              pacman -Syu --noconfirm git jq python libarchive

              groupadd -g "$HOST_GID" runner
              useradd -m -u "$HOST_UID" -g "$HOST_GID" runner
              chown -R runner:runner /workspace/pkgbuilds

              # Packages marked auto_merge ride track-branches.yml instead,
              # which checks them hourly.
              if [[ -n "${PACKAGES:-}" ]]; then
                read -r -a package_args <<< "$PACKAGES"
                runuser -u runner -- ./bin/sync-upstream --lane reviewed "${package_args[@]}"
              else
                runuser -u runner -- ./bin/sync-upstream --lane reviewed
              fi
            '
        env:
          PACKAGES: ${{ github.event.inputs.packages }}
          UPSTREAM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # Failed feeds leave their recipes untouched; completed updates still
      # get their PRs. The failed sync step keeps the workflow red and notifies.
      - name: Group the updates into PRs
        if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
        id: groups
        run: |
          groups=$(.github/scripts/package-pr-groups.sh auto/sync-upstream "$RUNNER_TEMP/pins.patch")
          echo "groups=$groups" >> "$GITHUB_OUTPUT"

      - name: Hand the updates to the PR jobs
        if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
        uses: actions/upload-artifact@v4
        with:
          name: package-pins
          path: ${{ runner.temp }}/pins.patch
          retention-days: 1

  prs:
    needs: sync
    if: ${{ !cancelled() && needs.sync.outputs.groups != '' }}
    permissions:
      contents: read
    uses: ./.github/workflows/package-prs.yml
    with:
      groups: ${{ needs.sync.outputs.groups }}
      prefix: auto/sync-upstream
      title: Sync upstream releases
      body: |
        Automated update of a package that tracks an upstream vendor release
        feed rather than the AUR.

        Release watches and providers are declared in `.omarchy/package.json`;
        exceptional feeds use `.omarchy/upstream.sh`. This PR auto-merges once
        the build checks pass. A failing build leaves it open for a maintainer
        without holding back any other package.
    secrets:
      PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}

  notify:
    needs: [sync, prs]
    if: ${{ failure() }}
    runs-on: ubuntu-latest
    steps:
      - name: Notify Basecamp on failure
        if: ${{ env.BASECAMP_CHATBOT_URL != '' }}
        env:
          BASECAMP_CHATBOT_URL: ${{ secrets.BASECAMP_CHATBOT_URL }}
        run: |
          curl -s -o /dev/null \
            -H "Content-Type: application/json" \
            -d "$(jq -n --arg content \
              "🔴 <strong>Upstream sync failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
              '{content: $content}')" \
            "$BASECAMP_CHATBOT_URL"