update-backports.yml

name: "Update backports"

# Runs quarterly on the second day to update meta-balena's master branch backports

on:
  # Run at 00:00 the second day every 3rd month (quarterly)
  schedule:
    - cron: "0 0 2 */3 *"

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

env:
  # get the user id of the GitHub App
  # gh api /users/balenaos-esr%5Bbot%5D
  GIT_AUTHOR_NAME: balenaos-esr-bot[bot]
  GIT_AUTHOR_EMAIL: 146746583+balenaos-esr-bot[bot]@users.noreply.github.com
  GIT_COMMITTER_NAME: balenaos-esr-bot[bot]
  GIT_COMMITTER_EMAIL: 146746583+balenaos-esr-bot[bot]@users.noreply.github.com

jobs:
  fetch:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10"]
    outputs:
      status: ${{ join(steps.*.conclusion) }}
    steps:
      - name: Generate GitHub App installation token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
        id: gh_app_token
        with:
          app_id: ${{ vars.ESR_BOT_APP_ID || '400859' }}
          installation_retrieval_mode: organization
          installation_retrieval_payload: ${{ github.event.repository.owner.login }}
          private_key: ${{ secrets.ESR_BOT_PRIVATE_KEY }}
          repositories: >
            ["${{ github.event.repository.name }}"]

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          # The default GITHUB_TOKEN does not have workflow scope
          # This is needed to push a new branch with workflow files
          token: ${{ steps.gh_app_token.outputs.token }}
          persist-credentials: true

      - name: "Only run for meta-balena repository"
        id: assert-meta-balena-repository
        run: |
          if [ -f "$(pwd)/repo.yml" ]; then
            if grep -q "yocto layer" repo.yml; then
              exit 0
            fi
          fi
          exit 1

      - name: Setup Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pyyaml

      - name: "Update backports"
        id: update-backports
        run: |
          git fetch origin > /dev/null 2>&1
          esr_branches=$(git branch -r --sort=v:refname --list "origin/*.*.x")
          esr_branches=$(echo "${esr_branches}" | tr '\n' ' ')
          if [ -z "${esr_branches}" ]; then
            echo "[ERROR] No ESR branches available"
            exit 1
          fi
          # Modify repo.yml
          python3 <<-EOF
          import sys
          import yaml
          import re
          import os
          esr_branches=[str(v).replace('origin/', '') for v in "${esr_branches}".split()]
          next = esr_branches[-1]
          current = esr_branches[-2]
          sunset = esr_branches[-3]
          print("Identified ESR branches as:\n\n" +
                 "next: %s\ncurrent: %s\nsunset: %s\n" %
                 (next, current, sunset))
          for esr in [current, sunset, next]:
            if esr is not None and not re.compile("^[0-9]+\.[0-9]+\.x$").match(esr):
              print("Invalid ESR branch " + esr)
              sys.exit(1)
          filePath = './repo.yml'
          with open(filePath, 'r') as original:
            ydata = yaml.safe_load(original)
          if 'esr' in ydata:
            print("Refusing to set backport on ESR branch")
            sys.exit(1)
          if 'backports' not in ydata:
            print("No backports found on branch")
            sys.exit(1)
          if ydata['backports']['current'] is current:
            print("Current backport is already %s, nothing to do" % (current) )
            sys.exit(1)
          ydata['backports'] = {'current': current, 'sunset': sunset, 'next': next}
          with open(filePath, 'w') as modified:
            yaml.dump(ydata, modified)
          with open(os.environ['GITHUB_ENV'], 'a') as e:
            for name,value in { "ESR_CURRENT": current, "ESR_NEXT": next, "ESR_SUNSET": sunset}.items():
              print(f'{name}={value}', file=e)
          EOF

      - name: "Push backports"
        id: push-backports
        env:
          GH_TOKEN: ${{ steps.gh_app_token.outputs.token }}
        run: |
          branch_name="balenaci/update-backports"
          git checkout -b ${branch_name} HEAD
          git add repo.yml
          git commit -F- <<-EOF
          Update backports with current ${ESR_CURRENT}

          Set current to ${ESR_CURRENT}, next to ${ESR_NEXT} and sunset to ${ESR_SUNSET}

          Change-type: patch
          EOF
          git push origin ${branch_name}
          gh pr create --fill