ci: atomic pushes when updating packages (#13)

* ci: make update.yml atomic

* use git am properly

* only upload if changed

* diff Nru

* push on build

* fix reusable workflow calling

* checkout

* b64 input

* do not accumulate patches

* parallelise updates

.github/workflows/main.yml

@@ -3,16 +3,18 @@ on:
   pull_request:
   push:
     branches: [main]
-  # schedule:
-  # - cron: '53 19 * * *'  # AEST 5:53 am
-  workflow_run:
-    workflows: [update Nix packages]
-    types: [completed]
   workflow_dispatch:
-
+    inputs:
+      push: { type: boolean, default: false }
+      patches-b64: { type: string, required: false }
+  workflow_call:
+    inputs:
+      push: { type: boolean, default: false, required: false }
+      patches-b64: { type: string, required: false }
 
 jobs:
   update-check:
+    if: ${{ ! inputs.patches-b64 }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -43,6 +45,24 @@ jobs:
     - uses: cachix/cachix-action@v14
       with: { name: pac-nix, authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}', skipPush: "${{ github.ref != 'refs/heads/main' }}" }
 
+    - name: Apply staged patch commits
+      if: ${{ inputs.patches-b64 }}
+      run: |
+        shopt -s nullglob
+        set -x
+
+        cat <<EOF | base64 -d > patches.tar.zst
+        ${{ inputs.patches-b64 }}
+        EOF
+
+        mkdir prev-patches
+        tar xaf patches.tar.zst -C prev-patches
+
+        git config user.name 'github-actions[bot]'
+        git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+
+        for f in prev-patches/*; do git am "$f"; done
+
     - name: Check for meta.broken
       run: |
         broken="$(nix eval --json .#${{ matrix.pkg }}.meta.broken)"
@@ -75,8 +95,30 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ build ]
     steps:
-    - name: aggregate matrix results
+    - uses: actions/checkout@v4
+    - name: Aggregate matrix results
       run: |
         set -x
         result="${{ needs.build.result }}"
         [[ $result == success || $result == skipped ]]
+
+    - name: Apply staged patch commits
+      if: ${{ inputs.patches-b64 }}
+      run: |
+        shopt -s nullglob
+        set -x
+
+        cat <<EOF | base64 -d > patches.tar.zst
+        ${{ inputs.patches-b64 }}
+        EOF
+
+        mkdir prev-patches
+        tar xaf patches.tar.zst -C prev-patches
+
+        git config user.name 'github-actions[bot]'
+        git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+
+        for f in prev-patches/*; do git am "$f"; done
+
+    - run: git push
+      if: ${{ inputs.push }}

.github/workflows/update.yml

@@ -3,30 +3,83 @@ on:
   schedule:
   - cron: '53 18 * * 0-4'  # AEST 4:53 am
   workflow_dispatch:
+    inputs:
+      push: { type: boolean, default: false, required: false }
+
+env:
+  COMMIT: ${{ github.sha }}
 
 jobs:
   update:
     strategy:
-      max-parallel: 1
+      # max-parallel: 1
       fail-fast: false
       matrix:
         pkg: [asli, bap-asli-plugin, bap-primus, basil, gtirb-semantics,
               asl-translator, alive2-aslp, alive2-regehr, aslp_web, compiler-explorer]
+
     runs-on: ubuntu-latest
+
     steps:
     - uses: actions/checkout@v4
     - uses: cachix/install-nix-action@v25
     - uses: cachix/cachix-action@v14
       with: { name: pac-nix, authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' }
 
     - run: |
-        nix run .#update -- check -A ${{matrix.pkg}}
-
-    - run: |
-        git pull
         git config user.name 'github-actions[bot]'
         git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+
+    - run: |
+        nix run .#update -- check -A ${{matrix.pkg}}
+
     - run: |
         nix run .#update -- do-upgrade -A ${{matrix.pkg}}
-    - run: git push
+    - run: |
+        git format-patch $COMMIT -o new-patches
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: partial-patches-${{matrix.pkg}}
+        path: new-patches
+        if-no-files-found: ignore
+
+  collate:
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    needs: [ update ]
+    outputs:
+      patches: ${{ steps.data.outputs.b64 }}
+    steps:
+    - uses: actions/download-artifact@v4
+      with:
+        pattern: 'partial-patches-*'
+        merge-multiple: true
+        path: prev-patches
+
+    - uses: geekyeggo/delete-artifact@v5
+      with:
+        name: 'partial-patches-*'
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: all-patches
+        path: prev-patches
+        if-no-files-found: ignore
+
+    - name: Encode patches
+      id: data
+      run: |
+        set -x
+        (cd prev-patches && tar caf ../patches.tar.zst .)
+        (printf 'b64=' && base64 -w0 patches.tar.zst && echo) >> "$GITHUB_OUTPUT"
+        ls -lh *.tar*
+
+  build:
+    needs: [ collate ] 
+    uses: ./.github/workflows/main.yml
+    with:
+      patches-b64: ${{ needs.collate.outputs.patches }}
+      push: ${{ inputs.push || github.event_name == 'schedule' }}
+    secrets: inherit