astroml/.github/workflows/infra-updates.yml at main · Traqora/astroml · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
name: Infrastructure Dependency Updates

on:
  schedule:
    # Run every Tuesday at 3am UTC (offset from Monday dependency updates)
    - cron: '0 3 * * 2'
  workflow_dispatch:
    inputs:
      force_check:
        description: 'Force check all images even if recently checked'
        required: false
        default: 'false'
        type: boolean

jobs:
  check-base-images:
    runs-on: ubuntu-latest
    outputs:
      updates_available: ${{ steps.check.outputs.updates_available }}
      update_report: ${{ steps.check.outputs.update_report }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker
        uses: docker/setup-buildx-action@v3

      - name: Check for base image updates
        id: check
        run: |
          python scripts/check_base_images.py \
            --dockerfiles Dockerfile api/Dockerfile Dockerfile.soroban \
            --output image_updates.json \
            --report update_report.md

          if [ -f image_updates.json ]; then
            updates=$(python -c "import json; data=json.load(open('image_updates.json')); print('true' if data else 'false')")
            echo "updates_available=$updates" >> $GITHUB_OUTPUT
            if [ -f update_report.md ]; then
              report=$(cat update_report.md)
              echo "update_report<<EOF" >> $GITHUB_OUTPUT
              echo "$report" >> $GITHUB_OUTPUT
              echo "EOF" >> $GITHUB_OUTPUT
            fi
          fi

      - name: Upload update report
        uses: actions/upload-artifact@v4
        with:
          name: image-update-report
          path: |
            image_updates.json
            update_report.md
          retention-days: 30

  create-update-pr:
    runs-on: ubuntu-latest
    needs: check-base-images
    if: needs.check-base-images.outputs.updates_available == 'true'
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download update report
        uses: actions/download-artifact@v4
        with:
          name: image-update-report

      - name: Apply image updates
        run: |
          python scripts/apply_image_updates.py \
            --updates image_updates.json \
            --commit-message "deps: update Docker base images"

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          branch: deps/docker-base-images
          delete-branch: true
          title: "deps: update Docker base images - ${{ github.event.schedule || 'manual' }}"
          body: |
            ## Docker Base Image Updates

            ${{ needs.check-base-images.outputs.update_report }}

            This PR was automatically generated by the Infrastructure Dependency Updates workflow.

            ### Verification
            - [ ] Review the changelogs for each updated image
            - [ ] Verify CI passes with the new images
            - [ ] Test locally if the update is significant
          labels: |
            dependencies
            docker
            infrastructure
          draft: false

  check-system-packages:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Check Dockerfile system packages
        run: |
          python scripts/check_system_packages.py \
            --dockerfiles Dockerfile api/Dockerfile \
            --output system_updates.json \
            --report system_report.md || true

      - name: Upload system package report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: system-package-report
          path: |
            system_updates.json
            system_report.md
          retention-days: 30