coreutils-args-drift.yml

name: Coreutils Args Drift

# Detects upstream uutils/coreutils argument-surface AND vendored-module
# drift, and proposes both as a single PR. See
# knowledge/runtimes/coreutils-args-port.md for the design (args mode + module mode).
#
# Module set is read from `crates/bashkit-coreutils-port/vendored.toml`;
# adding a vendored module is one TOML stanza there and the drift run
# picks it up automatically — no workflow edits needed.
#
# The PR's intermediate commits are bot-authored (this is automated drift
# detection, not a code change). Squash-merge it as a human so the merge
# commit lands under a real identity per AGENTS.md commit-attribution rules.
#
# Security boundary: uutils source is third-party input. Regeneration,
# build, and tests run without repository write permission and without
# persisted checkout credentials. Only the later PR job gets write
# permission, and it only commits generated files after tests pass.

on:
  schedule:
    # Weekly Mondays 05:00 UTC. uutils flag changes are rare; weekly is plenty.
    - cron: '0 5 * * 1'
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  regenerate:
    name: Regenerate uutils argument surfaces
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    outputs:
      drifted: ${{ steps.diff.outputs.drifted }}
      modules: ${{ steps.regen_modules.outputs.modules }}
      old_rev: ${{ steps.rev.outputs.pinned }}
      rev: ${{ steps.regen.outputs.rev }}
      utils: ${{ steps.regen.outputs.utils }}
    steps:
      - name: Checkout bashkit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          path: bashkit
          persist-credentials: false

      # Two Cargo workspaces (bashkit + uutils) plus a release multicall
      # build share one volume on ubuntu-latest. Reclaim ~25 GiB of unused
      # preinstalled tooling before any cargo step touches target/.
      - name: Free disk space
        uses: ./bashkit/.github/actions/free-disk-space

      - name: Checkout uutils/coreutils
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: uutils/coreutils
          path: uutils
          persist-credentials: false
          # Full history so we can checkout the pinned rev below; depth=1
          # would only have HEAD.
          fetch-depth: 0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
        with:
          components: rustfmt

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          workspaces: bashkit

      # The pin in `crates/bashkit/src/builtins/generated/mod.rs` is the
      # single source of truth shared by args codegen AND the body-drift
      # harness. Resolve it here so every later step uses the same rev.
      - name: Resolve pinned uutils revision and upstream HEAD
        id: rev
        working-directory: bashkit
        run: |
          set -euo pipefail
          pinned="$(grep -oE 'UUTILS_REVISION: &str = "[^"]+"' \
              crates/bashkit/src/builtins/generated/mod.rs \
              | sed -E 's/.*"([^"]+)"/\1/')"
          if [ -z "$pinned" ]; then
              echo "::error::could not parse UUTILS_REVISION pin"
              exit 1
          fi
          upstream_full="$(git -C "$GITHUB_WORKSPACE/uutils" rev-parse HEAD)"
          upstream="$(git -C "$GITHUB_WORKSPACE/uutils" rev-parse --short HEAD)"
          echo "pinned=$pinned" >> "$GITHUB_OUTPUT"
          echo "upstream=$upstream" >> "$GITHUB_OUTPUT"
          echo "upstream_full=$upstream_full" >> "$GITHUB_OUTPUT"
          echo "Pinned: $pinned   Upstream HEAD: $upstream"

      # Drift workflow's job is to track upstream — codegen + harness
      # both run against upstream HEAD. If anything diverges, the
      # auto-PR bumps the pin AND the regenerated files atomically.
      - name: Check out uutils at upstream HEAD for codegen
        working-directory: uutils
        run: git checkout --detach "${{ steps.rev.outputs.upstream_full }}"

      - name: Regenerate argument surfaces
        id: regen
        working-directory: bashkit
        run: |
          set -euo pipefail
          uutils_dir="$GITHUB_WORKSPACE/uutils"
          rev="${{ steps.rev.outputs.upstream }}"
          out="crates/bashkit/src/builtins/generated"

          # Source of truth for "what's ported": the pub-mod lines in
          # generated/mod.rs. Adding a util means editing that file plus
          # consumer wiring; the workflow picks up new utils automatically.
          mapfile -t utils < <(grep -oE 'pub mod [a-z0-9_]+_args' "$out/mod.rs" \
              | sed -E 's/pub mod ([a-z0-9_]+)_args/\1/')
          if [ ${#utils[@]} -eq 0 ]; then
              echo "::error::no utilities found in $out/mod.rs"
              exit 1
          fi

          for util in "${utils[@]}"; do
              echo "::group::regenerating $util"
              cargo run -q -p bashkit-coreutils-port -- \
                  "$uutils_dir" "$util" "$rev" > "$out/${util}_args.rs"
              echo "::endgroup::"
          done
          cargo fmt -- "$out"/*.rs

          # Bump the pin so generated headers and the constant agree.
          # Single sed with anchored pattern keeps the edit safe.
          sed -i -E 's|(UUTILS_REVISION: &str = ")[^"]+(";)|\1'"$rev"'\2|' \
              "$out/mod.rs"

          echo "rev=$rev" >> "$GITHUB_OUTPUT"
          echo "utils=${utils[*]}" >> "$GITHUB_OUTPUT"

      # Module-mode drift: re-port every vendored uucore module from the
      # same uutils tree. Module set comes from the manifest, so picking
      # up a new vendored module needs no workflow change.
      - name: Re-port vendored uucore modules
        id: regen_modules
        working-directory: bashkit
        run: |
          set -euo pipefail
          uutils_dir="$GITHUB_WORKSPACE/uutils"
          rev="${{ steps.rev.outputs.upstream }}"
          manifest="crates/bashkit-coreutils-port/vendored.toml"

          # Extract module names from the manifest's `name = "<x>"` lines
          # under `[[modules]]`. Empty manifest → no work; that's fine.
          mapfile -t modules < <(grep -E '^name = "[^"]+"' "$manifest" \
              | sed -E 's/^name = "([^"]+)"/\1/')
          if [ ${#modules[@]} -eq 0 ]; then
              echo "no vendored modules in $manifest — skipping module-mode drift"
              echo "modules=" >> "$GITHUB_OUTPUT"
              exit 0
          fi

          for m in "${modules[@]}"; do
              echo "::group::re-porting module $m"
              cargo run -q -p bashkit-coreutils-port -- \
                  port-module "$uutils_dir" "$m" "$rev"
              echo "::endgroup::"
          done

          echo "modules=${modules[*]}" >> "$GITHUB_OUTPUT"

      # Format the module-mode output. The args step's `cargo fmt --
      # "$out"/*.rs` only globs the top-level generated/*.rs; module-vendor
      # output (format/, num_parser.rs, extendedbigdecimal.rs) plus any
      # generated/ subdirectory needs formatting too, or the drift PR fails
      # the rustfmt check. Scoped to generated/ to keep the open-pr
      # guardrail (generated-only diff) satisfied.
      - name: Format regenerated module sources
        working-directory: bashkit
        run: |
          set -euo pipefail
          out="crates/bashkit/src/builtins/generated"
          cargo fmt -- $(find "$out" -name '*.rs')

      - name: Verify build still passes
        working-directory: bashkit
        run: cargo build -p bashkit

      - name: Run cat/tac spec tests
        working-directory: bashkit
        run: cargo test -p bashkit --test integration -- spec_tests::bash_spec_tests

      # Body-drift gate: rebuild the matching uutils binaries from the
      # *same* tree the args codegen ran against, then run the
      # differential harness. Catches semantic divergence (e.g. uutils
      # reworking how -A renders a control byte) that the args drift
      # check cannot see.
      - name: Build uutils multicall from pinned tree
        working-directory: uutils
        run: |
          cargo build --release --bin coreutils
          echo "$GITHUB_WORKSPACE/uutils/target/release" >> "$GITHUB_PATH"

      - name: Run coreutils differential harness
        working-directory: bashkit
        env:
          BASHKIT_RUN_COREUTILS_DIFF: '1'
        # Quoted: a plain scalar ending in `:` is invalid YAML (parsed as a
        # mapping key) and broke parsing of this entire file, which made
        # GitHub record a failed zero-job run on every push to main.
        run: 'cargo test -p bashkit --test integration -- coreutils_differential_tests::'

      - name: Capture drift patch
        id: diff
        working-directory: bashkit
        run: |
          set -euo pipefail
          patch="$RUNNER_TEMP/coreutils-drift.patch"
          if git diff --quiet -- crates/bashkit/src/builtins/generated; then
              echo "drifted=false" >> "$GITHUB_OUTPUT"
              : > "$patch"
              exit 0
          fi
          git diff --binary -- crates/bashkit/src/builtins/generated > "$patch"
          echo "drifted=true" >> "$GITHUB_OUTPUT"

      - name: Upload drift patch
        if: steps.diff.outputs.drifted == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: coreutils-drift-patch
          path: ${{ runner.temp }}/coreutils-drift.patch
          if-no-files-found: error
          retention-days: 1

  open-pr:
    name: Open pull request if drifted
    needs: regenerate
    if: needs.regenerate.outputs.drifted == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout bashkit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          path: bashkit
          persist-credentials: false

      - name: Download drift patch
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: coreutils-drift-patch
          path: ${{ runner.temp }}/coreutils-drift

      - name: Apply drift patch
        working-directory: bashkit
        run: |
          set -euo pipefail
          branch="chore/coreutils-args-drift"
          git checkout -B "$branch"
          git apply --index "$RUNNER_TEMP/coreutils-drift/coreutils-drift.patch"
          bad_paths="$(git diff --cached --name-only \
              | grep -v '^crates/bashkit/src/builtins/generated/' || true)"
          if [ -n "$bad_paths" ]; then
              echo "::error::drift patch touched paths outside generated coreutils files"
              echo "$bad_paths"
              exit 1
          fi

      - name: Commit and open PR
        working-directory: bashkit
        env:
          GH_TOKEN: ${{ github.token }}
          NEW_REV: ${{ needs.regenerate.outputs.rev }}
          OLD_REV: ${{ needs.regenerate.outputs.old_rev }}
          UTILS: ${{ needs.regenerate.outputs.utils }}
          MODULES: ${{ needs.regenerate.outputs.modules }}
        run: |
          set -euo pipefail
          branch="chore/coreutils-args-drift"
          title="chore: sync uutils/coreutils argument surfaces and vendored modules"
          body_file="$(mktemp)"

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          gh auth setup-git
          git commit -m "chore(builtins): sync uutils/coreutils argument surfaces and vendored modules" \
              -m "Regenerated by \`bashkit-coreutils-port\` against uutils/coreutils@$NEW_REV." \
              -m "Utilities: $UTILS" \
              -m "Vendored modules: $MODULES"
          # Plain --force (not --force-with-lease): this branch is owned
          # exclusively by this automation and is fully regenerated each
          # run. The fresh main checkout has no remote-tracking ref for the
          # drift branch, so --force-with-lease aborts with "stale info"
          # whenever the branch already exists from a prior week's run.
          git push --force --set-upstream origin "$branch"

          cat > "$body_file" <<EOF
          Automated regeneration of argument surfaces and vendored modules
          ported from [uutils/coreutils](https://github.com/uutils/coreutils).

          **Source revision:** \`$NEW_REV\` (was \`$OLD_REV\`)
          **Utilities:** $UTILS
          **Vendored modules:** $MODULES
          **Trigger:** \`.github/workflows/coreutils-args-drift.yml\`

          This PR bumps \`UUTILS_REVISION\` in
          \`crates/bashkit/src/builtins/generated/mod.rs\`, the matching
          \`<util>_args.rs\` files, and any vendored module trees
          atomically — args codegen, module-vendor mode, and the
          body-drift harness all stay aligned to the same rev.

          Review the diff to confirm whether upstream:
          - Added flags we should now expose
          - Removed/renamed flags we should drop or migrate
          - Reworded help text in user-visible ways
          - Changed body code in vendored modules (e.g. \`format/\`)

          **Squash-merge as a human** so the merge commit is attributed
          correctly per \`AGENTS.md\`. Intermediate bot commits in this PR
          are discarded by squash.

          Design: [\`knowledge/runtimes/coreutils-args-port.md\`](../tree/main/knowledge/runtimes/coreutils-args-port.md).
          EOF

          if gh pr view "$branch" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
              gh pr edit "$branch" --repo "$GITHUB_REPOSITORY" \
                  --title "$title" \
                  --body-file "$body_file"
          else
              gh pr create --repo "$GITHUB_REPOSITORY" \
                  --base main \
                  --head "$branch" \
                  --title "$title" \
                  --body-file "$body_file"
          fi