aur-update.yml

name: AUR package updates

on:
  schedule:
    - cron: "17 */6 * * *"
  workflow_dispatch:
    inputs:
      package:
        description: "Optional package directory/pkgbase to check"
        required: false
        type: string
      update_limit:
        description: "Maximum number of PRs to open in one run"
        required: false
        default: "10"
        type: string
      verify_source:
        description: "Run makepkg --verifysource after updating"
        required: false
        default: false
        type: boolean

permissions:
  contents: write
  issues: write
  pull-requests: write

concurrency:
  group: aur-package-updates
  cancel-in-progress: false

jobs:
  update:
    runs-on: ubuntu-latest
    container:
      image: archlinux:base-devel

    env:
      BASE_BRANCH: ${{ github.ref_name }}
      GH_TOKEN: ${{ github.token }}
      UPDATE_LIMIT: ${{ inputs.update_limit || '10' }}
      PACKAGE_FILTER: ${{ inputs.package || '' }}
      VERIFY_SOURCE: ${{ inputs.verify_source || 'false' }}
      BATCH_SLEEP: "2"

    steps:
      - name: Install checkout dependency
        run: pacman -Syu --noconfirm git

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install depends
        run: |
          pacman -Syu --noconfirm devtools pacman-contrib github-cli jq python-jq nvchecker sudo

      - name: Configure build user
        run: |
          useradd -m builder
          printf 'builder ALL=(ALL) NOPASSWD: ALL\n' >/etc/sudoers.d/builder
          chmod 0440 /etc/sudoers.d/builder
          chown -R builder:builder "$GITHUB_WORKSPACE"

      - name: Configure nvchecker credentials
        run: |
          install -dm700 /home/builder/.config/nvchecker
          cat >/home/builder/.config/nvchecker/keyfile.toml <<EOF
          [keys]
          github = "$GH_TOKEN"
          EOF
          chown -R builder:builder /home/builder/.config

      - name: Check for updates
        run: |
          run_as_builder=(
            sudo -u builder -H env
            BASE_BRANCH="$BASE_BRANCH"
            GH_TOKEN="$GH_TOKEN"
            UPDATE_LIMIT="$UPDATE_LIMIT"
            PACKAGE_FILTER="$PACKAGE_FILTER"
            VERIFY_SOURCE="$VERIFY_SOURCE"
            BATCH_SLEEP="$BATCH_SLEEP"
            GITHUB_REF_NAME="$GITHUB_REF_NAME"
            TERM=xterm-256color
          )
          if [[ -n "$PACKAGE_FILTER" ]]; then
            "${run_as_builder[@]}" bash ci/check-updates.sh "$PACKAGE_FILTER"
          else
            "${run_as_builder[@]}" bash ci/check-updates.sh
          fi

      - name: Publish update summary
        if: always()
        run: |
          if [[ -n "${GITHUB_STEP_SUMMARY:-}" && -f .ci/update-check/summary.md ]]; then
            cat .ci/update-check/summary.md >>"$GITHUB_STEP_SUMMARY"
          fi

      - name: Open update pull requests
        run: |
          sudo -u builder -H env \
            BASE_BRANCH="$BASE_BRANCH" \
            GH_TOKEN="$GH_TOKEN" \
            UPDATE_LIMIT="$UPDATE_LIMIT" \
            VERIFY_SOURCE="$VERIFY_SOURCE" \
            GITHUB_REF_NAME="$GITHUB_REF_NAME" \
            GIT_AUTHOR_NAME="${GIT_AUTHOR_NAME:-cachyos-update-bot}" \
            GIT_AUTHOR_EMAIL="${GIT_AUTHOR_EMAIL:-cachyos-update-bot@users.noreply.github.com}" \
            TERM=xterm-256color \
            bash ci/open-update-prs.sh

      - name: Publish pull request failures
        if: always()
        run: |
          failure_file=.ci/update-check/update-failures.txt
          if [[ -n "${GITHUB_STEP_SUMMARY:-}" && -s "$failure_file" ]]; then
            {
              printf '\n## Pull request update failures\n\n'
              printf 'These outdated packages could not be updated and did not receive a pull request:\n\n'
              printf '```text\n'
              cat "$failure_file"
              printf '```\n'
            } >>"$GITHUB_STEP_SUMMARY"
          fi

      - name: Upload update report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: aur-update-report
          path: |
            .ci/update-check/
            .ci/pr-bodies/