renovate-custom-hooks.yaml

name: renovate hooks

permissions: {}

on:
  pull_request:
    branches:
      - main
    paths:
      - 'charts/**/*'

jobs:
  renovate-post-run:
    name: Renovate Post Run
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    if: github.event.pull_request.user.login  == 'renovate[bot]'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
          fetch-tags: 'false'

      # Using a GitHub App token, because GitHub Actions doesn't run on commits from github-actions bot
      # Used App:
      # https://github.com/organizations/prometheus-community/settings/apps/helm-charts-renovate-helper.
      # Ref: https://github.com/prometheus-community/helm-charts/issues/5213.
      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        id: app-token
        with:
          app-id: ${{ secrets.APP_RENOVATE_HELPER_APP_ID }}
          private-key: ${{ secrets.APP_RENOVATE_HELPER_PRIVATE_KEY }}

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.13'

      - name: Set up chart-testing
        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0

      - name: Detect changed charts
        id: list-changed
        #language=bash
        run: |
          changed="$(ct list-changed --config .github/linters/ct.yaml)"
          if [[ -n "$changed" ]]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "changed_list=${changed//$'\n'/ }" >> "$GITHUB_OUTPUT"
          fi

      - name: run renovate-post-upgrade-hook
        if: steps.list-changed.outputs.changed == 'true'
        env:
          CHART: ${{ steps.list-changed.outputs.changed_list }}
        #language=bash
        run: |
          if [[ -x "$CHART/hack/renovate-post-upgrade-hook.sh" ]]; then
            cd "$CHART"
            ./hack/renovate-post-upgrade-hook.sh
          fi

      - name: Commit changes
        if: steps.list-changed.outputs.changed == 'true'
        env:
          CHART: ${{ steps.list-changed.outputs.changed_list }}
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          GITHUB_HEAD_REF: ${{ github.head_ref }}
        #language=bash
        run: |
          set -x

          # Define the target directory
          TARGET_DIR="$CHART"

          # Fetch deleted files in the target directory
          DELETED_FILES=$(git diff --diff-filter=D --name-only HEAD -- "$TARGET_DIR")

          # Fetch added/modified files in the target directory
          MODIFIED_FILES=$(git diff --diff-filter=ACM --name-only HEAD -- "$TARGET_DIR")

          # Exit early if no changes detected
          if [ -z "$DELETED_FILES" ] && [ -z "$MODIFIED_FILES" ]; then
            echo "No files added, modified, or deleted. Skipping."
            exit 0
          fi

          # Create a temporary file for JSON output
          FILE_CHANGES_JSON_FILE=$(mktemp)

          # Initialize JSON structure in the file
          echo '{ "deletions": [], "additions": [] }' > "$FILE_CHANGES_JSON_FILE"

          # Add deletions
          for file in $DELETED_FILES; do
            jq --arg path "$file" '.deletions += [{"path": $path}]' "$FILE_CHANGES_JSON_FILE" > "$FILE_CHANGES_JSON_FILE.tmp"
            mv "$FILE_CHANGES_JSON_FILE.tmp" "$FILE_CHANGES_JSON_FILE"
          done

          # Add additions (new or modified files)
          for file in $MODIFIED_FILES; do
            TMP_CONTENT_FILE=$(mktemp)
            base64 -w 0 <"$file" > "$TMP_CONTENT_FILE"

            jq --arg path "$file" --rawfile content "$TMP_CONTENT_FILE" \
            '.additions += [{"path": $path, "contents": $content }]' "$FILE_CHANGES_JSON_FILE" > "$FILE_CHANGES_JSON_FILE.tmp"

            mv "$FILE_CHANGES_JSON_FILE.tmp" "$FILE_CHANGES_JSON_FILE"
            rm "$TMP_CONTENT_FILE"
          done

          # Create a temporary file for the final JSON payload
          JSON_PAYLOAD_FILE=$(mktemp)

          # Construct the final JSON using jq and store it in a file
          jq -n --arg repo "$GITHUB_REPOSITORY" \
                --arg branch "$GITHUB_HEAD_REF" \
                --arg message "post upgrade changes from renovate" \
                --arg expectedOid "$GITHUB_SHA" \
                --slurpfile fileChanges "$FILE_CHANGES_JSON_FILE" \
                '{
                  query: "mutation ($input: CreateCommitOnBranchInput!) {
                    createCommitOnBranch(input: $input) {
                      commit {
                        url
                      }
                    }
                  }",
                  variables: {
                    input: {
                      branch: {
                        repositoryNameWithOwner: $repo,
                        branchName: $branch
                      },
                      message: { headline: $message },
                      fileChanges: $fileChanges[0],
                      expectedHeadOid: $expectedOid
                    }
                  }
                }' > "$JSON_PAYLOAD_FILE"

          # Call GitHub API
          curl https://api.github.com/graphql -f \
            -sSf -H "Authorization: Bearer $GITHUB_TOKEN" \
            --data "@$JSON_PAYLOAD_FILE"

          # Clean up temporary files
          rm "$FILE_CHANGES_JSON_FILE" "$JSON_PAYLOAD_FILE"