watch-webkit #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: watch-webkit | |
| # Weekly upstream watch: compare the newest STABLE WPE WebKit tag against the | |
| # engines the live feed serves, and open an issue when a newer engine should be | |
| # built. Policy: hosted engines track the STABLE train only (even minor — | |
| # 2.52.x; odd minors are development and security advisories land on stable), | |
| # so development tags are filtered out here. The issue is the tracking record; | |
| # building stays a human call (dispatch build-engine-windows.yml with the new | |
| # tag — pack/sign/publish then run unattended off the repo secrets). Skips if | |
| # an engine-update issue is already open, so it never stacks duplicates. | |
| on: | |
| schedule: | |
| - cron: '0 6 * * 1' # Mondays 06:00 UTC | |
| workflow_dispatch: | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| issues: write | |
| steps: | |
| - name: Compare upstream tags to the live feed | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| latest_tag=$(git ls-remote --tags https://github.com/WebKit/WebKit.git 'wpewebkit-*' \ | |
| | awk -F/ '{print $3}' | grep -E '^wpewebkit-[0-9]+\.[0-9]+\.[0-9]+$' \ | |
| | awk -F'[-.]' '$3 % 2 == 0' | sort -V | tail -1) | |
| latest="${latest_tag#wpewebkit-}" | |
| served=$(curl -sf https://engines.bunmaska.org/index.json \ | |
| | jq -r '.engines[].id' | cut -d- -f3 | sort -V | tail -1) | |
| echo "upstream latest: $latest / feed serves: $served" | |
| newest=$(printf '%s\n%s\n' "$served" "$latest" | sort -V | tail -1) | |
| if [ "$newest" = "$served" ]; then | |
| echo "feed is current" | |
| exit 0 | |
| fi | |
| open=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \ | |
| --label engine-update --json number --jq 'length') | |
| if [ "$open" != "0" ]; then | |
| echo "an engine-update issue is already open; not stacking another" | |
| exit 0 | |
| fi | |
| gh label create engine-update --repo "$GITHUB_REPOSITORY" \ | |
| --description "a newer upstream WebKit is available for the engine feed" \ | |
| --color D93F0B 2>/dev/null || true | |
| body=$(printf 'The weekly upstream watch found a newer stable WPE WebKit release.\n\n- Upstream: `%s`\n- Live feed serves: `%s` (https://engines.bunmaska.org/index.json)\n\nTo ship it: dispatch `build-engine-windows.yml` with `webkit_tag=%s`. Pack, sign, publish, and the index refresh all run unattended off the repo secrets. Release policy notes live in the engine hosting runbook (.admin).' "$latest_tag" "$served" "$latest_tag") | |
| gh issue create --repo "$GITHUB_REPOSITORY" \ | |
| --title "engine: upstream WebKit $latest available (feed serves $served)" \ | |
| --label engine-update --body "$body" |