Make PR

Author: larseggert

.github/actions/check-vm/action.yml

@@ -185,17 +185,3 @@ runs:
       with:
         name: bindings-${{ inputs.platform }}
         path: ${{ inputs.working-directory }}/${{ inputs.platform }}.rs
-
-    - if: ${{ always() && inputs.generate-bindings == 'true' }}
-      shell: bash
-      env:
-        WD: ${{ inputs.working-directory }}
-        PLATFORM: ${{ inputs.platform }}
-      run: |
-        # Check if generated bindings differ from committed bindings
-        if [ -f "$WD/$PLATFORM.rs" ]; then
-          if ! diff "$WD/src/bindings/$PLATFORM.rs" "$WD/$PLATFORM.rs"; then
-            echo "::error::Generated bindings for $PLATFORM differ from committed version. Update src/bindings/$PLATFORM.rs with the artifact contents."
-            exit 1
-          fi
-        fi

.github/workflows/check-mtu.yml

@@ -1,6 +1,12 @@
 name: CI MTU
 on:
   workflow_dispatch:
+  push:
+    branches: ["main"]
+    paths:
+      - "mtu/**"
+      - ".github/workflows/check-mtu.yml"
+      - ".github/actions/check-vm/**"
   pull_request:
     branches: ["main"]
 
@@ -46,14 +52,6 @@ jobs:
         with:
           name: bindings-${{ matrix.os }}
           path: ${{ matrix.os }}.rs
-      - name: Check bindings match committed
-        env:
-          OS: ${{ matrix.os }}
-        run: |
-          if ! diff "mtu/src/bindings/$OS.rs" "$OS.rs"; then
-            echo "::error::Generated bindings for $OS differ from committed version. Update mtu/src/bindings/$OS.rs with the artifact contents."
-            exit 1
-          fi
 
   check-android:
     name: Check Android
@@ -89,3 +87,76 @@ jobs:
           codecov-token: ${{ secrets.CODECOV_TOKEN }}
           generate-bindings: true
 
+  check-bindings:
+    name: Check bindings
+    needs: [generate-bindings, check-vm]
+    if: always() && !cancelled()
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write # to create PRs for binding updates
+      contents: write # to push branches for binding updates
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: true # zizmor: ignore[artipacked] We need to push branches.
+
+      - name: Download all binding artifacts
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          path: artifacts
+          pattern: bindings-*
+
+      - name: Check for binding changes
+        id: check
+        run: |
+          CHANGED=""
+          for dir in artifacts/bindings-*; do
+            [ -d "$dir" ] || continue
+            PLATFORM=$(basename "$dir" | sed 's/bindings-//')
+            FILE="$dir/$PLATFORM.rs"
+            [ -f "$FILE" ] || continue
+
+            if ! diff -q "mtu/src/bindings/$PLATFORM.rs" "$FILE" > /dev/null 2>&1; then
+              echo "Bindings for $PLATFORM differ:"
+              diff "mtu/src/bindings/$PLATFORM.rs" "$FILE" || true
+              cp "$FILE" "mtu/src/bindings/$PLATFORM.rs"
+              CHANGED="$CHANGED $PLATFORM"
+            fi
+          done
+
+          if [ -z "$CHANGED" ]; then
+            echo "No binding changes detected."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "platforms=$CHANGED" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create PR for binding updates
+        if: steps.check.outputs.changed == 'true' && github.event_name == 'push'
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SHA: ${{ github.sha }}
+          PLATFORMS: ${{ steps.check.outputs.platforms }}
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          echo "$TOKEN" | gh auth login --with-token
+          SHA_SHORT=$(echo "$SHA" | cut -c1-7)
+          BRANCH="chore-update-mtu-bindings-$SHA_SHORT"
+          MESSAGE="chore: Update MTU bindings
+
+          Automated update of platform-specific bindings generated by bindgen.
+
+          Updated platforms:$PLATFORMS"
+          git checkout -b "$BRANCH"
+          git add mtu/src/bindings
+          git commit -m "$MESSAGE"
+          git push --set-upstream origin "$BRANCH"
+          gh pr create --fill-verbose
+
+      - name: Fail if bindings changed on PR
+        if: steps.check.outputs.changed == 'true' && github.event_name == 'pull_request'
+        run: |
+          echo "::error::Generated bindings differ from committed versions. See job output for details."
+          exit 1