dotfiles/.github/workflows/update-terminal-tools.yml at main · Commanderx-code/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
name: Update pinned terminal tools
on:
  schedule:
    - cron: '23 6 * * 1'
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: update-terminal-tools
  cancel-in-progress: false
jobs:
  update:
    if: github.repository == 'Commanderx-code/dotfiles'
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
      # netwatch, tfm, cassette and the Zellij add-ons are fixed download links
      # that Dependabot cannot follow, so this compares each with its latest release.
      - name: Look for newer releases
        id: update
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 -B scripts/update-terminal-tools.py
      - name: Open or refresh the pull request
        if: steps.update.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          SUMMARY: ${{ steps.update.outputs.summary }}
        run: |
          branch=update-terminal-tools
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          git switch --force-create "$branch"
          git add home-manager/terminal-tools.nix home-manager/modules/zellij.nix
          git diff --cached --check
          git commit -m 'Update pinned terminal tools' -m "$SUMMARY"
          git push --force origin "$branch"
          # The description always matches the diff, also when an open pull
          # request is refreshed with a later release.
          body="Newer releases were published: $SUMMARY.

          Each hash is the SHA-256 of the file this workflow downloaded, so it shows the pin is consistent, not that the release is trustworthy. The build runs each new terminal program once; Zellij add-ons are only downloaded. Look at the upstream release before approving the validation run on this pull request."
          if [ "$(gh pr view "$branch" --json state --jq .state 2>/dev/null)" = OPEN ]; then
            gh pr edit "$branch" --body "$body"
          else
            gh pr create --head "$branch" --base main --title 'Update pinned terminal tools' --body "$body"
          fi
          # Validation is not started from here on purpose: it builds and runs
          # the newly downloaded programs, so it waits for the owner to approve
          # the run on the pull request after reading the diff.