cli/.github/workflows/cli-go-api-sync.yml at develop · supabase/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
name: API Sync

on:
  repository_dispatch:
    types:
      - api-sync
  # Fallback for a lost dispatch, per docs/openapi-sync.md. This matters more
  # now that the per-pull-request Codegen check reads the committed snapshot:
  # this workflow is the only thing that looks at the live specification, so a
  # dropped dispatch would otherwise leave drift undetected indefinitely.
  schedule:
    - cron: "17 6 * * *"
  workflow_dispatch: # allow manual triggering

permissions:
  contents: read

jobs:
  sync:
    name: Sync API Types
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: apps/cli-go/go.mod
          cache: true

      # The only place that reads the live spec. Every other consumer, including
      # the per-PR Codegen check, regenerates from the committed snapshot, so
      # upstream drift turns into this one pull request instead of a failure on
      # every open pull request that touches apps/cli-go.
      - name: Refresh the OpenAPI snapshot
        run: curl -fsSL "$API_SPEC_URL" -o api/v1-openapi.yaml
        env:
          API_SPEC_URL: https://api.supabase.green/api/v1-yaml

      - name: Run codegen
        run: go generate

      # Covers the snapshot as well as the generated client: an upstream edit
      # that codegen ignores (a description, an example) would otherwise be
      # refetched and discarded on every run, leaving the snapshot stale. The
      # snapshot is compared byte-for-byte for the same reason -- under
      # --ignore-space-at-eol a trailing-whitespace-only upstream edit would be
      # refetched and discarded forever, which is the loop this check prevents.
      # pkg keeps the flag: it is oapi-codegen output, not upstream bytes.
      - name: Check for changes
        id: check
        run: |
          if git diff --exit-code --quiet api/v1-openapi.yaml &&
            git diff --ignore-space-at-eol --exit-code --quiet pkg; then
            echo "No changes detected"
            echo "has_changes=false" >> $GITHUB_OUTPUT
          else
            echo "Changes detected"
            echo "has_changes=true" >> $GITHUB_OUTPUT
          fi

      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.GH_APP_CLIENT_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          permission-pull-requests: write
          permission-contents: write

      - name: Create Pull Request
        if: steps.check.outputs.has_changes == 'true'
        id: cpr
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ steps.app-token.outputs.token }}
          commit-message: "chore: sync API types from infrastructure"
          title: "chore: sync API types from infrastructure"
          body: |
            This PR was automatically created to sync API types from the infrastructure repository.

            Changes were detected after refreshing `apps/cli-go/api/v1-openapi.yaml` from the latest spec from infrastructure, and `apps/cli-go/pkg/api` is regenerated from it. The snapshot diff is the upstream API change and is worth reading: it is marked `linguist-generated`, so GitHub collapses it behind a "Load diff" click rather than hiding it.
          branch: sync/api-types
          base: develop

      - name: Approve Pull Request
        if: steps.check.outputs.has_changes == 'true'
        run: gh pr review --approve --repo "${{ github.repository }}" "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
        env:
          GH_TOKEN: ${{ secrets.AUTO_APPROVE_PR_PAT }}
          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}

      - name: Enable Pull Request Automerge
        if: steps.check.outputs.has_changes == 'true'
        run: gh pr merge --auto --squash --repo "${{ github.repository }}" "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
defaults:
  run:
    working-directory: apps/cli-go