upgrade-main #46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: upgrade-main | |
| # Scheduled dependency upgrade on main: `mise run upgrade` refreshes the Yarn | |
| # workspaces and the agent uv lockfile WITHIN declared ranges/pins (exact pins | |
| # — including the Cedar parity pair — are never rewritten; see mise.toml). | |
| # Changes are shipped as a PR labeled 'auto-approve' so the auto-approve | |
| # workflow approves it once the build workflow passes. | |
| on: | |
| workflow_dispatch: {} | |
| schedule: | |
| - cron: 0 0 * * * | |
| permissions: | |
| actions: none | |
| attestations: none | |
| checks: none | |
| contents: none | |
| deployments: none | |
| discussions: none | |
| id-token: none | |
| issues: none | |
| models: none | |
| packages: none | |
| pages: none | |
| pull-requests: none | |
| repository-projects: none | |
| security-events: none | |
| statuses: none | |
| jobs: | |
| upgrade: | |
| name: Upgrade | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| if: github.repository == 'aws-samples/sample-autonomous-cloud-coding-agents' | |
| outputs: | |
| patch_created: ${{ steps.create_patch.outputs.patch_created }} | |
| env: | |
| MISE_EXPERIMENTAL: "1" | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| AQUA_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: main | |
| persist-credentials: false | |
| - name: Install mise | |
| uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 | |
| with: | |
| cache: true | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22.x | |
| - name: Install dependencies | |
| run: mise run install | |
| - name: Upgrade dependencies | |
| run: mise run upgrade | |
| - name: Find mutations | |
| id: create_patch | |
| shell: bash | |
| run: | | |
| git add . | |
| git diff --staged --patch --exit-code > repo.patch || echo "patch_created=true" >> "$GITHUB_OUTPUT" | |
| - name: Upload patch | |
| if: steps.create_patch.outputs.patch_created | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: repo.patch | |
| path: repo.patch | |
| overwrite: true | |
| pr: | |
| name: Create Pull Request | |
| needs: upgrade | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| if: ${{ needs.upgrade.outputs.patch_created }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: main | |
| persist-credentials: false | |
| - name: Download patch | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: repo.patch | |
| path: ${{ runner.temp }} | |
| - name: Apply patch | |
| run: '[ -s ${{ runner.temp }}/repo.patch ] && git apply ${{ runner.temp }}/repo.patch || echo "Empty patch. Skipping."' | |
| - name: Set git identity | |
| run: |- | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| - name: Create Pull Request | |
| id: create-pr | |
| # AUTOMATION_GITHUB_TOKEN is a PAT (contents + pull-requests write): | |
| # PRs created with the default GITHUB_TOKEN do not trigger the build | |
| # workflow, which branch protection requires before auto-approve merges. | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| token: ${{ secrets.AUTOMATION_GITHUB_TOKEN }} | |
| commit-message: |- | |
| chore(deps): upgrade dependencies | |
| Upgrades project dependencies. See details in [workflow run]. | |
| [Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| ------ | |
| *Automatically created by the "upgrade-main" workflow* | |
| branch: github-actions/upgrade-main | |
| title: "chore(deps): upgrade dependencies" | |
| body: |- | |
| Upgrades project dependencies. See details in [workflow run]. | |
| [Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| ------ | |
| *Automatically created by the "upgrade-main" workflow* | |
| author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | |
| committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | |
| signoff: true | |
| labels: auto-approve |