update-llama-stack-version.yml

name: Update Llama Stack Version

run-name: "Update llama-stack to ${{ github.event.client_payload.tag }}"

on:
  repository_dispatch:
    types: [update-llama-stack-version]

permissions: {}

env:
  TAG: ${{ github.event.client_payload.tag }}
  BRANCH: chore/update-llama-stack-${{ github.event.client_payload.tag }}
  VERSION_FILE: distribution/build.py
  SOURCE_RUN_URL: ${{ github.event.client_payload.source_run_url }}
  MIDSTREAM_REPO_URL: https://github.com/opendatahub-io/llama-stack

concurrency:
  group: ${{ github.workflow }}-${{ github.event.client_payload.tag }}
  cancel-in-progress: false

jobs:
  preflight:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      should_continue: ${{ steps.checks.outputs.should_continue }}
    steps:
      - name: Validate event payload
        run: |
          if [[ -z "$TAG" ]]; then
            echo "::error::Missing 'tag' in repository_dispatch client_payload"
            exit 1
          fi

          # Validate tag format: vMAJOR.MINOR.PATCH[.BUILD]+rhaiv.N (e.g., v0.5.0+rhaiv.0, v0.5.0.1+rhaiv.0)
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?\+rhaiv\.[0-9]+$ ]]; then
            echo "::error::Tag '${TAG}' does not match expected format vX.Y.Z+rhaiv.N"
            exit 1
          fi
          echo "Validated tag: $TAG"

          # Validate source_run_url if provided (untrusted input from client_payload)
          if [[ -n "${SOURCE_RUN_URL}" ]]; then
            if [[ ! "${SOURCE_RUN_URL}" =~ ^${MIDSTREAM_REPO_URL}/actions/runs/[0-9]+$ ]]; then
              echo "::error::source_run_url does not match expected pattern: ${MIDSTREAM_REPO_URL}/actions/runs/<id>"
              exit 1
            fi
            echo "Validated source_run_url: $SOURCE_RUN_URL"
          fi

      - name: Checkout main branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: main

      - name: Run preflight checks
        id: checks
        run: |
          SHOULD_CONTINUE=true

          if [[ ! -f "$VERSION_FILE" ]]; then
            echo "::error::${VERSION_FILE} not found"
            exit 1
          fi

          if git ls-remote --exit-code --heads origin "refs/heads/${BRANCH}" > /dev/null 2>&1; then
            echo "::notice::Branch ${BRANCH} already exists — skipping (likely a duplicate trigger)"
            SHOULD_CONTINUE=false
          fi

          if grep -q "CURRENT_LLAMA_STACK_VERSION = \"${TAG}\"" "$VERSION_FILE"; then
            echo "::notice::Version already set to ${TAG} — nothing to update"
            SHOULD_CONTINUE=false
          fi

          if [[ "$SHOULD_CONTINUE" == "true" ]]; then
            echo "All preflight checks passed, proceeding with update"
          fi
          echo "should_continue=$SHOULD_CONTINUE" >> "$GITHUB_OUTPUT"

  update-version:
    needs: preflight
    if: needs.preflight.outputs.should_continue == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash -eo pipefail {0}
    env:
      WORKFLOW_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
      SLACK_WEBHOOK_URL: ${{ secrets.WH_SLACK_TEAM_LLS_CORE }}
      SLACK_GROUP_LLAMASTACK_RELEASE_MANAGERS: S0AHXK52HGD
    steps:
      - name: Checkout main branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: main
          token: ${{ secrets.RELEASE_TOKEN }}

      - name: Capture old version
        id: current-version
        run: |
          OLD_VERSION=$(grep '^CURRENT_LLAMA_STACK_VERSION = ' "$VERSION_FILE" | sed 's/.*"\(.*\)"/\1/') \
            || { echo "::error::Could not find CURRENT_LLAMA_STACK_VERSION in ${VERSION_FILE}"; exit 1; }
          echo "old_version=$OLD_VERSION" >> "$GITHUB_OUTPUT"
          echo "Current version: $OLD_VERSION"

      - name: Create update branch
        run: git checkout -b "$BRANCH"

      - name: Update version in build.py
        run: |
          sed -i "s|^CURRENT_LLAMA_STACK_VERSION = \".*\"|CURRENT_LLAMA_STACK_VERSION = \"${TAG}\"|" "$VERSION_FILE"

          if ! grep -q "CURRENT_LLAMA_STACK_VERSION = \"${TAG}\"" "$VERSION_FILE"; then
            echo "::error::Failed to update CURRENT_LLAMA_STACK_VERSION to ${TAG}"
            exit 1
          fi
          echo "Updated CURRENT_LLAMA_STACK_VERSION to ${TAG}"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.12'

      - name: Run pre-commit
        env:
          SKIP: no-commit-to-branch
        run: |
          pip install pre-commit
          # Two-pass approach: the first run lets hooks autofix files (e.g., Containerfile/README
          # regeneration by pkg-gen/doc-gen). The second run verifies everything is clean — any
          # failure here is a genuine error, not an expected autofix.
          pre-commit run --all-files || true
          pre-commit run --all-files

      - name: Commit changes
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add -A

          if git diff --cached --quiet; then
            echo "::error::No changes to commit — version may already be set to ${TAG}"
            exit 1
          fi

          git commit -m "chore: update llama-stack to ${TAG}"

      - name: Push branch
        run: git push origin "$BRANCH"

      - name: Open pull request
        id: create-pr
        env:
          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          OLD_VERSION: ${{ steps.current-version.outputs.old_version }}
          SOURCE_TAG_URL: ${{ env.MIDSTREAM_REPO_URL }}/releases/tag/${{ env.TAG }}
        run: |
          SOURCE_LINE=""
          if [[ -n "${SOURCE_RUN_URL}" ]]; then
            SOURCE_LINE="Triggered by: [workflow run](${SOURCE_RUN_URL})"
          fi
          export TAG OLD_VERSION SOURCE_TAG_URL SOURCE_LINE

          BODY=$(envsubst <<'EOF'
          ## Summary

          Update `CURRENT_LLAMA_STACK_VERSION` from `${OLD_VERSION}` to `${TAG}`

          Regenerated distribution artifacts via pre-commit.

          ## Source

          Tag: [`${TAG}`](${SOURCE_TAG_URL})
          ${SOURCE_LINE}

          ## Test plan

          - [ ] Review the generated `distribution/Containerfile` changes
          - [ ] Verify the new tag exists in opendatahub-io/llama-stack
          - [ ] Merge and confirm the distribution container build succeeds
          EOF
          )

          PR_URL=$(gh pr create \
            --base main \
            --head "$BRANCH" \
            --title "chore: update llama-stack to ${TAG}" \
            --body "$BODY")

          echo "pr_url=$PR_URL" >> "$GITHUB_OUTPUT"
          echo "Created PR: $PR_URL"

      - name: Notify Slack (success)
        if: success()
        run: |
          PR_URL="${{ steps.create-pr.outputs.pr_url }}"

          TEXT=$(printf '%s\n%s\n%s\n%s' \
            ":greenchecked: *Llama Stack version update to \`${TAG}\` is ready for review*" \
            "PR: <${PR_URL}|Review and merge>" \
            "<${WORKFLOW_URL}|View workflow run>" \
            "cc <!subteam^${SLACK_GROUP_LLAMASTACK_RELEASE_MANAGERS}>")

          .github/actions/notify-slack/notify.sh "$TEXT" \
            || echo "::warning::Failed to send Slack notification"

      - name: Notify Slack (failure)
        if: failure()
        run: |
          TEXT=$(printf '%s\n%s\n%s\n%s' \
            ":failed: *Failed to create llama-stack version update PR*" \
            "Version: \`${TAG}\`" \
            "<${WORKFLOW_URL}|View workflow run>" \
            "cc <!subteam^${SLACK_GROUP_LLAMASTACK_RELEASE_MANAGERS}>")

          .github/actions/notify-slack/notify.sh "$TEXT" "#d00000" \
            || echo "::warning::Failed to send Slack notification"