trogonstack-sync.yml

name: trogonstack-sync

# Merges the newest stable upstream release tag into main every Friday, so the
# image is ready for the homelab Renovate batch on Saturday.
# main = upstream release tag + our patch commits. This repo must never carry
# or push git tags: upstream's release and docker workflows trigger on tag
# pushes. Upstream tags are fetched into the runner only.

on:
  schedule:
    - cron: '17 6 * * 5'
  workflow_dispatch:

permissions: {}

concurrency:
  group: trogonstack-sync
  cancel-in-progress: false

env:
  UPSTREAM: https://github.com/router-for-me/CLIProxyAPI.git
  GH_TOKEN: ${{ github.token }}
  GH_REPO: ${{ github.repository }}
  RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

jobs:
  # Builds and tests upstream code, so it can read the repository and nothing
  # else. The merge is bundled before any of that code runs, and publish
  # pushes it by sha, so a test cannot swap the commit that lands.
  merge:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
      up_to_date: ${{ steps.tag.outputs.up_to_date }}
      sha: ${{ steps.merge.outputs.sha }}
      conflict: ${{ steps.merge.outputs.conflict }}
      verified: ${{ steps.verify.outcome }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          fetch-depth: 0
          persist-credentials: false

      - uses: ./.github/actions/setup-mise

      - name: Pick newest stable upstream tag
        id: tag
        run: mise run github:workflows:trogonstack-sync:pick-tag
      - name: Merge upstream tag
        id: merge
        if: steps.tag.outputs.up_to_date == 'false'
        env:
          TAG: ${{ steps.tag.outputs.tag }}
        run: mise run github:workflows:trogonstack-sync:merge-upstream
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: steps.tag.outputs.up_to_date == 'false'
        with:
          name: sync
          path: |
            ${{ runner.temp }}/sync.bundle
            ${{ runner.temp }}/conflicts.txt
          retention-days: 7
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        if: steps.tag.outputs.up_to_date == 'false' && steps.merge.outputs.conflict == 'false'
        with:
          go-version-file: go.mod
          # A cache saved after upstream tests run would be restored by
          # later builds on main.
          cache: false

      # The full suite is run as is. If upstream later adds tests that need
      # credentials or network not available in CI, narrow this to a package
      # subset here instead of skipping verification.
      - name: Build and test
        id: verify
        if: steps.tag.outputs.up_to_date == 'false' && steps.merge.outputs.conflict == 'false'
        continue-on-error: true
        run: mise run github:workflows:trogonstack-sync:verify

  # The only job that can read the Barnacle key: the environment admits it
  # from main, and GCP admits only this file. It runs mise tasks and a local
  # action from main, so push-main never lands a merge that changes them;
  # those, like workflow changes GITHUB_TOKEN may not push, go through a
  # reviewed pull request.
  # Barnacle opens the sync pull requests, so they run CI and may change
  # workflows, which GITHUB_TOKEN can do neither of.
  publish:
    needs: merge
    if: needs.merge.outputs.up_to_date == 'false'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment: github-app-barnacle
    permissions:
      contents: write
      actions: write
      id-token: write
    env:
      TAG: ${{ needs.merge.outputs.tag }}
      MERGE_SHA: ${{ needs.merge.outputs.sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          fetch-depth: 0

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: sync
          path: ${{ runner.temp }}

      - uses: ./.github/actions/setup-mise

      - name: Fetch the merge
        run: mise run github:workflows:trogonstack-sync:fetch-merge

      - name: Push main and build image
        id: push
        if: needs.merge.outputs.verified == 'success'
        run: mise run github:workflows:trogonstack-sync:push-main

      - name: Google Cloud auth
        if: needs.merge.outputs.verified != 'success' || steps.push.outputs.reason != ''
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
        with:
          workload_identity_provider: ${{ vars.BARNACLE_WORKLOAD_IDENTITY_PROVIDER }}

      - name: Barnacle key
        id: barnacle_key
        if: needs.merge.outputs.verified != 'success' || steps.push.outputs.reason != ''
        uses: google-github-actions/get-secretmanager-secrets@bc9c54b29fdffb8a47776820a7d26e77b379d262 # v3.0.0
        with:
          secrets: |-
            private_key:${{ vars.BARNACLE_PRIVATE_KEY_SECRET }}

      - name: Barnacle token
        id: barnacle
        if: needs.merge.outputs.verified != 'success' || steps.push.outputs.reason != ''
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ vars.BARNACLE_APP_CLIENT_ID }}
          private-key: ${{ steps.barnacle_key.outputs.private_key }}
          repositories: ${{ github.event.repository.name }}
          permission-contents: write
          permission-pull-requests: write
          permission-workflows: write

      - name: Publish the merge as a pull request
        if: needs.merge.outputs.verified != 'success' || steps.push.outputs.reason != ''
        env:
          BARNACLE_TOKEN: ${{ steps.barnacle.outputs.token }}
          CONFLICT: ${{ needs.merge.outputs.conflict }}
          VERIFIED: ${{ needs.merge.outputs.verified }}
          PUSH_REASON: ${{ steps.push.outputs.reason }}
        run: mise run github:workflows:trogonstack-sync:publish-pull-request

  # Main may hold fork-only commits that were never released. The release
  # workflow is idempotent, so run it for HEAD when it has an image, and build
  # and release that commit when it has none.
  release:
    needs: merge
    if: needs.merge.outputs.up_to_date == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      actions: write
      packages: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          persist-credentials: false

      - uses: ./.github/actions/setup-mise

      - name: Release current main
        env:
          REGISTRY_TOKEN: ${{ github.token }}
          ACTOR: ${{ github.actor }}
        run: mise run github:workflows:trogonstack-sync:release-current