patch_update_release.yml

name: Update Runner Patches (Release-to-Release)

on:
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - "patches/runner-sdk8-*.patch"
      - "patches/last_processed_tag.txt"

permissions:
  contents: write # Required to push patch updates and release branches
  pull-requests: write # Required to create pull requests via peter-evans/create-pull-request

jobs:
  update-patches:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout your repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          # Persist the PE bot PAT (not the default GITHUB_TOKEN) so the
          # release-branch push triggers Runner CD (release.yml). Pushes
          # authenticated with GITHUB_TOKEN do not trigger downstream workflows.
          token: ${{ secrets.PE_BOT_PAT }}

      - name: Clone upstream runner repository
        run: git clone --tags https://github.com/actions/runner.git upstream-runner

      - name: Get release tags
        id: get-tags
        run: |
          cd upstream-runner
          # Get latest release tag
          LATEST_TAG=$(git tag --sort=-v:refname | grep '^v[0-9]' | head -n1)
          echo "LATEST_TAG=$LATEST_TAG" >> $GITHUB_OUTPUT
          echo "LATEST_COMMIT=$(git rev-parse $LATEST_TAG)" >> $GITHUB_OUTPUT

          # Get previous processed tag
          if [ -f ../patches/last_processed_tag.txt ]; then
            PREVIOUS_TAG=$(cat ../patches/last_processed_tag.txt)
            echo "PREVIOUS_TAG=$PREVIOUS_TAG" >> $GITHUB_OUTPUT
          else
            echo "PREVIOUS_TAG=" >> $GITHUB_OUTPUT
          fi

      - name: Check for new release
        if: steps.get-tags.outputs.PREVIOUS_TAG == steps.get-tags.outputs.LATEST_TAG
        run: |
          echo "No new releases - skipping"
          exit 0

      - name: Verify previous release exists
        if: steps.get-tags.outputs.PREVIOUS_TAG != '' && steps.get-tags.outputs.PREVIOUS_TAG != steps.get-tags.outputs.LATEST_TAG
        run: |
          cd upstream-runner
          if ! git rev-parse ${{ steps.get-tags.outputs.PREVIOUS_TAG }} >/dev/null 2>&1; then
            echo "Previous tag ${{ steps.get-tags.outputs.PREVIOUS_TAG }} not found"
            exit 1
          fi

      - name: Process architectures
        if: steps.get-tags.outputs.PREVIOUS_TAG != '' && steps.get-tags.outputs.PREVIOUS_TAG != steps.get-tags.outputs.LATEST_TAG
        id: process-arches
        run: |
          mkdir -p patches
          touch successful_arches.txt

          for arch in ppc64le s390x arm; do
            echo "Processing $arch..."
            cd upstream-runner
            
            # Reset to clean state
            git reset --hard
            git clean -fd

            # A patch that conflicted on a previous run may have been regenerated
            # manually for the latest release; use it as-is instead of rebasing it.
            if [ -f "../patches/runner-sdk8-$arch.patch" ] && \
               [ "$(tail -n 1 "../patches/runner-sdk8-$arch.patch")" = "# From upstream release: ${{ steps.get-tags.outputs.LATEST_TAG }}" ]; then
              git checkout ${{ steps.get-tags.outputs.LATEST_TAG }}
              if ! git apply --check --whitespace=nowarn "../patches/runner-sdk8-$arch.patch"; then
                echo "::error::Patch for $arch is marked as regenerated for ${{ steps.get-tags.outputs.LATEST_TAG }} but does not apply cleanly to it"
                cd ..
                exit 1
              fi
              echo "Patch for $arch already regenerated for ${{ steps.get-tags.outputs.LATEST_TAG }} - skipping rebase"
              cd ..
              echo "$arch" >> successful_arches.txt
              continue
            fi

            # Check if previous patch exists
            if [ ! -f "../patches/runner-sdk8-$arch.patch" ] || \
               ! grep -q "${{ steps.get-tags.outputs.PREVIOUS_TAG }}" "../patches/runner-sdk8-$arch.patch"; then
              echo "::error::No valid previous patch for $arch — patch file missing or does not reference ${{ steps.get-tags.outputs.PREVIOUS_TAG }}"
              cd ..
              exit 1
            fi

            # Apply previous patch to previous release
            git checkout ${{ steps.get-tags.outputs.PREVIOUS_TAG }}
            if ! git apply --check --whitespace=nowarn "../patches/runner-sdk8-$arch.patch"; then
              echo "::error::Previous patch application failed for $arch — patch does not apply cleanly to ${{ steps.get-tags.outputs.PREVIOUS_TAG }}"
              cd ..
              exit 1
            fi
            git apply --whitespace=nowarn "../patches/runner-sdk8-$arch.patch"
            
            # Stash changes
            git stash push -m "patch-$arch"
            
            # Apply to latest release
            git checkout ${{ steps.get-tags.outputs.LATEST_TAG }}
            if ! git stash apply stash^{/patch-$arch}; then
              echo "::error::Stash application failed for $arch on ${{ steps.get-tags.outputs.LATEST_TAG }} — patch conflicts with upstream changes; manual regeneration required"
              git reset --hard
              git stash drop || true
              cd ..
              exit 1
            fi
            
            # Create new patch
            git diff --patch --ignore-space-at-eol > "../patches/runner-sdk8-$arch.patch"
            echo "# From upstream release: ${{ steps.get-tags.outputs.LATEST_TAG }}" >> "../patches/runner-sdk8-$arch.patch"
            
            # Cleanup
            git reset --hard
            git stash drop || true
            cd ..
            
            echo "$arch" >> successful_arches.txt
          done

          # Set output for successful architectures
          if [ -s successful_arches.txt ]; then
            echo "successful_arches=$(paste -sd, successful_arches.txt)" >> $GITHUB_OUTPUT
          fi

      - name: Update tag reference
        if: steps.process-arches.outputs.successful_arches != ''
        run: |
          echo "${{ steps.get-tags.outputs.LATEST_TAG }}" > patches/last_processed_tag.txt

      # Only commit the patches for release patch sync
      - name: Prepare repo for PR
        if: steps.process-arches.outputs.successful_arches != ''
        run: |
          rm -f successful_arches.txt

      - name: Import and configure the GPG key for Platform Engineering bot
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.PE_BOT_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PE_BOT_GPG_PASSPHRASE }}
          git_config_global: true
          git_user_signingkey: true
          git_commit_gpgsign: true

      - name: Create pull request to main
        uses: peter-evans/create-pull-request@v8
        if: steps.process-arches.outputs.successful_arches != ''
        with:
          # 2025-08-22: Using GitHub's Personal Access Token is required to allow automated workflow
          # triggers (on: pull_request) from Pull Requests issued by this workflow.
          token: ${{ secrets.PE_BOT_PAT }}
          commit-message: "Update release: ${{ steps.get-tags.outputs.PREVIOUS_TAG }} → ${{ steps.get-tags.outputs.LATEST_TAG }} [${{ steps.process-arches.outputs.successful_arches }}]"
          committer: Platform Engineering Bot <is-devops-team@canonical.com>
          author: Platform Engineering Bot <is-devops-team@canonical.com>
          branch: patch-sync/${{ steps.get-tags.outputs.LATEST_TAG }}
          title: Sync release patch ${{ steps.get-tags.outputs.LATEST_TAG }}
          body: Sync release branch patch for commit ${{ steps.get-tags.outputs.LATEST_TAG }}

      - name: Prepare repo for release
        run: |
          cd upstream-runner && git checkout ${{ steps.get-tags.outputs.LATEST_TAG }} && cd ..
          cp -r upstream-runner/* .
          rm -rf upstream-runner

      - name: Create release branch
        if: steps.process-arches.outputs.successful_arches != ''
        run: |
          git checkout -b releases/${{ steps.get-tags.outputs.LATEST_TAG }}
          git add . && git commit -m "Create release ${{ steps.get-tags.outputs.LATEST_TAG }}"
          git push -u origin releases/${{ steps.get-tags.outputs.LATEST_TAG }}

      - uses: mattermost/action-mattermost-notify@master
        if: ${{ failure() }}
        with:
          MATTERMOST_WEBHOOK_URL: ${{ secrets.MM_WEBHOOK_URL }}
          TEXT: |
            ${{ github.repository }} build failed.
            [Pipeline](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) was failed :red_circle:
            ${{ secrets.MM_PING_USERS }}
          MATTERMOST_USERNAME: ${{ github.triggering_actor }}
          MATTERMOST_ICON_URL: https://cdn-icons-png.flaticon.com/512/25/25231.png