action.yml

name: 'Dependency Updater'
description: 'Updates dependencies to the latest published tag and creates/updates PRs'
author: 'Sentry'

inputs:
  path:
    description: 'Dependency path in the source repository, this can be either a submodule, a .properties file, a shell script, or a CMake file with FetchContent.'
    required: true
  name:
    description: 'Name used in the PR title and the changelog entry.'
    required: true
  pattern:
    description: 'RegEx pattern that will be matched against available versions when picking the latest one.'
    required: false
    default: ''
  gh-title-pattern:
    description: 'RegEx pattern to match against GitHub release titles. Only releases with matching titles will be considered.'
    required: false
    default: ''
  changelog-entry:
    description: 'Whether to add a changelog entry for the update.'
    required: false
    default: 'true'
  changelog-section:
    description: 'Section header to attach the changelog entry to.'
    required: false
    default: 'Dependencies'
  pr-strategy:
    description: 'How to handle PRs - can be either "create" (create new PRs for each version) or "update" (keep single PR updated with latest version)'
    required: false
    default: 'update'
  target-branch:
    description: 'Branch to use as base for dependency updates. Defaults to repository default branch if not specified.'
    required: false
    default: ''
  api-token:
    description: 'Token for the repo. Can be passed in using {{ secrets.GITHUB_TOKEN }}. Not required if ssh-key is provided, but can be used together with ssh-key for GitHub API operations.'
    required: false
    default: ''
  ssh-key:
    description: 'SSH private key for repository authentication. Can be used alone or together with api-token (SSH for git, token for GitHub API).'
    required: false
    default: ''
  post-update-script:
    description: 'Optional script to run after successful dependency update. Can be a bash script (.sh) or PowerShell script (.ps1). The script will be executed in the caller-repo directory before PR creation.'
    required: false
    default: ''

outputs:
  prUrl:
    description: 'The created/updated PRs url.'
    value: ${{ steps.pr.outputs.url }}
  baseBranch:
    description: 'The base branch name.'
    value: ${{ steps.root.outputs.baseBranch }}
  prBranch:
    description: 'The created/updated pr branch name.'
    value: ${{ steps.root.outputs.prBranch }}
  originalTag:
    description: 'The original tag from which the dependency was updated from.'
    value: ${{ steps.target.outputs.originalTag }}
  latestTag:
    description: 'The latest tag to which the dependency was updated to.'
    value: ${{ steps.target.outputs.latestTag }}

runs:
  using: 'composite'
  steps:
    - name: Cancel Previous Runs
      uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # Tag: 0.12.1
      with:
        access_token: ${{ github.token }}

    - name: Validate dependency name
      shell: pwsh
      env:
        DEPENDENCY_NAME: ${{ inputs.name }}
      run: |
        # Validate that inputs.name contains only safe characters
        if ("$env:DEPENDENCY_NAME" -notmatch '^[a-zA-Z0-9_\./@\s-]+$') {
          Write-Output "::error::Invalid dependency name: '$env:DEPENDENCY_NAME'. Only alphanumeric characters, spaces, and _-./@  are allowed."
          exit 1
        }
        Write-Output "✓ Dependency name '$env:DEPENDENCY_NAME' is valid"

    - name: Validate dependency path
      shell: pwsh
      env:
        DEPENDENCY_PATH: ${{ inputs.path }}
      run: |
        # Validate that inputs.path contains only safe characters (including # for CMake dependencies)
        if ("$env:DEPENDENCY_PATH" -notmatch '^[a-zA-Z0-9_\./#-]+$') {
          Write-Output "::error::Invalid dependency path: '$env:DEPENDENCY_PATH'. Only alphanumeric characters and _-./#  are allowed."
          exit 1
        }
        Write-Output "✓ Dependency path '$env:DEPENDENCY_PATH' is valid"

    - name: Validate changelog-entry
      shell: pwsh
      env:
        CHANGELOG_ENTRY: ${{ inputs.changelog-entry }}
      run: |
        # Validate that inputs.changelog-entry is either 'true' or 'false'
        if ("$env:CHANGELOG_ENTRY" -notin @('true', 'false')) {
          Write-Output "::error::Invalid changelog-entry value: '$env:CHANGELOG_ENTRY'. Only 'true' or 'false' are allowed."
          exit 1
        }
        Write-Output "✓ Changelog-entry value '$env:CHANGELOG_ENTRY' is valid"

    - name: Validate pr-strategy
      shell: pwsh
      env:
        PR_STRATEGY: ${{ inputs.pr-strategy }}
      run: |
        # Validate that inputs.pr-strategy is either 'create' or 'update'
        if ("$env:PR_STRATEGY" -notin @('create', 'update')) {
          Write-Output "::error::Invalid pr-strategy value: '$env:PR_STRATEGY'. Only 'create' or 'update' are allowed."
          exit 1
        }
        Write-Output "✓ PR strategy value '$env:PR_STRATEGY' is valid"

    - name: Validate post-update-script
      if: ${{ inputs.post-update-script != '' }}
      shell: pwsh
      env:
        POST_UPDATE_SCRIPT: ${{ inputs.post-update-script }}
      run: |
        # Validate that inputs.post-update-script contains only safe characters
        if ("$env:POST_UPDATE_SCRIPT" -notmatch '^[a-zA-Z0-9_\./#\s-]+$') {
          Write-Output "::error::Invalid post-update-script path: '$env:POST_UPDATE_SCRIPT'. Only alphanumeric characters, spaces, and _-./#  are allowed."
          exit 1
        }
        Write-Output "✓ Post-update script path '$env:POST_UPDATE_SCRIPT' is valid"

    - name: Validate authentication inputs
      shell: pwsh
      env:
        GH_TOKEN: ${{ inputs.api-token || github.token }}
        SSH_KEY: ${{ inputs.ssh-key }}
      run: |
        $hasToken = -not [string]::IsNullOrEmpty($env:GH_TOKEN)
        $hasSshKey = -not [string]::IsNullOrEmpty($env:SSH_KEY)

        if (-not $hasToken -and -not $hasSshKey) {
          Write-Output "::error::Either api-token or ssh-key must be provided for authentication."
          exit 1
        }

        if ($hasToken -and $hasSshKey) {
          Write-Output "✓ Using both SSH key (for git) and token (for GitHub API)"
        } elseif ($hasToken) {
          Write-Output "✓ Using token authentication"
        } else {
          Write-Output "✓ Using SSH key authentication"
        }

    - name: Validate API token
      if: ${{ inputs.api-token != '' }}
      shell: pwsh
      env:
        GH_TOKEN: ${{ inputs.api-token || github.token }}
      run: |
        # Check if token is actually an SSH key
        if ($env:GH_TOKEN -match '-----BEGIN') {
          Write-Output "::error::The api-token input appears to contain an SSH private key."
          Write-Output "::error::Please use the ssh-key input for SSH authentication instead of api-token."
          exit 1
        }

        # Check for whitespace
        if ($env:GH_TOKEN -match '\s') {
          $tokenLength = $env:GH_TOKEN.Length
          $whitespaceMatch = [regex]::Match($env:GH_TOKEN, '\s')
          $position = $whitespaceMatch.Index
          $char = $whitespaceMatch.Value
          $charName = switch ($char) {
            "`n" { "newline (LF)" }
            "`r" { "carriage return (CR)" }
            "`t" { "tab" }
            " " { "space" }
            default { "whitespace character (code: $([int][char]$char))" }
          }
          Write-Output "::error::GitHub token contains whitespace at position $position of $tokenLength characters: $charName"
          Write-Output "::error::This suggests the token secret may be malformed. Check for extra newlines when setting the secret."
          exit 1
        }

        # Check token scopes (works for classic PATs only)
        $headers = curl -sS -I -H "Authorization: token $env:GH_TOKEN" https://api.github.com 2>&1
        $scopeLine = $headers | Select-String -Pattern '^x-oauth-scopes:' -CaseSensitive:$false
        if ($scopeLine) {
          $scopes = $scopeLine -replace '^x-oauth-scopes:\s*', '' -replace '\r', ''
          if ([string]::IsNullOrWhiteSpace($scopes)) {
            Write-Output "::warning::Token has no scopes. If using a fine-grained PAT, ensure it has Contents (write) and Pull Requests (write) permissions."
          } else {
            Write-Output "Token scopes: $scopes"
            if ($scopes -notmatch '\brepo\b' -and $scopes -notmatch '\bpublic_repo\b') {
              Write-Output "::warning::Token may be missing 'repo' or 'public_repo' scope. This may cause issues with private repositories."
            }
          }
        } else {
          Write-Output "::notice::Could not detect token scopes (this is normal for fine-grained PATs). Ensure token has Contents (write) and Pull Requests (write) permissions."
        }

        # Check token validity and access
        gh api repos/${{ github.repository }} --silent 2>&1 | Out-Null
        if ($LASTEXITCODE -ne 0) {
          Write-Output "::error::GitHub token validation failed. Please verify:"
          Write-Output "  1. Token is not empty or malformed"
          Write-Output "  2. Token has not expired"
          Write-Output "  3. Token has an expiration date set"
          Write-Output "  4. Token has 'repo' and 'workflow' scopes"
          exit 1
        }

        Write-Output "✓ GitHub token is valid and has access to this repository"

    - name: Validate SSH key
      if: ${{ inputs.ssh-key != '' }}
      shell: pwsh
      env:
        SSH_KEY: ${{ inputs.ssh-key }}
      run: |
        # Check if SSH key looks valid
        if ($env:SSH_KEY -notmatch '-----BEGIN') {
          Write-Output "::warning::SSH key does not appear to start with a PEM header (-----BEGIN). Please verify the key format."
        }

        # Check for common SSH key types
        $validKeyTypes = @('RSA', 'OPENSSH', 'DSA', 'EC', 'PRIVATE KEY')
        $hasValidType = $false
        foreach ($type in $validKeyTypes) {
          if ($env:SSH_KEY -match "-----BEGIN.*$type") {
            $hasValidType = $true
            break
          }
        }

        if (-not $hasValidType) {
          Write-Output "::warning::SSH key type not recognized. Supported types: RSA, OPENSSH, DSA, EC, PRIVATE KEY"
        }

        Write-Output "✓ SSH key format appears valid"

    # What we need to accomplish:
    # * update to the latest tag
    # * create a PR
    # * update changelog (including the link to the just created PR)
    #
    # What we actually do is based on whether a PR exists already:
    # * YES it does:
    #    * make the update
    #    * update changelog (with the ID of an existing PR)
    #    * push to the PR
    # * NO it doesn't:
    #    * make the update
    #    * push to a new PR
    #    * update changelog (with the ID of the just created PR)
    #    * push to the PR
    # We do different approach on subsequent runs because otherwise we would spam users' mailboxes
    # with notifications about pushes to existing PRs. This way there is actually no push if not needed.
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        token: ${{ inputs.api-token || github.token }}
        ssh-key: ${{ inputs.ssh-key }}
        ref: ${{ inputs.target-branch || github.ref }}
        path: caller-repo

    - name: Update to the latest version
      id: target
      shell: pwsh
      working-directory: caller-repo
      env:
        DEPENDENCY_PATH: ${{ inputs.path }}
        DEPENDENCY_PATTERN: ${{ inputs.pattern }}
        GH_TITLE_PATTERN: ${{ inputs.gh-title-pattern }}
        POST_UPDATE_SCRIPT: ${{ inputs.post-update-script }}
        GH_TOKEN: ${{ inputs.api-token || github.token }}
      run: ${{ github.action_path }}/scripts/update-dependency.ps1 -Path $env:DEPENDENCY_PATH -Pattern $env:DEPENDENCY_PATTERN -GhTitlePattern $env:GH_TITLE_PATTERN -PostUpdateScript $env:POST_UPDATE_SCRIPT

    - name: Get the base repo info
      if: steps.target.outputs.latestTag != steps.target.outputs.originalTag
      id: root
      shell: pwsh
      working-directory: caller-repo
      env:
        PR_STRATEGY: ${{ inputs.pr-strategy }}
        DEPENDENCY_PATH: ${{ inputs.path }}
        TARGET_BRANCH: ${{ inputs.target-branch }}
      run: |
        if ([string]::IsNullOrEmpty($env:TARGET_BRANCH)) {
            $mainBranch = $(git remote show origin | Select-String "HEAD branch: (.*)").Matches[0].Groups[1].Value
            $prBranchPrefix = ''
        } else {
            $mainBranch = $env:TARGET_BRANCH
            $prBranchPrefix = "$mainBranch-"
        }
        $prBranch = switch ($env:PR_STRATEGY)
        {
            'create' { "deps/$env:DEPENDENCY_PATH/${{ steps.target.outputs.latestTag }}" }
            'update' { "deps/$env:DEPENDENCY_PATH" }
            default { throw "Unkown PR strategy '$env:PR_STRATEGY'." }
        }
        $prBranch = $prBranchPrefix + $prBranch
        "baseBranch=$mainBranch" | Tee-Object $env:GITHUB_OUTPUT -Append
        "prBranch=$prBranch" | Tee-Object $env:GITHUB_OUTPUT -Append
        $nonBotCommits = ${{ github.action_path }}/scripts/nonbot-commits.ps1 `
          -RepoUrl "$(git config --get remote.origin.url)" -PrBranch $prBranch -MainBranch $mainBranch
        $changed = $nonBotCommits.Length -gt 0 ? 'true' : 'false'
        "changed=$changed" | Tee-Object $env:GITHUB_OUTPUT -Append
        if ("$changed" -eq "true")
        {
            Write-Output "::warning::Target branch '$prBranch' has been changed manually - skipping updater to avoid overwriting these changes."
        }

    - name: Parse the existing PR URL
      if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
      id: existing-pr
      shell: pwsh
      working-directory: caller-repo
      env:
        GH_TOKEN: ${{ inputs.api-token || github.token }}
      run: |
        $urls = @(gh api 'repos/${{ github.repository }}/pulls?base=${{ steps.root.outputs.baseBranch }}&head=${{ github.repository_owner }}:${{ steps.root.outputs.prBranch }}' --jq '.[].html_url')
        if ($urls.Length -eq 0)
        {
            "url=" | Tee-Object $env:GITHUB_OUTPUT -Append
        }
        elseif ($urls.Length -eq 1)
        {
            "url=$($urls[0])" | Tee-Object $env:GITHUB_OUTPUT -Append
        }
        else
        {
            throw "Unexpected number of PRs matched ($($urls.Length)): $urls"
        }

    - name: Show git diff
      if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
      shell: bash
      working-directory: caller-repo
      run: git --no-pager diff

    - name: Get target changelog
      if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
      shell: pwsh
      working-directory: caller-repo
      env:
        GH_TOKEN: ${{ inputs.api-token || github.token }}
      run: |
        $changelog = ${{ github.action_path }}/scripts/get-changelog.ps1 `
          -RepoUrl '${{ steps.target.outputs.url }}' `
          -OldTag '${{ steps.target.outputs.originalTag }}' `
          -NewTag '${{ steps.target.outputs.latestTag }}'
        ${{ github.action_path }}/scripts/set-github-env.ps1 TARGET_CHANGELOG $changelog

    # First we create a PR only if it doesn't exist. We will later overwrite the content with the same action.
    - name: Create a PR
      if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
      uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc # pin#v6.0.1
      id: create-pr
      env:
        DEPENDENCY_PATH: ${{ inputs.path }}
        DEPENDENCY_NAME: ${{ inputs.name }}
      with:
        path: caller-repo
        base: ${{ steps.root.outputs.baseBranch }}
        branch: ${{ steps.root.outputs.prBranch }}
        commit-message: 'chore: update ${{ env.DEPENDENCY_PATH }} to ${{ steps.target.outputs.latestTag }}'
        author: 'GitHub <noreply@github.com>'
        title: 'chore(deps): update ${{ env.DEPENDENCY_NAME }} to ${{ steps.target.outputs.latestTagNice }}'
        body: |
          Bumps ${{ env.DEPENDENCY_PATH }} from ${{ steps.target.outputs.originalTag }} to ${{ steps.target.outputs.latestTag }}.

          Auto-generated by a [dependency updater](https://github.com/getsentry/github-workflows/blob/main/updater/action.yml).
          ${{ env.TARGET_CHANGELOG }}
        labels: dependencies

    - name: Verify we have a PR
      if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
      id: pr
      shell: pwsh
      working-directory: caller-repo
      run: |
        if ('${{ steps.create-pr.outputs.pull-request-url }}' -ne '')
        {
            "url=${{ steps.create-pr.outputs.pull-request-url }}" | Tee-Object $env:GITHUB_OUTPUT -Append
        }
        elseif ('${{ steps.existing-pr.outputs.url }}' -ne '')
        {
            "url=${{ steps.existing-pr.outputs.url }}" | Tee-Object $env:GITHUB_OUTPUT -Append
        }
        else
        {
            throw "PR hasn't been created"
        }

    # If we had to create a new PR, we must do a clean checkout & update the submodule again.
    # If we didn't do this, the new PR would only have a changelog...
    - name: 'After new PR: restore repo'
      if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
      uses: actions/checkout@v4
      with:
        token: ${{ inputs.api-token || github.token }}
        ssh-key: ${{ inputs.ssh-key }}
        ref: ${{ inputs.target-branch || github.ref }}
        path: caller-repo

    - name: 'After new PR: redo the update'
      if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.existing-pr.outputs.url == '') && ( steps.root.outputs.changed == 'false') }}
      shell: pwsh
      working-directory: caller-repo
      env:
        DEPENDENCY_PATH: ${{ inputs.path }}
        POST_UPDATE_SCRIPT: ${{ inputs.post-update-script }}
        GH_TOKEN: ${{ inputs.api-token || github.token }}
      run: ${{ github.action_path }}/scripts/update-dependency.ps1 -Path $env:DEPENDENCY_PATH -Tag '${{ steps.target.outputs.latestTag }}' -OriginalTag '${{ steps.target.outputs.originalTag }}' -PostUpdateScript $env:POST_UPDATE_SCRIPT

    - name: Update Changelog
      if: ${{ inputs.changelog-entry == 'true' && ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
      shell: pwsh
      working-directory: caller-repo
      env:
        DEPENDENCY_NAME: ${{ inputs.name }}
        CHANGELOG_SECTION: ${{ inputs.changelog-section }}
        GH_TOKEN: ${{ inputs.api-token || github.token }}
      run: |
        ${{ github.action_path }}/scripts/update-changelog.ps1 `
          -Name $env:DEPENDENCY_NAME `
          -PR '${{ steps.pr.outputs.url }}' `
          -RepoUrl '${{ steps.target.outputs.url }}' `
          -MainBranch '${{ steps.target.outputs.mainBranch }}' `
          -OldTag '${{ steps.target.outputs.originalTag }}' `
          -NewTag '${{ steps.target.outputs.latestTag }}' `
          -Section $env:CHANGELOG_SECTION

    - name: Show final git diff
      if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
      shell: bash
      working-directory: caller-repo
      run: git --no-pager diff

    # Now make the PR in its final state. This way we only have one commit and no updates if there are no changes between runs.
    - name: Update the PR
      if: ${{ ( steps.target.outputs.latestTag != steps.target.outputs.originalTag ) && ( steps.root.outputs.changed == 'false') }}
      uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc # pin#v6.0.1
      id: update
      env:
        DEPENDENCY_PATH: ${{ inputs.path }}
        DEPENDENCY_NAME: ${{ inputs.name }}
      with:
        path: caller-repo
        base: ${{ steps.root.outputs.baseBranch }}
        branch: ${{ steps.root.outputs.prBranch }}
        commit-message: 'chore: update ${{ env.DEPENDENCY_PATH }} to ${{ steps.target.outputs.latestTag }}'
        author: 'GitHub <noreply@github.com>'
        title: 'chore(deps): update ${{ env.DEPENDENCY_NAME }} to ${{ steps.target.outputs.latestTagNice }}'
        body: |
          Bumps ${{ env.DEPENDENCY_PATH }} from ${{ steps.target.outputs.originalTag }} to ${{ steps.target.outputs.latestTag }}.

          Auto-generated by a [dependency updater](https://github.com/getsentry/github-workflows/blob/main/updater/action.yml).
          ${{ env.TARGET_CHANGELOG }}
        labels: dependencies