synchronize-dependabot-branch.yaml

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: Synchronize Dependabot Branch

on:
  workflow_run:
    workflows: ["Camel Quarkus CI"]
    types:
      - completed

jobs:
  update:
    runs-on: ubuntu-latest
    outputs:
      branch-ref: ${{ steps.setup-dependabot-patches.outputs.branch-ref }}
      pr-number: ${{ steps.setup-dependabot-patches.outputs.pr-number }}
      pr-updated: ${{ steps.push-changes.outputs.updated }}
    if: github.repository == 'apache/camel-quarkus' && github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' && github.actor == 'dependabot[bot]'
    steps:
      - name: Download dependabot pull request changes
        id: download-pr-changes
        uses: actions/github-script@v7
        with:
          result-encoding: string
          script: |
            const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id }},
            });
            
            const matchArtifact = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "dependabot-pr-changeset"
            })[0];

            if (matchArtifact !== undefined) {
              const download = await github.rest.actions.downloadArtifact({
                owner: context.repo.owner,
                repo: context.repo.repo,
                artifact_id: matchArtifact.id,
                archive_format: 'zip',
              });

              const fs = require('fs');
              fs.writeFileSync('/home/runner/work/dependabot-pr.zip', Buffer.from(download.data));
              return true;
            }

            return false;
      - name: Set up dependabot patches
        id: setup-dependabot-patches
        if: steps.download-pr-changes.outputs.result == 'true'
        run: |
          if [[ -f /home/runner/work/dependabot-pr.zip ]]; then
            mkdir -p /home/runner/work/dependabot-pr
            unzip -o /home/runner/work/dependabot-pr.zip -d /home/runner/work/dependabot-pr

            echo "branch-ref=$(cat /home/runner/work/dependabot-pr/BRANCH_REF)" >> $GITHUB_OUTPUT
            echo "pr-number=$(cat /home/runner/work/dependabot-pr/PR_NUMBER)" >> $GITHUB_OUTPUT
          fi
      - name: Checkout dependabot branch
        uses: actions/checkout@v4
        if: steps.setup-dependabot-patches.outputs.branch-ref != ''
        with:
          ref: ${{ steps.setup-dependabot-patches.outputs.branch-ref }}
          fetch-depth: 0
      - name: Push changes to dependabot/maven branch
        id: push-changes
        if: steps.setup-dependabot-patches.outputs.branch-ref != ''
        run: |
          git config --local user.email "49699333+dependabot[bot]@users.noreply.github.com"
          git config --local user.name "dependabot[bot]"

          CHANGES_PATH=/home/runner/work/dependabot-pr/changes.patch
          if [[ -f "${CHANGES_PATH}" ]]; then
            COMMIT_MESSAGE="Auto generated changes for dependabot commit $(git log -1 --pretty=%H)"

            git apply ${CHANGES_PATH}
            git commit -am"${COMMIT_MESSAGE}"
            git push origin ${BRANCH_REF}

            echo "updated=true" >> $GITHUB_OUTPUT
          else
            echo "updated=false" >> $GITHUB_OUTPUT
          fi

  rerun-pr-workflow:
    needs: update
    runs-on: ubuntu-latest
    if: needs.update.outputs.pr-updated == 'true'
    permissions:
      actions: write
      pull-requests: write
    steps:
      - name: Trigger dependabot pull request workflow
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.actions.reRunWorkflow({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: ${{ github.event.workflow_run.id }},
            });

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: ${{ needs.update.outputs.pr-number }},
              body: ":warning: :warning: :warning:\n\nBranch auto synchronized due to changes in generated files. New workflow run triggered:\n\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}\n\nPlease check the workflow result before merging.\n\n:warning: :warning: :warning:"
            });