update-dependencies.yaml

name: Update dependencies
on:
  schedule:
    - cron: '0 11 * * 2'
  workflow_dispatch:
    inputs:
      nerdctl_tag_override:
        type: string
        description: The tag of nerdctl full archive to update
        required: false

permissions:
  contents: read

jobs:
  update-deps:
    runs-on: ubuntu-latest

    permissions:
      # This is required for configure-aws-credentials to request an OIDC JWT ID token to access AWS resources later on.
      # More info: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
      id-token: write
      contents: write
      pull-requests: write

    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: ${{ secrets.ROLE }}
          role-session-name: dependency-upload-session
          aws-region: ${{ secrets.REGION }}

      - name: Update Lima bundle archive for Finch on macOS
        run: bash bin/update-lima-bundles.sh -d ${{ secrets.DEPENDENCY_BUCKET_NAME }}

      - name: Update base OS for Finch on macOS
        run: bash bin/update-os-image.sh -d ${{ secrets.DEPENDENCY_BUCKET_NAME }}

      - name: Update rootfs for Finch on Windows
        run: bash bin/update-rootfs.sh -d ${{ secrets.DEPENDENCY_BUCKET_NAME }}

      - name: create PR
        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
        with:
          # A Personal Access Token instead of the default `GITHUB_TOKEN` is required
          # to trigger the checks (e.g., e2e tests) on the created pull request.
          # More info: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#workarounds-to-trigger-further-workflow-runs
          # TODO: Use FINCH_BOT_TOKEN instead of GITHUB_TOKEN.
          token: ${{ secrets.GITHUB_TOKEN }}
          signoff: true
          title: 'build(deps): Bump finch dependencies'
          branch: create-pull-request/bump-finch-dependencies

  fetch-latest-nerdctl-tag:
    runs-on: ubuntu-latest

    outputs:
      tag: ${{ steps.fetch-tag.outputs.tag }}

    steps:
      - name: Checkout nerdctl
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: containerd/nerdctl
          fetch-depth: 0
          fetch-tags: true

      - name: Fetch tag for latest release
        id: fetch-tag
        run: |
          tag="$(git tag --sort=-version:refname | head -n 1)"
          echo "Latest tag is ${tag}"

          if [[ -n "${{ github.event.inputs.nerdctl_tag_override }}" ]]; then
            tag="${{ github.event.inputs.nerdctl_tag_override }}"
            echo "Override tag: ${tag}"
          fi

          echo "tag=${tag}" >> "$GITHUB_OUTPUT"

  update-container-runtime-full-archive:
    runs-on: ubuntu-latest
    needs: fetch-latest-nerdctl-tag

    permissions:
      contents: write
      pull-requests: write

    env:
      NERDCTL_TAG: ${{ needs.fetch-latest-nerdctl-tag.outputs.tag }}

    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Update container runtime dependencies
        run: bash bin/update-container-runtime-full-archive.sh -t "${{ env.NERDCTL_TAG }}"

      - name: Create PR
        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          signoff: true
          branch: create-pull-request/update-container-runtime-full-archive-${{ env.NERDCTL_TAG }}
          delete-branch: true
          title: 'build(deps): update container runtime full archive to nerdctl-${{ env.NERDCTL_TAG }}'
          add-paths: deps/container-runtime-full-archive.conf
          body: |
            Update the container runtime full archive to nerdctl ${{ env.NERDCTL_TAG }} for macOS and Window platforms.

            See https://github.com/containerd/nerdctl/releases/tag/${{ env.NERDCTL_TAG }} for more details.

            This PR created by [create-pull-request](https://github.com/peter-evans/create-pull-request) must be closed 
            and reopened manually to trigger automated checks.