security_content/.github/workflows/update-datasource-ta-versions.yml at 151e053e38d2d1379c4571bb313c4add3d909d67 · pyth0n1c/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: update datasource ta versions

on:
  workflow_dispatch:
  schedule:
    - cron: '0 * * * *'

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: update-datasource-ta-versions
  cancel-in-progress: false

jobs:
  update-datasource-ta-versions:
    runs-on: ubuntu-latest
    env:
      BASE_BRANCH: develop
      PR_TITLE: Available App Updates
      UPDATE_BRANCH: dependabot/datasource-ta-versions
      GH_TOKEN: ${{ secrets.DATA_SOURCES_DEPENDABOT || secrets.GITHUB_TOKEN }}

    steps:
      - name: Checkout develop
        uses: actions/checkout@v6
        with:
          ref: ${{ env.BASE_BRANCH }}
          fetch-depth: 0
          token: ${{ secrets.DATA_SOURCES_DEPENDABOT || secrets.GITHUB_TOKEN }}

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.14'

      - name: Install dependencies
        run: python -m pip install -r requirements.txt

      - name: Configure git author
        run: |
          git config user.name "datasource-ta-dependabot"
          git config user.email "datasource-ta-dependabot@users.noreply.github.com"

      - name: Check develop for available TA updates
        id: check_develop
        run: |
          set -euo pipefail

          python scripts/check_supported_ta_versions.py | tee "${RUNNER_TEMP}/ta-update-report.md"

          if git diff --quiet -- data_sources; then
            echo "has_updates=false" >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          echo "has_updates=true" >> "${GITHUB_OUTPUT}"

      - name: Find existing app update PR
        id: find_pr
        if: steps.check_develop.outputs.has_updates == 'true'
        run: |
          set -euo pipefail

          pr_json="$(
            gh pr list \
              --state open \
              --base "${BASE_BRANCH}" \
              --search "\"${PR_TITLE}\" in:title" \
              --json number,title,headRefName \
              --jq "map(select(.title == \"${PR_TITLE}\")) | first // {}"
          )"

          pr_number="$(jq -r '.number // empty' <<< "${pr_json}")"
          head_branch="$(jq -r '.headRefName // empty' <<< "${pr_json}")"

          echo "pr_number=${pr_number}" >> "${GITHUB_OUTPUT}"
          echo "head_branch=${head_branch}" >> "${GITHUB_OUTPUT}"

      - name: Create app update PR
        if: >-
          steps.check_develop.outputs.has_updates == 'true' &&
          steps.find_pr.outputs.pr_number == ''
        run: |
          set -euo pipefail

          git checkout -B "${UPDATE_BRANCH}"
          git add data_sources
          git commit -m "Update datasource TA versions"
          git push --force-with-lease origin "HEAD:${UPDATE_BRANCH}"

          gh pr create \
            --base "${BASE_BRANCH}" \
            --head "${UPDATE_BRANCH}" \
            --title "${PR_TITLE}" \
            --body-file "${RUNNER_TEMP}/ta-update-report.md"

      - name: Check existing PR for new updates
        id: diff_existing_pr
        if: >-
          steps.check_develop.outputs.has_updates == 'true' &&
          steps.find_pr.outputs.pr_number != ''
        run: |
          set -euo pipefail

          head_branch="${{ steps.find_pr.outputs.head_branch }}"
          git fetch origin "${head_branch}"

          if git diff --quiet "origin/${head_branch}" -- data_sources; then
            echo "has_new_updates=false" >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          echo "has_new_updates=true" >> "${GITHUB_OUTPUT}"

      - name: Commit new updates to existing PR
        if: steps.diff_existing_pr.outputs.has_new_updates == 'true'
        run: |
          set -euo pipefail

          pr_number="${{ steps.find_pr.outputs.pr_number }}"
          head_branch="${{ steps.find_pr.outputs.head_branch }}"

          git reset --hard
          git checkout -B "${head_branch}" "origin/${head_branch}"

          python scripts/check_supported_ta_versions.py

          if git diff --quiet -- data_sources; then
            echo "No new data source TA updates to commit."
            exit 0
          fi

          git add data_sources
          git commit -m "Update datasource TA versions"
          git push origin "HEAD:${head_branch}"

          gh pr edit "${pr_number}" --body-file "${RUNNER_TEMP}/ta-update-report.md"