mirror of
https://github.com/tailscale/tailscale.git
synced 2026-10-23 03:37:19 +09:00
Brad Fitzpatrick
63f625397b
The bumpdep workflow grew 170 lines of inline shell that duplicated
much of what misc/bumpdeps already did in Go (resolving versions,
special branches, running go get), and disagreed with it in small ways
(the workflow fetched wireguard-go with GOPROXY=direct; the tool asked
the proxy for the branch head). It was also untestable except by
extracting the run block and running it by hand.
Move all of that logic into misc/bumpdeps and make the workflow a thin
wrapper that runs it with -github. The tool now:
- accepts the workflow's argument forms: "go" for the toolchain (via
./pull-toolchain.sh), the "wireguard-go" and "gvisor" aliases,
exact module paths, "path@version", and modules not yet in go.mod,
alongside its existing substring filters; comma-separated arguments
are split, so the workflow input passes straight through;
- finds branch heads with git ls-remote and then asks the proxy for
the pseudo-version of that commit, so a just-pushed commit is seen
without ever cloning (GOPROXY=direct on github.com/gokrazy/kernel.*
hung the workflow for hours);
- refuses downgrades by diffing go.mod before and after go get,
rather than grepping go get's output;
- runs "make tidy" and "make updatedeps" itself (-tidy=false to skip);
- renders the PR title, body (GitHub compare links derived from the
module path, including subdirectory-tagged modules), and commit
message, printing a suggested commit message locally and, with
-github, writing step outputs and the step summary. -issue accepts
the issue URL or "#N" form and becomes the "Updates" line.
The branch name changes from a slug of every module path, which
produced names like actions/bumpdep/github.com-gokrazy-kernel.amd64-
main-github.com-gokrazy-kernel.arm64-main-github, to
actions/<workflow>/<actor>/<yyyymmdd-hhmmss> (no actor for scheduled
runs). Each run is a fresh PR; delete-branch cleans up after merge or
close.
The bumpdep workflow gains an optional exclude-newer-than-days input for
the cooldown. All of the formerly-inline logic now has unit tests,
including a fake module proxy.
Also add a gokrazy-bump workflow that runs the same tool every Sunday
night on the direct github.com/gokrazy/* modules (kernels, firmware,
gokrazy itself) and opens a PR labeled run-natlab-tests, so the natlab
VM tests boot the new kernels before merge. Substring filters now skip
indirect dependencies unless -indirect is set, so that "github.com/
gokrazy/" doesn't drag in gokapi; naming an indirect module exactly
still selects it.
Updates tailscale/corp#48312
Updates #8043
Updates #1866
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I7c3e91a4d2f58b0e6a1c9d47f3b2e8a5c6d0f1e2
75 lines
2.8 KiB
YAML
75 lines
2.8 KiB
YAML
name: gokrazy-bump
|
|
|
|
# Weekly bump of the gokrazy modules (kernels, firmware, gokrazy itself)
|
|
# that the natlab VM tests boot. The PR carries the run-natlab-tests
|
|
# label so natlab-test.yml exercises the new kernels before merge.
|
|
|
|
on:
|
|
schedule:
|
|
# Sunday night (Monday 05:17 UTC), off-the-hour to avoid GitHub's :00
|
|
# cron-stampede window.
|
|
- cron: "17 5 * * 1"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
gokrazy-bump:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
# The substring matches every direct github.com/gokrazy/* module.
|
|
# See misc/bumpdeps for what the tool does and the outputs it sets.
|
|
- name: Bump gokrazy modules
|
|
id: bump
|
|
run: ./tool/go run ./misc/bumpdeps -github -issue https://github.com/tailscale/tailscale/issues/1866 -- github.com/gokrazy/
|
|
|
|
- name: Show changes
|
|
run: git --no-pager diff --stat
|
|
|
|
- name: Get access token
|
|
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
|
|
id: generate-token
|
|
with:
|
|
# Get token for app: https://github.com/apps/tailscale-code-updater
|
|
app-id: ${{ secrets.CODE_UPDATER_APP_ID }}
|
|
private-key: ${{ secrets.CODE_UPDATER_APP_PRIVATE_KEY }}
|
|
# Limit the token to only pushing a branch and opening a pull request.
|
|
permission-contents: write
|
|
permission-pull-requests: write
|
|
|
|
# Nothing happens if go.mod didn't change: create-pull-request
|
|
# opens a PR only when there's a diff to commit.
|
|
- name: Send pull request
|
|
id: pull-request
|
|
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 #v8.1.0
|
|
with:
|
|
token: ${{ steps.generate-token.outputs.token }}
|
|
author: Dep Updater <noreply+dep-updater@tailscale.com>
|
|
committer: Dep Updater <noreply+dep-updater@tailscale.com>
|
|
branch: ${{ steps.bump.outputs.branch }}
|
|
commit-message: ${{ steps.bump.outputs.commit-message }}
|
|
title: ${{ steps.bump.outputs.title }}
|
|
body-path: ${{ steps.bump.outputs.body-path }}
|
|
labels: run-natlab-tests
|
|
signoff: true
|
|
delete-branch: true
|
|
# For scheduled runs this is whoever last edited this file.
|
|
reviewers: ${{ github.triggering_actor }}
|
|
|
|
- name: Summary
|
|
if: ${{ steps.pull-request.outputs.pull-request-number }}
|
|
env:
|
|
PR_OPERATION: ${{ steps.pull-request.outputs.pull-request-operation }}
|
|
PR_URL: ${{ steps.pull-request.outputs.pull-request-url }}
|
|
run: echo "$PR_OPERATION $PR_URL" >> "$GITHUB_STEP_SUMMARY"
|