rollout-actions-ref.yml

name: Rollout Actions Ref

# Repoints every consumer reference to this repository at a released commit SHA,
# annotated with the tag it came from:
#
#   uses: spring-cloud/spring-cloud-github-actions/.github/workflows/deploy.yml@<sha> # v1.0.0
#
# Targets every branch listed under branches.scheduled in config/projects.json.
# Retired branches are absent from that file and are left alone - their Locked
# Branches rulesets would reject a push anyway.
#
# Defaults to a dry run. Set dry_run to false to actually commit and push.
#
# Re-running this at an older release is the rollback path: consumers pin an
# immutable SHA, so they do not follow a moved tag.

on:
  # Weekly drift check. A scheduled run is always a dry run - it reports what has
  # drifted from the current release and posts to Google Chat, and never pushes.
  #
  # Paired entries hold the run at ~7:30am Eastern year-round, the same shape the
  # other scheduled workflows here use. Offset half an hour from
  # update-maven-wrapper's Monday slot so the two do not contend for runners.
  schedule:
    - cron: '30 11 * 3-10 1'      # ~7:30am EDT Monday, March-October
    - cron: '30 12 * 11,12,1,2 1' # ~7:30am EST Monday, November-February

  workflow_dispatch:
    inputs:
      projects:
        description: 'Comma-separated Spring Cloud project names (e.g. spring-cloud-build,spring-cloud-config). Empty means every project in projects.json.'
        required: false
        type: string
        default: ''
      repo_type:
        description: 'Update commercial, oss, or both?'
        required: false
        type: choice
        default: 'both'
        options:
          - both
          - oss
          - commercial
      to_ref:
        description: 'Tag to pin to. Empty means the latest published release.'
        required: false
        type: string
        default: ''
      dry_run:
        description: 'Dry run, if checked no changes will be committed, but you can see what would be updated'
        required: false
        type: boolean
        default: true
      notify:
        description: 'Post a summary of anything out of date to Google Chat.'
        required: false
        type: boolean
        default: false
      token:
        description: 'GitHub token with write access to all target repos. Falls back to GH_ACTIONS_REPO_TOKEN.'
        required: false
        type: string
        default: ''

permissions:
  contents: read

jobs:
  setup:
    name: Build Matrix
    runs-on: ubuntu-latest
    outputs:
      # A schedule event carries no inputs, so inputs.dry_run is null there. Passing
      # that through would reach the sync action as an empty string, which is not
      # "true" - and it would push to every branch. Force it instead.
      dry-run: ${{ github.event_name != 'workflow_dispatch' || inputs.dry_run }}
      matrix: ${{ steps.build-matrix.outputs.matrix }}
      count: ${{ steps.build-matrix.outputs.count }}
      tag: ${{ steps.resolve.outputs.tag }}
      sha: ${{ steps.resolve.outputs.sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve the ref to pin to
        id: resolve
        uses: ./.github/actions/resolve-actions-ref
        with:
          ref: ${{ inputs.to_ref }}
          token: ${{ inputs.token || secrets.GH_ACTIONS_REPO_TOKEN }}

      # Resolving to "main" means no release exists. Pinning consumers to a
      # branch is the thing this rollout exists to undo, so stop here rather
      # than quietly rewriting 79 branches back to a moving ref.
      - name: Require a released ref
        env:
          TAG: ${{ steps.resolve.outputs.tag }}
        run: |
          if [[ "$TAG" == "main" ]]; then
            echo "::error::No release found. Cut a release first, or pass an explicit to_ref."
            exit 1
          fi
          echo "Pinning to ${TAG} (${{ steps.resolve.outputs.sha }})."

      - name: Build matrix
        id: build-matrix
        env:
          PROJECTS_FILTER: ${{ inputs.projects }}
          REPO_TYPE: ${{ inputs.repo_type }}
          MATRIX_LIB: ${{ github.workspace }}/.github/scripts/project-branch-matrix.js
        run: |
          node - << 'JSEOF'
          const fs = require('fs');
          const { buildBranchMatrix } = require(process.env.MATRIX_LIB);

          const projects = JSON.parse(fs.readFileSync('config/projects.json', 'utf8'));

          // One matrix entry per (repo, branch). branches.scheduled is the set of
          // branches actively built, which is exactly the set worth migrating -
          // retired branches are removed from it by the retire-branch workflow.
          // `-internal` branches are kept (excludeInternal: false) and given their own
          // scope below rather than excluded: they are rebased from their OSS branch, so
          // ci.yml and pr.yml there are overwritten from OSS and must not be pinned here.
          // ci-release.yml is internal-only and survives the rebase, so it is the one file
          // the rollout owns on those branches - and the one file it must not touch
          // anywhere else.
          const { entries } = buildBranchMatrix(projects, {
            filter: process.env.PROJECTS_FILTER,
            repoType: process.env.REPO_TYPE,
            excludeInternal: false,
          });

          const include = entries.map(({ repo, branch, type }) => {
            const internal = branch.endsWith('-internal');
            return {
              repo, branch, type,
              scope: internal ? 'ci-release.yml only' : 'all but ci-release.yml',
              includeFiles: internal ? 'ci-release.yml' : '',
              excludeFiles: internal ? '' : 'ci-release.yml',
            };
          });

          console.log(`${include.length} (repo, branch) pairs:`);
          for (const e of include) console.log(`  ${e.repo}@${e.branch}  [${e.scope}]`);

          fs.appendFileSync(process.env.GITHUB_OUTPUT,
            `matrix=${JSON.stringify({ include })}\n` +
            `count=${include.length}\n`);
          JSEOF

  sync:
    name: "Sync — ${{ matrix.repo }}@${{ matrix.branch }}"
    needs: setup
    if: needs.setup.outputs.count != '0'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      max-parallel: 8
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # Avoid persisting this repository's GITHUB_TOKEN as a git
          # extraheader; it would override the credentials the sync action
          # uses when talking to the target repositories.
          persist-credentials: false

      - name: Sync actions ref
        id: sync
        uses: ./.github/actions/sync-actions-ref
        with:
          repository:    ${{ matrix.repo }}
          branch:        ${{ matrix.branch }}
          to-sha:        ${{ needs.setup.outputs.sha }}
          to-tag:        ${{ needs.setup.outputs.tag }}
          include-files: ${{ matrix.includeFiles }}
          exclude-files: ${{ matrix.excludeFiles }}
          dry-run:       ${{ needs.setup.outputs.dry-run }}
          token:         ${{ inputs.token || secrets.GH_ACTIONS_REPO_TOKEN }}

      - name: Record result
        if: always()
        id: record
        env:
          REPO: ${{ matrix.repo }}
          BRANCH: ${{ matrix.branch }}
          TYPE: ${{ matrix.type }}
          SCOPE: ${{ matrix.scope }}
          STATUS: ${{ steps.sync.outputs.status }}
          FILES: ${{ steps.sync.outputs.files }}
          OUTCOME: ${{ steps.sync.outcome }}
        run: |
          set -euo pipefail
          safe="${REPO//\//-}-${BRANCH//\//-}"
          echo "safe-name=${safe}" >> "$GITHUB_OUTPUT"
          jq -n \
            --arg repo "$REPO" \
            --arg branch "$BRANCH" \
            --arg type "$TYPE" \
            --arg scope "$SCOPE" \
            --arg status "${STATUS:-failed}" \
            --arg files "${FILES:-}" \
            --arg outcome "$OUTCOME" \
            '{repo: $repo, branch: $branch, type: $type, scope: $scope, status: $status, files: $files, outcome: $outcome}' \
            > "result-${safe}.json"

      - name: Upload result
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: result-${{ steps.record.outputs.safe-name }}
          path: result-${{ steps.record.outputs.safe-name }}.json

  summary:
    name: Summary
    needs: [setup, sync]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Download results
        uses: actions/download-artifact@v4
        with:
          pattern: result-*
          merge-multiple: true
          path: results

      - name: Write summary
        id: write-summary
        env:
          DRY_RUN: ${{ needs.setup.outputs.dry-run }}
          TAG: ${{ needs.setup.outputs.tag }}
          SHA: ${{ needs.setup.outputs.sha }}
        run: |
          node - << 'JSEOF'
          const fs = require('fs');

          let results = [];
          try {
            results = fs.readdirSync('results')
              .filter(f => f.endsWith('.json'))
              .map(f => JSON.parse(fs.readFileSync(`results/${f}`, 'utf8')))
              .sort((a, b) => a.repo.localeCompare(b.repo) || a.branch.localeCompare(b.branch));
          } catch (err) {
            console.log('No results to summarize.');
          }

          const dryRun = (process.env.DRY_RUN || 'false') === 'true';
          const icon = r => r.outcome !== 'success' ? '❌'
            : r.status === 'no-change' ? '➖'
            : r.status === 'skipped' ? '⏭️'
            : '✅';

          const lines = [];
          lines.push(dryRun ? '## Rollout summary (dry run — nothing pushed)' : '## Rollout summary');
          lines.push('');
          lines.push(`Pinning to \`${process.env.TAG}\` (\`${process.env.SHA}\`).`);
          lines.push('');
          // The files the sync step actually rewrote, rather than the scope it was
          // allowed to consider - a branch already on the current release has an
          // empty list, which is the honest answer to "what would be updated".
          const fileList = r => {
            const raw = (r.files || '').trim();
            if (!raw) return '—';
            return raw.split(/\s+/).filter(Boolean)
              .map(f => `\`${f.replace('.github/workflows/', '')}\``)
              .join(', ');
          };

          lines.push('| | Repository | Branch | Files | Result |');
          lines.push('|---|---|---|---|---|');
          for (const r of results) {
            lines.push(`| ${icon(r)} | \`${r.repo}\` | \`${r.branch}\` | ${fileList(r)} | ` +
              `${r.outcome !== 'success' ? 'failed' : r.status} |`);
          }
          lines.push('');

          const failed = results.filter(r => r.outcome !== 'success');
          const changed = results.filter(r => r.outcome === 'success' &&
            (r.status === 'updated' || r.status === 'would-update'));
          const unchanged = results.filter(r => r.status === 'no-change');
          const skipped = results.filter(r => r.status === 'skipped');

          lines.push(`**${results.length}** branches processed — ` +
            `**${changed.length}** ${dryRun ? 'would change' : 'changed'}, ` +
            `**${unchanged.length}** already up to date, ` +
            `**${skipped.length}** skipped, ` +
            `**${failed.length}** failed.`);

          if (failed.length) {
            lines.push('');
            lines.push('Failed: ' + failed.map(r => `\`${r.repo}@${r.branch}\``).join(', '));
          }

          fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, lines.join('\n') + '\n');
          console.log(lines.join('\n'));

          // Chat text, built only when something is actually out of date - a weekly
          // "nothing to do" ping trains people to ignore the channel.
          const drifted = results.filter(r => r.status === 'would-update');
          if (drifted.length || failed.length) {
            const chat = [];
            chat.push(`*spring-cloud-github-actions refs are out of date* — current release \`${process.env.TAG}\``);

            const section = (title, items, render, limit = 15) => {
              if (!items.length) return;
              chat.push('', `*${title}* (${items.length})`);
              for (const i of items.slice(0, limit)) chat.push(`• ${render(i)}`);
              if (items.length > limit) chat.push(`• …and ${items.length - limit} more`);
            };

            section('Out of date', drifted, r =>
              `${r.repo} — \`${r.branch}\` — ${(r.files || '').trim().split(/\s+/)
                .filter(Boolean).map(f => f.replace('.github/workflows/', '')).join(', ')}`);
            section('Failed to check', failed, r => `${r.repo} — \`${r.branch}\``);

            if (drifted.length) {
              chat.push('', 'Run *Rollout Actions Ref* with `dry_run` unchecked to update them.');
            }

            // Multiline GITHUB_OUTPUT values need the <<delimiter heredoc form.
            const delimiter = `ghadelim_${Date.now()}`;
            fs.appendFileSync(process.env.GITHUB_OUTPUT,
              `chat-text<<${delimiter}\n${chat.join('\n')}\n${delimiter}\n`);
          } else {
            console.log('Everything is on the current release - no Google Chat notification.');
          }

          if (failed.length) process.exit(1);
          JSEOF

      # Scheduled runs always notify; a manual run only when asked, so a dry run
      # you are watching in the UI does not also ping the channel.
      - name: Send Google Chat notification
        if: always() && (github.event_name == 'schedule' || inputs.notify)
        env:
          WEBHOOK_URL: ${{ secrets.SPRING_CLOUD_CORE_CI_GCHAT_WEBHOOK_URL }}
          CHAT_TEXT: ${{ steps.write-summary.outputs.chat-text }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail

          if [[ -z "${WEBHOOK_URL}" ]]; then
            echo "SPRING_CLOUD_CORE_CI_GCHAT_WEBHOOK_URL is not set - skipping Google Chat notification."
            exit 0
          fi

          if [[ -z "${CHAT_TEXT:-}" ]]; then
            echo "Nothing out of date - skipping Google Chat notification."
            exit 0
          fi

          TEXT=$(printf '%s\n\n<%s|View full report>' "$CHAT_TEXT" "$RUN_URL")

          jq -n --arg text "$TEXT" '{text: $text}' > chat-message.json

          curl --fail --silent --show-error \
            -X POST \
            -H 'Content-Type: application/json; charset=UTF-8' \
            -d @chat-message.json \
            "${WEBHOOK_URL}"