# The golangci-lint version lives in hack/golangci-lint.version, which Dependabot
# cannot parse. This bumps it and opens a PR.
#
# The new golangci-lint runs in its own job without credentials. Only the job that
# opens the PR can write.
#
# Events caused by GITHUB_TOKEN start no workflows, except workflow_dispatch. After
# every push to the PR branch the PR job therefore dispatches ci.yaml on that branch;
# the run attaches its checks to the PR head commit.
name: upstream-sync

on:
  schedule:
    - cron: "17 4 * * *"
  workflow_dispatch:

concurrency:
  group: upstream-sync-golangci-lint
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    outputs:
      changed: ${{ steps.detect.outputs.changed }}
      current: ${{ steps.detect.outputs.current }}
      latest: ${{ steps.detect.outputs.latest }}
      result: ${{ steps.lint.outcome }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - id: detect
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          current=$(cat hack/golangci-lint.version)
          latest=$(gh release view --repo golangci/golangci-lint --json tagName -q .tagName)
          [[ "${latest}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
          echo "current=${current}" >> "$GITHUB_OUTPUT"
          echo "latest=${latest}" >> "$GITHUB_OUTPUT"
          [ "${current}" = "${latest}" ] && echo "changed=false" >> "$GITHUB_OUTPUT" || echo "changed=true" >> "$GITHUB_OUTPUT"

      # A new release usually means new checks, so let the PR say whether we pass.
      - if: steps.detect.outputs.changed == 'true'
        id: lint
        continue-on-error: true
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: ${{ steps.detect.outputs.latest }}

  pull-request:
    needs: lint
    if: needs.lint.outputs.changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      actions: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - env:
          LATEST: ${{ needs.lint.outputs.latest }}
        run: echo "${LATEST}" > hack/golangci-lint.version

      - id: pr
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          branch: automation/golangci-lint-version-sync
          delete-branch: true
          commit-message: "Bump golangci-lint to ${{ needs.lint.outputs.latest }}"
          title: "Bump golangci-lint to ${{ needs.lint.outputs.latest }}"
          body: |
            Automated golangci-lint upstream sync.

            - Previous: `${{ needs.lint.outputs.current }}`
            - New: `${{ needs.lint.outputs.latest }}`

            Result of running the new version against the tree: `${{ needs.lint.outputs.result }}`.
            A failure here is expected when a release adds checks; the findings are in the
            job log of the run that opened this PR.

      # A push or a new PR starts no CI, so dispatch it. An unchanged branch gets a run
      # only when none exists for its head yet, which retries a lost dispatch.
      - if: steps.pr.outputs.pull-request-number != ''
        env:
          GH_TOKEN: ${{ github.token }}
          OPERATION: ${{ steps.pr.outputs.pull-request-operation }}
          SHA: ${{ steps.pr.outputs.pull-request-head-sha }}
          BRANCH: automation/golangci-lint-version-sync
        run: |
          set -euo pipefail
          if [ "${OPERATION}" = none ] && [ "$(gh run list --workflow ci.yaml --commit "${SHA}" --json databaseId -q length)" != 0 ]; then
            exit 0
          fi
          gh workflow run ci.yaml --ref "${BRANCH}"