From 2b5406516f3fd299d2a48e611266391a88ebc758 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kirill=20M=C3=BCller?= <kirill@cynkra.com>
Date: Fri, 16 Aug 2024 19:54:50 +0000
Subject: [PATCH] ci: Import from actions-sync, check carefully

---
 .github/workflows/R-CMD-check-dev.yaml        |  4 +-
 .github/workflows/R-CMD-check.yaml            | 22 +++++++-
 .github/workflows/commit/action.yml           | 50 +++++++++++++----
 .../workflows/dep-matrix-suggests/action.yml  | 56 -------------------
 .../dep-suggests-matrix-read/action.yml       | 24 ++++++++
 .../workflows/dep-suggests-matrix/action.R    | 47 ++++++++++++++++
 .../workflows/dep-suggests-matrix/action.yml  | 13 +++++
 .github/workflows/revdep.yaml                 |  2 +-
 .github/workflows/update-status/action.yml    | 19 ++++---
 9 files changed, 157 insertions(+), 80 deletions(-)
 delete mode 100644 .github/workflows/dep-matrix-suggests/action.yml
 create mode 100644 .github/workflows/dep-suggests-matrix-read/action.yml
 create mode 100644 .github/workflows/dep-suggests-matrix/action.R
 create mode 100644 .github/workflows/dep-suggests-matrix/action.yml

diff --git a/.github/workflows/R-CMD-check-dev.yaml b/.github/workflows/R-CMD-check-dev.yaml
index 9b00903cf..700486fc2 100644
--- a/.github/workflows/R-CMD-check-dev.yaml
+++ b/.github/workflows/R-CMD-check-dev.yaml
@@ -101,7 +101,7 @@ jobs:
 
     runs-on: ubuntu-22.04
 
-    name: ${{ matrix.package }}
+    name: 'rcc-dev: ${{ matrix.package }}'
 
     # Begin custom: services
     # End custom: services
@@ -147,4 +147,4 @@ jobs:
 
       - uses: ./.github/workflows/check
         with:
-          results: ${{ matrix.package }}
\ No newline at end of file
+          results: ${{ matrix.package }}
diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 1102fc602..5c685f598 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -13,11 +13,20 @@ on:
     branches:
       - main
       - master
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Branch or tag to check out"
+        required: false
+        default: "main"
+  merge_group:
+    types:
+      - checks_requested
   schedule:
     - cron: "10 0 * * *"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.sha }}-${{ github.base_ref || '' }}
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.ref || github.head_ref || github.sha }}-${{ github.base_ref || '' }}
   cancel-in-progress: true
 
 name: rcc
@@ -35,6 +44,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       - uses: ./.github/workflows/rate-limit
         with:
@@ -59,6 +70,9 @@ jobs:
       - uses: ./.github/workflows/versions-matrix
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
 
+      - uses: ./.github/workflows/dep-suggests-matrix
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+
       - uses: ./.github/workflows/update-snapshots
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
 
@@ -71,6 +85,8 @@ jobs:
       - id: commit
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         uses: ./.github/workflows/commit
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: ./.github/workflows/check
         with:
@@ -151,7 +167,7 @@ jobs:
 
     runs-on: ${{ matrix.os }}
 
-    name: ${{ matrix.os }} (${{ matrix.r }}) ${{ matrix.desc }}
+    name: 'rcc: ${{ matrix.os }} (${{ matrix.r }}) ${{ matrix.desc }}'
 
     # Begin custom: services
     # End custom: services
@@ -212,7 +228,7 @@ jobs:
           use-public-rspm: true
 
       - id: set-matrix
-        uses: ./.github/workflows/dep-matrix-suggests
+        uses: ./.github/workflows/dep-suggests-matrix-read
 
   check-suggests-matrix:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/commit/action.yml b/.github/workflows/commit/action.yml
index bd375d3dd..d5049bc56 100644
--- a/.github/workflows/commit/action.yml
+++ b/.github/workflows/commit/action.yml
@@ -1,4 +1,8 @@
 name: "Action to commit changes to the repository"
+inputs:
+  token:
+    description: "GitHub token"
+    required: true
 outputs:
   sha:
     description: "SHA of generated commit"
@@ -7,23 +11,47 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Commit if changed
+    - name: Commit if changed, create a PR if protected
       id: commit
+      env:
+        GITHUB_TOKEN: ${{ inputs.token }}
       run: |
         set -x
         if [ -n "$(git status --porcelain)" ]; then
           echo "Changed"
-          git fetch
-          if [ -n "${GITHUB_HEAD_REF}" ]; then
+          protected=${{ github.ref_protected }}
+          if [ "${protected}" = "true" ]; then
+            current_branch=$(git branch --show-current)
+            new_branch=gha-commit
+            git checkout -b ${new_branch}
             git add .
-            git stash save
-            git switch ${GITHUB_HEAD_REF}
-            git merge origin/${GITHUB_BASE_REF} --no-edit
-            git stash pop
+            git commit -m "chore: Auto-update from GitHub Actions"$'\n'$'\n'"Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+            # Force-push, used in only one place
+            # Alternative: separate branch names for each usage
+            git push -u origin HEAD -f
+
+            existing_pr=$(gh pr list --state open --base main --head ${new_branch} --json number --jq '.[] | .number')
+            if [ -n "${existing_pr}" ]; then
+              echo "Existing PR: ${existing_pr}"
+            else
+              gh pr create --base main --head ${new_branch} --title "chore: Auto-update from GitHub Actions" --body "Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+            fi
+
+            gh workflow run rcc -f ref=$(git rev-parse HEAD)
+          else
+            git fetch
+            if [ -n "${GITHUB_HEAD_REF}" ]; then
+              git add .
+              git stash save
+              git switch ${GITHUB_HEAD_REF}
+              git merge origin/${GITHUB_BASE_REF} --no-edit
+              git stash pop
+            fi
+            git add .
+            git commit -m "chore: Auto-update from GitHub Actions"$'\n'$'\n'"Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+            git push -u origin HEAD
           fi
-          git add .
-          git commit -m "chore: Auto-update from GitHub Actions"$'\n'$'\n'"Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-          git push -u origin HEAD
-          echo sha=$(git rev-parse HEAD) >> $GITHUB_OUTPUT
         fi
+        # Unconditionally set the output because it could come from a manually triggered run
+        echo sha=$(git rev-parse HEAD) >> $GITHUB_OUTPUT
       shell: bash
diff --git a/.github/workflows/dep-matrix-suggests/action.yml b/.github/workflows/dep-matrix-suggests/action.yml
deleted file mode 100644
index deafab932..000000000
--- a/.github/workflows/dep-matrix-suggests/action.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: "Actions to compute a matrix with all suggested packages"
-outputs:
-  matrix:
-    description: "Generated matrix"
-    value: ${{ steps.set-matrix.outputs.matrix }}
-
-runs:
-  using: "composite"
-  steps:
-    - id: set-matrix
-      run: |
-        get_deps <- function() {
-          # Determine package dependencies
-          if (!requireNamespace("desc", quietly = TRUE)) {
-            install.packages("desc")
-          }
-
-          deps_df <- desc::desc_get_deps()
-          deps_df_optional <- deps_df$package[deps_df$type %in% c("Suggests", "Enhances")]
-          deps_df_hard <- deps_df$package[deps_df$type %in% c("Depends", "Imports", "LinkingTo")]
-
-          packages <- sort(deps_df_optional)
-          packages <- intersect(packages, rownames(available.packages()))
-
-          # Too big to fail, or can't be avoided:
-          off_limits <- c("testthat", "rmarkdown", "rcmdcheck", deps_df_hard)
-          off_limits_dep <- unlist(tools::package_dependencies(off_limits, recursive = TRUE, which = "strong"))
-          setdiff(packages, c(off_limits, off_limits_dep))
-        }
-
-        if (Sys.getenv("GITHUB_BASE_REF") != "") {
-          print(Sys.getenv("GITHUB_BASE_REF"))
-          has_diff <- (system("git diff ${{ github.event.pull_request.base.sha }}... | egrep '^[+][^+]' | grep -q ::") == 0)
-          if (has_diff) {
-            system("git diff ${{ github.event.pull_request.base.sha }}... | egrep '^[+][^+]' | grep -q ::")
-            packages <- get_deps()
-          } else {
-            writeLines("No changes using :: found, not checking without suggested packages")
-            packages <- character()
-          }
-        } else {
-          packages <- get_deps()
-        }
-
-        if (length(packages) > 0) {
-          json <- paste0(
-            '{"package":[',
-            paste0('"', packages, '"', collapse = ","),
-            ']}'
-          )
-          writeLines(json)
-          writeLines(paste0("matrix=", json), Sys.getenv("GITHUB_OUTPUT"))
-        } else {
-          writeLines("Package list empty!")
-        }
-      shell: Rscript {0}
diff --git a/.github/workflows/dep-suggests-matrix-read/action.yml b/.github/workflows/dep-suggests-matrix-read/action.yml
new file mode 100644
index 000000000..39e7a7b23
--- /dev/null
+++ b/.github/workflows/dep-suggests-matrix-read/action.yml
@@ -0,0 +1,24 @@
+name: "Actions to read a matrix with all suggested packages, computed with the dep-suggests-matrix action"
+outputs:
+  matrix:
+    description: "Generated matrix"
+    value: ${{ steps.set-matrix.outputs.matrix }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install json2yaml
+      run: |
+        sudo npm install -g json2yaml
+      shell: bash
+
+    - id: set-matrix
+      run: |
+        # Empty contents if no suggested packages
+        matrix=$(cat .github/dep-suggests-matrix.json || true)
+        if [ -n "$matrix" ]; then
+          echo $matrix | jq .
+          echo $matrix | json2yaml
+        fi
+        echo "matrix=$matrix" | tee -a $GITHUB_OUTPUT
+      shell: bash
diff --git a/.github/workflows/dep-suggests-matrix/action.R b/.github/workflows/dep-suggests-matrix/action.R
new file mode 100644
index 000000000..139519403
--- /dev/null
+++ b/.github/workflows/dep-suggests-matrix/action.R
@@ -0,0 +1,47 @@
+# FIXME: Dynamic lookup by parsing https://svn.r-project.org/R/tags/
+get_deps <- function() {
+  # Determine package dependencies
+  if (!requireNamespace("desc", quietly = TRUE)) {
+    install.packages("desc")
+  }
+
+  deps_df <- desc::desc_get_deps()
+  deps_df_optional <- deps_df$package[deps_df$type %in% c("Suggests", "Enhances")]
+  deps_df_hard <- deps_df$package[deps_df$type %in% c("Depends", "Imports", "LinkingTo")]
+  deps_df_base <- unlist(tools::standard_package_names(), use.names = FALSE)
+
+  packages <- sort(deps_df_optional)
+  packages <- intersect(packages, rownames(available.packages()))
+
+  # Too big to fail, or can't be avoided:
+  off_limits <- c("testthat", "rmarkdown", "rcmdcheck", deps_df_hard, deps_df_base)
+  off_limits_dep <- unlist(tools::package_dependencies(off_limits, recursive = TRUE, which = "strong"))
+  setdiff(packages, c(off_limits, off_limits_dep))
+}
+
+if (Sys.getenv("GITHUB_BASE_REF") != "") {
+  print(Sys.getenv("GITHUB_BASE_REF"))
+  has_diff <- (system("git diff ${{ github.event.pull_request.base.sha }}... | egrep '^[+][^+]' | grep -q ::") == 0)
+  if (has_diff) {
+    system("git diff ${{ github.event.pull_request.base.sha }}... | egrep '^[+][^+]' | grep -q ::")
+    packages <- get_deps()
+  } else {
+    writeLines("No changes using :: found, not checking without suggested packages")
+    packages <- character()
+  }
+} else {
+  packages <- get_deps()
+}
+
+if (length(packages) > 0) {
+  json <- paste0(
+    '{"package":[',
+    paste0('"', packages, '"', collapse = ","),
+    ']}'
+  )
+} else {
+  json <- character()
+}
+
+writeLines(json, ".github/dep-suggests-matrix.json")
+writeLines(json)
diff --git a/.github/workflows/dep-suggests-matrix/action.yml b/.github/workflows/dep-suggests-matrix/action.yml
new file mode 100644
index 000000000..0f5e64951
--- /dev/null
+++ b/.github/workflows/dep-suggests-matrix/action.yml
@@ -0,0 +1,13 @@
+name: "Actions to compute a matrix with all suggested packages"
+outputs:
+  matrix:
+    description: "Generated matrix"
+    value: ${{ steps.set-matrix.outputs.matrix }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: set-matrix
+      run: |
+        Rscript ./.github/workflows/dep-suggests-matrix/action.R
+      shell: bash
diff --git a/.github/workflows/revdep.yaml b/.github/workflows/revdep.yaml
index 4a0d511ae..0fa67dce8 100644
--- a/.github/workflows/revdep.yaml
+++ b/.github/workflows/revdep.yaml
@@ -67,7 +67,7 @@ jobs:
 
     runs-on: ubuntu-22.04
 
-    name: ${{ matrix.package }}
+    name: 'revdep: ${{ matrix.package }}'
 
     # Begin custom: services
     # End custom: services
diff --git a/.github/workflows/update-status/action.yml b/.github/workflows/update-status/action.yml
index 881217088..d9462fce3 100644
--- a/.github/workflows/update-status/action.yml
+++ b/.github/workflows/update-status/action.yml
@@ -4,9 +4,6 @@ inputs:
   sha:
     description: 'SHA to update'
     required: true
-  state:
-    description: 'state to update'
-    required: true
 
 runs:
   using: "composite"
@@ -24,11 +21,19 @@ runs:
             -H "X-GitHub-Api-Version: 2022-11-28" \
             repos/${{ github.repository }}/actions/runs/${{ github.run_id }} | jq -r .html_url)
 
-          gh api \
-            --method POST \
+          # Check if a failing status has been set already
+          status=$(gh api \
             -H "Accept: application/vnd.github+json" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            repos/${{ github.repository }}/statuses/${{ inputs.sha }} \
-            -f "state=${{ job.status }}" -f "target_url=$html_url" -f "description=${{ github.workflow }} / ${{ github.job }}" -f "context=actions-sync"
+            repos/${{ github.repository }}/commits/${{ inputs.sha }}/status | jq -r .state)
+
+          if [ "${status}" != "error" ] && [ "${status}" != "failure" ]; then
+            gh api \
+              --method POST \
+              -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              repos/${{ github.repository }}/statuses/${{ inputs.sha }} \
+              -f "state=${{ job.status }}" -f "target_url=$html_url" -f "description=${{ github.workflow }} / ${{ github.job }}" -f "context=actions-sync"
+          fi
         fi
       shell: bash