node/.github/workflows/update-openssl.yml at main · Eusgor/node · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
name: OpenSSL update
on:
  schedule:
    # Run once a week at 00:05 AM UTC on Sunday.
    - cron: 5 0 * * 0

  workflow_dispatch:

permissions:
  contents: read

jobs:
  openssl-update:
    if: github.repository == 'nodejs/node'
    # Cannot use ubuntu-slim here because the update script requires Docker
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false
      - name: Check and download new OpenSSL version
        run: |
          ./tools/dep_updaters/update-openssl.sh download > temp-output
          cat temp-output
          tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
          rm temp-output
        env:
          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
      - name: Create PR with first commit
        if: env.NEW_VERSION
        uses: gr2m/create-or-update-pull-request-action@b65137ca591da0b9f43bad7b24df13050ea45d1b  # v1.10.1
        # Creates a PR with the new OpenSSL source code committed
        env:
          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
        with:
          author: Node.js GitHub Bot <github-bot@iojs.org>
          body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }}.
          branch: actions/tools-update-openssl  # Custom branch *just* for this Action.
          commit-message: 'deps: upgrade openssl sources to openssl-${{ env.NEW_VERSION }}'
          labels: dependencies, openssl
          title: 'deps: update OpenSSL to ${{ env.NEW_VERSION }}'
          path: deps/openssl
          update-pull-request-title-and-body: true
      - name: Regenerate platform specific files
        if: env.NEW_VERSION
        run: |
          sudo apt update && sudo apt install -y nasm libtext-template-perl
          ./tools/dep_updaters/update-openssl.sh regenerate
        env:
          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
      - name: Add second commit
        # Adds a second commit to the PR with the generated platform-dependent files
        if: env.NEW_VERSION
        uses: gr2m/create-or-update-pull-request-action@b65137ca591da0b9f43bad7b24df13050ea45d1b  # v1.10.1
        env:
          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
        with:
          author: Node.js GitHub Bot <github-bot@iojs.org>
          branch: actions/tools-update-openssl  # Custom branch *just* for this Action.
          commit-message: 'deps: update archs files for openssl-${{ env.NEW_VERSION }}'
          path: deps/openssl