action-diff.yml

name: Upstream Action Diff

on:
  pull_request:
    paths:
      - '.github/workflows/**'

permissions: {}

jobs:
  upstream-diff:
    if: github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 2
          persist-credentials: false

      - name: Post upstream diff
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail

          # Extract changed action refs from the PR diff.
          # Dependabot bumps look like:
          #   -    uses: owner/repo@old_sha  # vX.Y.Z
          #   +    uses: owner/repo@new_sha  # vX.Y.Z
          body=""

          while IFS= read -r line; do
            old_ref=$(echo "$line" | cut -d'|' -f1)
            new_ref=$(echo "$line" | cut -d'|' -f2)

            old_action="${old_ref%%@*}"
            new_action="${new_ref%%@*}"
            old_sha="${old_ref##*@}"
            new_sha="${new_ref##*@}"

            # Skip if the action name changed (not a simple bump)
            [ "$old_action" != "$new_action" ] && continue
            # Skip if SHAs are identical
            [ "$old_sha" = "$new_sha" ] && continue

            owner=$(echo "$old_action" | cut -d'/' -f1)
            repo=$(echo "$old_action" | cut -d'/' -f2)

            echo "::group::${owner}/${repo} ${old_sha:0:7}..${new_sha:0:7}"

            compare_url="https://github.com/${owner}/${repo}/compare/${old_sha}...${new_sha}"

            # Fetch commit log between old and new SHA. The single-quoted
            # string is a jq program (passed to gh --jq), not shell — its
            # `\(...)` interpolations are jq's, so SC2016 is a false positive.
            # shellcheck disable=SC2016
            commits=$(gh api "repos/${owner}/${repo}/compare/${old_sha}...${new_sha}" \
              --jq '.commits | .[:20] | .[] | "- [`\(.sha[0:7])`](\(.html_url)) \(.commit.message | split("\n") | .[0])"' \
              2>/dev/null) || commits="*(could not fetch commit log — repository may be private)*"

            file_summary=$(gh api "repos/${owner}/${repo}/compare/${old_sha}...${new_sha}" \
              --jq '"**\(.files | length)** files changed, **\(.ahead_by)** commits ahead"' \
              2>/dev/null) || file_summary=""

            body="${body}
          ### [\`${owner}/${repo}\`](https://github.com/${owner}/${repo}) — ${old_sha:0:7}...${new_sha:0:7}

          ${file_summary}
          [Full diff](${compare_url})

          <details><summary>Commits</summary>

          ${commits}

          </details>
          "
            echo "::endgroup::"

          done < <(
            git diff HEAD~1..HEAD -- '.github/workflows/*.yml' \
            | grep -E '^[-+]\s+uses:' \
            | sed 's/^[-+]\s*uses:\s*//' \
            | sed 's/\s*#.*//' \
            | paste -d'|' - -
          )

          if [ -z "$body" ]; then
            echo "No action ref changes detected."
            exit 0
          fi

          comment="## Upstream changes

          This Dependabot PR bumps the following GitHub Action(s). Here's what changed upstream:
          ${body}
          ---
          *Posted by [action-diff](../actions/workflows/action-diff.yml)*"

          # Dedent the heredoc-style indentation (per-line strip; sed is the
          # clearest tool for this — bash param-expansion can't do per-line).
          # shellcheck disable=SC2001
          comment=$(echo "$comment" | sed 's/^          //')

          gh pr comment "$PR_NUMBER" --body "$comment"