Regenerate #91
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Regenerate | |
| on: | |
| schedule: | |
| - cron: "20 6 * * *" | |
| workflow_dispatch: | |
| defaults: | |
| run: | |
| shell: bash -xeuo pipefail {0} | |
| concurrency: | |
| group: regenerate | |
| env: | |
| HOMEBREW_DEVELOPER: 1 | |
| HOMEBREW_NO_AUTO_UPDATE: 1 | |
| HOMEBREW_NO_ENV_HINTS: 1 | |
| permissions: {} | |
| jobs: | |
| regenerate: | |
| name: Regenerate advisories | |
| if: github.repository_owner == 'Homebrew' && github.ref == 'refs/heads/main' | |
| runs-on: macos-latest | |
| timeout-minutes: 180 | |
| permissions: | |
| contents: write # Push the bot-owned regeneration branch. | |
| pull-requests: write # Open a pull request for that branch. | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Homebrew | |
| uses: Homebrew/actions/setup-homebrew@f8d4222eb633e65c2a0157383cf80861fc7fae7f # 2026.09.07.1 | |
| - name: Set up Ruby | |
| uses: Homebrew/actions/setup-ruby@f8d4222eb633e65c2a0157383cf80861fc7fae7f # 2026.09.07.1 | |
| with: | |
| bundler-cache: true | |
| portable-ruby: true | |
| - name: Run tests | |
| run: bundle exec rake spec | |
| - name: Regenerate advisories | |
| # Step-scoped: setup-homebrew unsets this so brew install can use the API. | |
| env: | |
| HOMEBREW_NO_INSTALL_FROM_API: 1 | |
| run: brew generate-vulns-advisories advisories | |
| - name: Configure git | |
| uses: Homebrew/actions/git-user-config@f8d4222eb633e65c2a0157383cf80861fc7fae7f # 2026.09.07.1 | |
| with: | |
| username: BrewTestBot | |
| - name: Set up commit signing | |
| uses: Homebrew/actions/setup-commit-signing@f8d4222eb633e65c2a0157383cf80861fc7fae7f # 2026.09.07.1 | |
| with: | |
| signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }} | |
| - name: Commit advisories | |
| id: commit | |
| env: | |
| BRANCH: regenerate-advisories | |
| run: | | |
| git add advisories/ | |
| if git diff --cached --quiet; then | |
| echo "No changes." | |
| exit 0 | |
| fi | |
| bundle exec rake advisories:summary > "${RUNNER_TEMP}/regenerate-pr-body.md" | |
| git checkout -b "${BRANCH}" | |
| git commit -m "Regenerate advisories" | |
| { | |
| echo "branch=${BRANCH}" | |
| echo "committed=true" | |
| } >> "${GITHUB_OUTPUT}" | |
| - name: Push commits | |
| if: steps.commit.outputs.committed == 'true' | |
| uses: Homebrew/actions/git-try-push@f8d4222eb633e65c2a0157383cf80861fc7fae7f # 2026.09.07.1 | |
| with: | |
| token: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN || github.token }} | |
| branch: ${{ steps.commit.outputs.branch }} | |
| # No lease: rebuilt from main each run, and no remote-tracking ref exists. | |
| force: true | |
| no_lease: true | |
| origin_branch: HEAD | |
| - name: Open or update pull request | |
| if: steps.commit.outputs.committed == 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN || github.token }} | |
| BRANCH: ${{ steps.commit.outputs.branch }} | |
| BODY: ${{ runner.temp }}/regenerate-pr-body.md | |
| run: | | |
| open_pr_number="$(gh pr list --head "${BRANCH}" --state open \ | |
| --json number,isCrossRepository \ | |
| --jq '.[] | select(.isCrossRepository | not) | .number')" | |
| if [[ -n "${open_pr_number}" ]]; then | |
| gh pr edit "${open_pr_number}" --body-file "${BODY}" | |
| else | |
| gh pr create --base main --head "${BRANCH}" \ | |
| --title "Regenerate advisories" \ | |
| --body-file "${BODY}" | |
| fi |