cron-update.yml

name: "🔄 Update versions"
run-name: "${{ github.event_name == 'schedule' && '⏰ ' || '' }}🔄 Update versions"

on:
  push:
    branches:
      - main
  schedule:
    - cron: "0 0 * * 6"
  workflow_dispatch:

concurrency:
  group: update-versions-${{ github.repository }}-${{ github.ref_name }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

jobs:
  update-docker-image-versions:
    name: 🐳 Update Docker image versions
    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
    runs-on: ubuntu-26.04
    steps:
      - name: ⬇️ Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: main

      - name: 🔧 Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: 📦 Install update dependencies
        run: bash scripts/github/update/install_python.sh

      - name: 🔄 Update Docker image versions
        run: bash scripts/github/update/image_versions.sh

      - name: 🔎 Check for changes
        id: diff
        run: bash scripts/github/resolve/check_git_changes.sh roles

      - name: ⚙️ Generate app token
        if: steps.diff.outputs.changed == 'true'
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: 📂 Open PR if Docker image versions changed
        if: steps.diff.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
          UPDATE_BRANCH_PREFIX: update/docker-image-versions
          UPDATE_COMMIT_MESSAGE: "update(images): update Docker image versions"
          UPDATE_PR_TITLE: "update(images): update Docker image versions"
          UPDATE_PR_BODY: "Automated update of semver-based Docker image versions in `roles/*/meta/services.yml`."
          UPDATE_BASE_BRANCH: main
        run: bash scripts/github/update/open/role_prs.sh roles

  update-version-sources:
    name: 🔖 Update declared version sources
    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
    runs-on: ubuntu-26.04
    steps:
      - name: ⬇️ Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: main

      - name: 🔧 Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: 📦 Install update dependencies
        run: bash scripts/github/update/install_python.sh

      - name: 🔄 Update declared version sources
        run: bash scripts/github/update/version_sources.sh

      - name: 🔎 Check for changes
        id: diff
        run: bash scripts/github/resolve/check_git_changes.sh roles

      - name: ⚙️ Generate app token
        if: steps.diff.outputs.changed == 'true'
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: 📂 Open PR if declared version sources changed
        if: steps.diff.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
          UPDATE_BRANCH_PREFIX: update/version-sources
          UPDATE_COMMIT_MESSAGE: "update(versions): update pins with a declared source"
          UPDATE_PR_TITLE: "update(versions): update pins with a declared source"
          UPDATE_PR_BODY: "Automated update of version pins declaring their upstream in an `update:` block of `roles/*/meta/services.yml` or `roles/*/meta/addons/*.yml`."
          UPDATE_BASE_BRANCH: main
        run: bash scripts/github/update/open/role_prs.sh roles

  update-pip-pins:
    name: 🐍 Update pinned pip requirements
    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
    runs-on: ubuntu-26.04
    steps:
      - name: ⬇️ Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: main

      - name: 🔧 Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: 📦 Install update dependencies
        run: bash scripts/github/update/install_python.sh

      - name: 🔄 Update pinned pip requirements
        run: bash scripts/github/update/pip_pins.sh

      - name: 🔎 Check for changes
        id: diff
        run: bash scripts/github/resolve/check_git_changes.sh roles

      - name: ⚙️ Generate app token
        if: steps.diff.outputs.changed == 'true'
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: 📂 Open PR if pip pins changed
        if: steps.diff.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
          UPDATE_BRANCH_PREFIX: update/pip-pins
          UPDATE_COMMIT_MESSAGE: "update(pip): update pinned pip requirements"
          UPDATE_PR_TITLE: "update(pip): update pinned pip requirements"
          UPDATE_PR_BODY: "Automated update of exact pip pins in `roles/**/*.yml`."
          UPDATE_BASE_BRANCH: main
        run: bash scripts/github/update/open/role_prs.sh roles

  update-galaxy-pins:
    name: 🌌 Update pinned Ansible collections
    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
    runs-on: ubuntu-26.04
    steps:
      - name: ⬇️ Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: main

      - name: 🔧 Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: 📦 Install update dependencies
        run: bash scripts/github/update/install_python.sh

      - name: 🔄 Update pinned Ansible collections
        run: bash scripts/github/update/galaxy_pins.sh

      - name: 🔎 Check for changes
        id: diff
        run: bash scripts/github/resolve/check_git_changes.sh requirements

      - name: ⚙️ Generate app token
        if: steps.diff.outputs.changed == 'true'
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: 📂 Open PR if collection pins changed
        if: steps.diff.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
          UPDATE_BRANCH_PREFIX: update/galaxy-pins
          UPDATE_COMMIT_MESSAGE: "update(galaxy): bump pinned Ansible collections"
          UPDATE_PR_TITLE: "update(galaxy): bump pinned Ansible collections"
          UPDATE_PR_BODY: "Automated update of the collection `version:` pins in `requirements/`. Both the Galaxy file and the git fallback are bumped together; upstream releases resolved via `git ls-remote --tags`."
          UPDATE_BASE_BRANCH: main
        run: bash scripts/github/update/open/pr.sh requirements

  update-repository-refs:
    name: 🌿 Update repository refs
    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
    runs-on: ubuntu-26.04
    steps:
      - name: ⬇️ Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: main

      - name: 🔧 Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: 📦 Install update dependencies
        run: bash scripts/github/update/install_python.sh

      - name: 🔄 Update repository refs
        run: bash scripts/github/update/repository_refs.sh

      - name: 🔎 Check for changes
        id: diff
        run: bash scripts/github/resolve/check_git_changes.sh roles

      - name: ⚙️ Generate app token
        if: steps.diff.outputs.changed == 'true'
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: 📂 Open PR if repository refs changed
        if: steps.diff.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
          UPDATE_BRANCH_PREFIX: update/repository-refs
          UPDATE_COMMIT_MESSAGE: "update(repos): bump git refs to latest semver tags"
          UPDATE_PR_TITLE: "update(repos): bump git refs to latest semver tags"
          UPDATE_PR_BODY: "Automated update of semver-based git `ref:` values in `roles/*/meta/services.yml`. Upstream tags resolved via `git ls-remote --tags`."
          UPDATE_BASE_BRANCH: main
        run: bash scripts/github/update/open/role_prs.sh roles

  update-runner-labels:
    name: 🏃 Update GitHub-hosted runner labels
    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
    runs-on: ubuntu-26.04
    steps:
      - name: ⬇️ Checkout
        uses: actions/checkout@v7.0.0
        with:
          ref: main

      - name: 🔧 Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: 🔄 Update runner labels
        run: bash scripts/github/update/runner_labels.sh

      - name: 🔎 Check for changes
        id: diff
        run: bash scripts/github/resolve/check_git_changes.sh .github/workflows

      - name: ⚙️ Generate app token
        if: steps.diff.outputs.changed == 'true'
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: 📂 Open PR if runner labels changed
        if: steps.diff.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
          UPDATE_BRANCH_PREFIX: update/runner-labels
          UPDATE_COMMIT_MESSAGE: "update(ci): raise GitHub-hosted runner labels"
          UPDATE_PR_TITLE: "update(ci): raise GitHub-hosted runner labels"
          UPDATE_PR_BODY: "Automated raise of every `runs-on: ubuntu-NN.NN` in `.github/workflows/` to the newest GA x64 Ubuntu image listed in https://github.com/actions/runner-images. Its CI run is the proof that the stack works on the new image."
          UPDATE_BASE_BRANCH: main
        run: bash scripts/github/update/open/pr.sh .github/workflows