Sync with Upstream Release #63
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sync with Upstream Release | |
| on: | |
| # Check for new upstream releases daily at 6 AM UTC | |
| schedule: | |
| - cron: '0 6 * * *' | |
| workflow_dispatch: | |
| inputs: | |
| upstream_tag: | |
| description: 'Specific upstream tag to sync (e.g., 6.0.0)' | |
| required: false | |
| type: string | |
| jobs: | |
| check-release: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| has_new_release: ${{ steps.check.outputs.has_new_release }} | |
| upstream_tag: ${{ steps.check.outputs.upstream_tag }} | |
| upstream_version: ${{ steps.check.outputs.upstream_version }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check for new upstream release | |
| id: check | |
| run: | | |
| # Add upstream remote | |
| git remote add upstream https://github.com/strongswan/strongswan.git || true | |
| git fetch upstream --tags | |
| if [ -n "${{ inputs.upstream_tag }}" ]; then | |
| # Manual trigger with specific tag | |
| UPSTREAM_TAG="${{ inputs.upstream_tag }}" | |
| else | |
| # Get latest upstream release tag (format: X.Y.Z) | |
| # Use git ls-remote to only get tags from upstream, not origin | |
| UPSTREAM_TAG=$(git ls-remote --tags upstream | \ | |
| sed -n 's|.*refs/tags/\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\)$|\1|p' | \ | |
| sort -V | tail -1) | |
| fi | |
| echo "Latest upstream tag: $UPSTREAM_TAG" | |
| # Check if we already have this release | |
| if git tag -l | grep -q "^${UPSTREAM_TAG}-sw\."; then | |
| echo "Already have release based on $UPSTREAM_TAG" | |
| echo "has_new_release=false" >> $GITHUB_OUTPUT | |
| else | |
| echo "New upstream release: $UPSTREAM_TAG" | |
| echo "has_new_release=true" >> $GITHUB_OUTPUT | |
| echo "upstream_tag=$UPSTREAM_TAG" >> $GITHUB_OUTPUT | |
| echo "upstream_version=$UPSTREAM_TAG" >> $GITHUB_OUTPUT | |
| fi | |
| sync: | |
| needs: check-release | |
| if: needs.check-release.outputs.has_new_release == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| outputs: | |
| rebase_success: ${{ steps.sync.outputs.rebase_success }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Configure Git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| - name: Sync to upstream release | |
| id: sync | |
| run: | | |
| UPSTREAM_TAG="${{ needs.check-release.outputs.upstream_tag }}" | |
| git remote add upstream https://github.com/strongswan/strongswan.git || true | |
| git fetch upstream --tags | |
| # Update master to upstream release tag | |
| # Force push is intentional here - master should always mirror | |
| # the upstream release exactly. This repo is a fork where only | |
| # the sw branch contains our modifications. | |
| # Use explicit origin/master to avoid ambiguity with upstream/master | |
| git checkout -B master origin/master | |
| git reset --hard "$UPSTREAM_TAG" | |
| git push origin master --force | |
| # Rebase sw branch onto the release | |
| git checkout sw | |
| if git rebase origin/master; then | |
| echo "Rebase successful" | |
| git push origin sw --force-with-lease | |
| echo "rebase_success=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "Rebase failed - conflicts detected" | |
| git rebase --abort | |
| echo "rebase_success=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Create issue on conflict | |
| if: steps.sync.outputs.rebase_success == 'false' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const title = '⚠️ Upstream release sync conflict'; | |
| const body = `## Upstream Sync Failed | |
| Failed to rebase \`sw\` branch onto upstream release **${{ needs.check-release.outputs.upstream_tag }}**. | |
| ### Manual resolution required: | |
| \`\`\`bash | |
| git fetch origin | |
| git fetch upstream --tags | |
| git checkout sw | |
| git rebase ${{ needs.check-release.outputs.upstream_tag }} | |
| # Resolve conflicts | |
| git push origin sw --force-with-lease | |
| \`\`\` | |
| After resolving, manually trigger the Build Packages workflow.`; | |
| const issues = await github.rest.issues.listForRepo({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| state: 'open', | |
| labels: 'upstream-sync' | |
| }); | |
| if (issues.data.length === 0) { | |
| await github.rest.issues.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: title, | |
| body: body, | |
| labels: ['upstream-sync', 'needs-attention'] | |
| }); | |
| } | |
| build: | |
| needs: [check-release, sync] | |
| if: needs.check-release.outputs.has_new_release == 'true' && needs.sync.outputs.rebase_success != 'false' | |
| uses: ./.github/workflows/build-packages.yml | |
| with: | |
| upstream_version: ${{ needs.check-release.outputs.upstream_version }} | |
| secrets: inherit | |
| permissions: | |
| contents: write |