watcher: use github-script (no gh, no checkout)

This commit is contained in:
mia
2026-06-28 11:03:29 -04:00
parent bfdb43f1a1
commit af8c7d472f

View File

@@ -12,46 +12,49 @@ permissions:
jobs: jobs:
check: check:
runs-on: self-hosted runs-on: self-hosted
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
REPO: ${{ github.repository }}
steps: steps:
- name: Bump build_image.sh PATCHES_REF if stale - uses: actions/github-script@v8
run: | with:
set -euo pipefail script: |
const { owner, repo } = context.repo;
# Read build_image.sh from main via API (no checkout — avoids // Read build_image.sh from main via API (no checkout — runner
# EACCES on root-owned build artifacts left in the workspace). // workspace has root-owned build leftovers EACCES checkout).
gh api "repos/${REPO}/contents/build_image.sh?ref=main" \ const file = await github.rest.repos.getContent({
--jq '.content' | base64 -d > build_image.sh owner, repo, path: 'build_image.sh', ref: 'main',
SHA=$(gh api "repos/${REPO}/contents/build_image.sh?ref=main" --jq '.sha') });
const buf = Buffer.from(file.data.content, 'base64');
let body = buf.toString();
REPO_URL=$(grep -E '^PATCHES_REPO=' build_image.sh | head -1 | cut -d'"' -f2) const patchesRepo = (body.match(/^PATCHES_REPO="([^"]+)"/m) || [])[1];
if [ "$REPO_URL" != "https://github.com/ps5-linux/ps5-linux-patches.git" ]; then if (patchesRepo !== 'https://github.com/ps5-linux/ps5-linux-patches.git') {
echo "PATCHES_REPO is a fork ($REPO_URL) — skipping auto-bump." core.info(`PATCHES_REPO is a fork (${patchesRepo}) — skipping auto-bump.`);
exit 0 return;
fi }
LATEST=$(gh api repos/ps5-linux/ps5-linux-patches/tags --paginate \ // Tags API returns by commit-date (most recent first).
--jq '.[] | select(.name | test("^kernel-[0-9]+\\.[0-9]+\\.[0-9]+-[a-f0-9]+$")) | .name' \ const tags = await github.paginate(github.rest.repos.listTags, {
| head -1) owner: 'ps5-linux', repo: 'ps5-linux-patches', per_page: 100,
[ -n "$LATEST" ] || { echo "no kernel tags found"; exit 1; } });
const re = /^kernel-\d+\.\d+\.\d+-[a-f0-9]+$/;
const latest = tags.find(t => re.test(t.name))?.name;
if (!latest) { core.setFailed('no kernel-*-* tags found'); return; }
CUR=$(grep -E '^PATCHES_REF=' build_image.sh | head -1 | cut -d'"' -f2) const cur = (body.match(/^PATCHES_REF="([^"]+)"/m) || [])[1];
echo "upstream latest: $LATEST" core.info(`upstream latest: ${latest}`);
echo "current ref: $CUR" core.info(`current ref: ${cur}`);
if [ "$LATEST" = "$CUR" ]; then if (latest === cur) { core.info('already current — no bump.'); return; }
echo "already current — no bump."
exit 0
fi
sed -i "s|^PATCHES_REF=\"${CUR}\"|PATCHES_REF=\"${LATEST}\"|" build_image.sh const updated = body.replace(
NEW_B64=$(base64 -w0 < build_image.sh) new RegExp(`^PATCHES_REF="${cur}"`, 'm'),
gh api -X PUT "repos/${REPO}/contents/build_image.sh" \ `PATCHES_REF="${latest}"`,
-f message="kernel: auto-bump ${CUR} -> ${LATEST}" \ );
-f content="${NEW_B64}" \ await github.rest.repos.createOrUpdateFileContents({
-f sha="${SHA}" \ owner, repo, path: 'build_image.sh', branch: 'main',
-f branch=main \ message: `kernel: auto-bump ${cur} -> ${latest}`,
-f committer.name="ps5-linux-bot" \ content: Buffer.from(updated).toString('base64'),
-f committer.email="ps5-linux-bot@users.noreply.github.com" sha: file.data.sha,
echo "pushed bump to ${LATEST}" committer: { name: 'ps5-linux-bot', email: 'ps5-linux-bot@users.noreply.github.com' },
author: { name: 'ps5-linux-bot', email: 'ps5-linux-bot@users.noreply.github.com' },
});
core.info(`pushed bump to ${latest}`);