From bfdb43f1a163be32ae224f5cad23b4f91d72ff6b Mon Sep 17 00:00:00 2001
From: mia <mia@grr.llc>
Date: Sun, 28 Jun 2026 11:00:39 -0400
Subject: [PATCH] =?UTF-8?q?watcher:=20no=20checkout=20=E2=80=94=20read+wri?=
 =?UTF-8?q?te=20build=5Fimage.sh=20via=20api?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/upstream-patches-watch.yml | 75 ++++++++------------
 1 file changed, 28 insertions(+), 47 deletions(-)

diff --git a/.github/workflows/upstream-patches-watch.yml b/.github/workflows/upstream-patches-watch.yml
index f9da774..1e05a06 100644
--- a/.github/workflows/upstream-patches-watch.yml
+++ b/.github/workflows/upstream-patches-watch.yml
@@ -1,15 +1,6 @@
 name: Upstream patches watch
 run-name: Watch ps5-linux-patches for new kernel-* tags
 
-# Polls https://github.com/ps5-linux/ps5-linux-patches for new
-# kernel-X.Y.Z-<sha> tags. If a newer one exists than build_image.sh's
-# PATCHES_REF, bump it and push to main. The push to main fires
-# trigger-builds.yml on its own (push event) so we don't need to dispatch.
-#
-# Runs daily at 04:00 UTC and on demand. Skips the bump if PATCHES_REPO has
-# been forked away from the canonical ps5-linux URL (i.e. local kernel fixes
-# are carried in a fork — overwriting the pinned ref would clobber them).
-
 on:
   schedule:
     - cron: '0 4 * * *'
@@ -21,56 +12,46 @@ permissions:
 jobs:
   check:
     runs-on: self-hosted
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      REPO: ${{ github.repository }}
     steps:
-      - uses: actions/checkout@v4
-        with:
-          clean: false
-
-      - name: Compare upstream latest vs current PATCHES_REF
-        id: cmp
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Bump build_image.sh PATCHES_REF if stale
         run: |
           set -euo pipefail
-          REPO=$(grep -E '^PATCHES_REPO=' build_image.sh | head -1 | cut -d'"' -f2)
-          if [ "$REPO" != "https://github.com/ps5-linux/ps5-linux-patches.git" ]; then
-            echo "PATCHES_REPO is a fork ($REPO) — skipping auto-bump."
-            echo "stale=false" >> "$GITHUB_OUTPUT"
+
+          # Read build_image.sh from main via API (no checkout — avoids
+          # EACCES on root-owned build artifacts left in the workspace).
+          gh api "repos/${REPO}/contents/build_image.sh?ref=main" \
+            --jq '.content' | base64 -d > build_image.sh
+          SHA=$(gh api "repos/${REPO}/contents/build_image.sh?ref=main" --jq '.sha')
+
+          REPO_URL=$(grep -E '^PATCHES_REPO=' build_image.sh | head -1 | cut -d'"' -f2)
+          if [ "$REPO_URL" != "https://github.com/ps5-linux/ps5-linux-patches.git" ]; then
+            echo "PATCHES_REPO is a fork ($REPO_URL) — skipping auto-bump."
             exit 0
           fi
+
           LATEST=$(gh api repos/ps5-linux/ps5-linux-patches/tags --paginate \
             --jq '.[] | select(.name | test("^kernel-[0-9]+\\.[0-9]+\\.[0-9]+-[a-f0-9]+$")) | .name' \
             | head -1)
-          if [ -z "$LATEST" ]; then
-            echo "no kernel-*-* tags found upstream"; exit 1
-          fi
+          [ -n "$LATEST" ] || { echo "no kernel tags found"; exit 1; }
+
           CUR=$(grep -E '^PATCHES_REF=' build_image.sh | head -1 | cut -d'"' -f2)
           echo "upstream latest: $LATEST"
           echo "current ref:     $CUR"
-          echo "latest=$LATEST"  >> "$GITHUB_OUTPUT"
-          echo "current=$CUR"    >> "$GITHUB_OUTPUT"
           if [ "$LATEST" = "$CUR" ]; then
-            echo "stale=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "stale=true"  >> "$GITHUB_OUTPUT"
+            echo "already current — no bump."
+            exit 0
           fi
 
-      - name: Bump + commit + push
-        if: steps.cmp.outputs.stale == 'true'
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          LATEST: ${{ steps.cmp.outputs.latest }}
-          CUR: ${{ steps.cmp.outputs.current }}
-        run: |
-          set -euo pipefail
           sed -i "s|^PATCHES_REF=\"${CUR}\"|PATCHES_REF=\"${LATEST}\"|" build_image.sh
-          git config user.name  "ps5-linux-bot"
-          git config user.email "ps5-linux-bot@users.noreply.github.com"
-          git add build_image.sh
-          git commit -m "kernel: auto-bump ${CUR} -> ${LATEST} (upstream watch)"
-          git push "https://x-access-token:${TOKEN}@github.com/${REPO}.git" HEAD:main
-          # Push to main fires trigger-builds.yml automatically (it's
-          # on: push branches: [main]), which calls build-image.yml with
-          # distro=all. No manual dispatch needed.
-          echo "pushed bump to ${LATEST}; trigger-builds.yml will fire on the push event"
+          NEW_B64=$(base64 -w0 < build_image.sh)
+          gh api -X PUT "repos/${REPO}/contents/build_image.sh" \
+            -f message="kernel: auto-bump ${CUR} -> ${LATEST}" \
+            -f content="${NEW_B64}" \
+            -f sha="${SHA}" \
+            -f branch=main \
+            -f committer.name="ps5-linux-bot" \
+            -f committer.email="ps5-linux-bot@users.noreply.github.com"
+          echo "pushed bump to ${LATEST}"