name: OpenSSL update
on:
  schedule:
    # Run once a week at 00:05 AM UTC on Sunday.
    - cron: 5 0 * * 0

  workflow_dispatch:
    inputs:
      include_prereleases:
        description: Include prereleases
        type: boolean
        default: false

permissions:
  contents: read
  pull-requests: read

jobs:
  openssl-update:
    if: github.repository == 'nodejs/node'
    name: OpenSSL update (${{ github.ref_name }})
    # Cannot use ubuntu-slim here because the update script requires Docker
    runs-on: ubuntu-latest
    concurrency:
      group: openssl-update-${{ github.ref_name }}
      cancel-in-progress: false
    env:
      TARGET_BRANCH: ${{ github.ref_name }}
      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      PR_BRANCH: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Git config
        run: |
          git config user.name "Node.js GitHub Bot"
          git config user.email "github-bot@iojs.org"
          if [ "$TARGET_BRANCH" != "$DEFAULT_BRANCH" ]; then
            echo "PR_TITLE_PREFIX=[${TARGET_BRANCH%-staging}] " >> "$GITHUB_ENV"
          fi
      - name: Apply existing OpenSSL update
        if: github.event_name != 'workflow_dispatch'
        shell: bash
        run: |
          commit_list=$(gh pr list --repo "$GITHUB_REPOSITORY" \
            --head "$PR_BRANCH" --base "$TARGET_BRANCH" --state open \
            --json commits,isCrossRepository \
            --jq 'first(.[] | select(.isCrossRepository | not)).commits[]?.oid')
          if [ -n "$commit_list" ]; then
            git fetch --depth=2 --no-tags origin $commit_list
            git cherry-pick --empty=drop $commit_list
          fi
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Check and download new OpenSSL version
        run: |
          ./tools/dep_updaters/update-openssl.sh download \
          | tee /dev/stderr \
          | tail -n1 \
          | sed -n '/^NEW_VERSION=/p' >> "$GITHUB_ENV"
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
          INCLUDE_PRERELEASES: ${{ github.event_name == 'workflow_dispatch' && inputs.include_prereleases }}
      - name: Commit OpenSSL sources
        if: env.NEW_VERSION
        run: |
          git add -A deps/openssl/openssl
          git commit -m "deps: upgrade openssl sources to openssl-$NEW_VERSION"
      - name: Regenerate platform specific files
        if: env.NEW_VERSION
        run: |
          sudo apt update && sudo apt install -y nasm libtext-template-perl
          ./tools/dep_updaters/update-openssl.sh regenerate
        env:
          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
      - name: Commit generated files
        if: env.NEW_VERSION
        run: |
          git add -A deps/openssl
          git commit -m "deps: update archs files for openssl-$NEW_VERSION"
      - name: Create or update PR
        if: env.NEW_VERSION
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
        with:
          token: ${{ secrets.GH_USER_TOKEN }}
          author: Node.js GitHub Bot <github-bot@iojs.org>
          committer: Node.js GitHub Bot <github-bot@iojs.org>
          body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }} for ${{ github.ref_name }}.
          branch: ${{ env.PR_BRANCH }}
          labels: dependencies, openssl
          title: '${{ env.PR_TITLE_PREFIX }}deps: update OpenSSL to ${{ env.NEW_VERSION }}'