name: Tools and deps update
on:
  schedule:
    # Run once a week at 00:05 AM UTC on Sunday.
    - cron: 5 0 * * 0

  workflow_dispatch:
    inputs:
      id:
        description: The ID of the job to run
        required: true
        default: all
        type: choice
        options:
          - all
          - acorn
          - acorn-walk
          - ada
          - amaro
          - brotli
          - c-ares
          - merve
          - corepack
          - googletest
          - gyp-next
          - histogram
          - icu
          - inspector_protocol
          - libffi
          - libuv
          - lief
          - llhttp
          - nbytes
          - nixpkgs-unstable
          - nghttp2
          - nghttp3
          - ngtcp2
          - perfetto
          - postject
          - root-certificates
          - simdjson
          - sqlite
          - test426-fixtures
          - undici
          - uvwasi
          - zlib
          - zstd

env:
  PYTHON_VERSION: '3.15'

permissions:
  contents: read

jobs:
  tools-deps-update:
    permissions:
      contents: read
      pull-requests: read
    if: github.repository == 'nodejs/node' || github.event_name == 'workflow_dispatch'
    # cannot use ubuntu-slim here because some update scripts require Docker
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false  # Prevent other jobs from aborting if one fails
      matrix:
        include:
          - id: acorn
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-acorn.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: acorn-walk
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-acorn-walk.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: ada
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-ada.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: amaro
            subsystem: deps
            label: dependencies, strip-types
            run: |
              ./tools/dep_updaters/update-amaro.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: brotli
            subsystem: deps
            label: dependencies, zlib
            run: |
              ./tools/dep_updaters/update-brotli.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: c-ares
            subsystem: deps
            label: dependencies, cares
            run: |
              ./tools/dep_updaters/update-c-ares.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: merve
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-merve.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: corepack
            subsystem: deps
            label: dependencies
            run: |
              make corepack-update
              echo "NEW_VERSION=$(node deps/corepack/dist/corepack.js --version)" >> $GITHUB_ENV
          - id: googletest
            subsystem: deps
            label: dependencies, test
            run: |
              ./tools/dep_updaters/update-googletest.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: gyp-next
            subsystem: tools
            label: tools, gyp
            run: |
              ./tools/dep_updaters/update-gyp-next.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: histogram
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-histogram.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: icu
            subsystem: deps
            label: dependencies, test, icu
            requires-python: true
            run: |
              ./tools/dep_updaters/update-icu.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: inspector_protocol
            subsystem: deps
            label: dependencies, inspector
            requires-python: true
            run: |
              ./tools/dep_updaters/update-inspector-protocol.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: libffi
            subsystem: deps
            label: dependencies, ffi
            run: |
              ./tools/dep_updaters/update-libffi.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: libuv
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-libuv.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: lief
            subsystem: deps
            label: dependencies, dont-land-on-v22.x
            requires-python: true
            run: |
              ./tools/dep_updaters/update-lief.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: llhttp
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-llhttp.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: nbytes
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-nbytes.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: nixpkgs-unstable
            subsystem: tools
            # dont-land labels are there so we can guarantee released versions of
            # Node.js can be built with the same env along the whole release line life – or
            # at least we can detect and document necessary updates.
            label: tools, dont-land-on-v22.x, dont-land-on-v24.x, dont-land-on-v26.x
            run: |
              ./tools/dep_updaters/update-nixpkgs-pin.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: nghttp2
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-nghttp2.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: nghttp3
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-nghttp3.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: ngtcp2
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-ngtcp2.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: perfetto
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-perfetto.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: postject
            subsystem: deps,test
            label: test
            run: |
              ./tools/dep_updaters/update-postject.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: root-certificates
            subsystem: crypto
            label: crypto, notable-change
            run: |
              node ./tools/dep_updaters/update-root-certs.mjs -v -f "$GITHUB_ENV"
          - id: simdjson
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-simdjson.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: sqlite
            subsystem: deps
            label: dependencies, sqlite
            run: |
              ./tools/dep_updaters/update-sqlite.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: test426-fixtures
            subsystem: test
            label: test
            run: |
              bash tools/dep_updaters/update-test426-fixtures.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: undici
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-undici.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: uvwasi
            subsystem: deps
            label: dependencies
            run: |
              ./tools/dep_updaters/update-uvwasi.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: zlib
            subsystem: deps
            label: dependencies, zlib
            run: |
              ./tools/dep_updaters/update-zlib.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
          - id: zstd
            subsystem: deps
            label: dependencies, zlib
            run: |
              ./tools/dep_updaters/update-zstd.sh > temp-output
              cat temp-output
              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
              rm temp-output
    env:
      BRANCH_NAME: actions/${{ github.ref_name != 'main' && format('{0}/', github.ref_name) || '' }}tools-update-${{ matrix.id }}
    steps:
      - name: Check for non-bot commits on the existing pull request
        id: check-pr
        # Updating the Action's PR force-pushes its branch, so skip the update
        # if someone pushed their own commits to it to avoid discarding them.
        # When 'inputs.id == matrix.id', non-bot commits are being overwritten
        if: github.event_name == 'schedule' || inputs.id == 'all'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          PR_URL=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BRANCH_NAME" --state open \
            --json url,commits,isCrossRepository \
            --jq '[.[] | select(.isCrossRepository | not) | select(any(.commits[].authors[]; .email != "github-bot@iojs.org")) | .url] | join(" ")')
          if [ -n "$PR_URL" ]; then
            echo "::notice::Skipping update, $PR_URL has commits not authored by the bot"
            echo "hasNonBotCommits=true" >> "$GITHUB_OUTPUT"
          fi
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        if: (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id) && steps.check-pr.outputs.hasNonBotCommits != 'true'
        with:
          persist-credentials: false
      - name: Set up Python ${{ env.PYTHON_VERSION }}
        if: matrix.requires-python && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id) && steps.check-pr.outputs.hasNonBotCommits != 'true'
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          allow-prereleases: true
      - name: Set up Nix
        if: matrix.id == 'nixpkgs-unstable' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id) && steps.check-pr.outputs.hasNonBotCommits != 'true'
        uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b  # v31.11.3
      - run: ${{ matrix.run }}
        if: (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id) && steps.check-pr.outputs.hasNonBotCommits != 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
      - name: Generate commit message if not set
        if: env.COMMIT_MSG == '' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id) && steps.check-pr.outputs.hasNonBotCommits != 'true'
        run: |
          echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to $NEW_VERSION" >> "$GITHUB_ENV"
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
        if: (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id) && steps.check-pr.outputs.hasNonBotCommits != 'true'
        # Creates a PR or update the Action's existing PR, or
        # no-op if the base branch is already up-to-date.
        with:
          token: ${{ secrets.GH_USER_TOKEN }}
          branch: ${{ env.BRANCH_NAME }}  # Custom branch *just* for this Action.
          delete-branch: true
          commit-message: ${{ env.COMMIT_MSG }}
          labels: ${{ matrix.label }}
          title: '${{ matrix.subsystem }}: update ${{ matrix.id }} to ${{ env.NEW_VERSION }}'
          body: This is an automated update of ${{ matrix.id }} to ${{ env.NEW_VERSION }}.
          committer: ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>
          author: Node.js GitHub Bot <github-bot@iojs.org>