kandev/.github/workflows/update-agent-runtime-pins.yml

name: Update managed runtime pins

on:
  schedule:
    # Refresh the reviewed runtime pins every Friday at 09:00 UTC, then open
    # or refresh the single grouped updater PR when a stable version changes.
    - cron: "0 9 * * 5"
  workflow_dispatch:

# The job uses the repository-scoped workflow token for the branch, PR, and
# explicit validation-workflow dispatches. A GITHUB_TOKEN-created push or PR
# does not recursively trigger push/pull_request workflows.
permissions:
  contents: write
  pull-requests: write
  actions: write

concurrency:
  group: managed-runtime-pin-update
  cancel-in-progress: false

jobs:
  update:
    name: Open managed runtime pin PR
    runs-on: ubuntu-latest
    env:
      BOT_BRANCH: automation/update-managed-runtime-pins

    steps:
      - name: Checkout main
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: main
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "24"

      - name: Test pin updater
        run: node --test scripts/update-agent-runtime-pins.test.mjs

      - name: Configure git authentication
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh auth setup-git

      - name: Prepare stable bot branch
        run: |
          set -euo pipefail
          git fetch origin main
          git fetch origin "refs/heads/${BOT_BRANCH}:refs/remotes/origin/${BOT_BRANCH}" || true
          git checkout -B "${BOT_BRANCH}" origin/main

      - name: Update trusted catalogue
        id: update
        run: node scripts/update-agent-runtime-pins.mjs --github-output "$GITHUB_OUTPUT"

      - name: Test managed runtime catalogue and commands
        working-directory: apps/backend
        run: go test ./internal/agent/agents ./internal/agent/managedruntime ./internal/agent/runtime/lifecycle ./internal/agent/hostutility ./internal/agent/settings/controller ./internal/agent/settings/handlers

      - name: Commit and push one grouped change
        if: steps.update.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          git config user.name "kandev-runtime-updater[bot]"
          git config user.email "kandev-runtime-updater[bot]@users.noreply.github.com"
          git add apps/backend/internal/agent/agents/managed_npm_runtime_versions.json
          git diff --cached --check
          git commit -m "chore: update managed runtime pins"
          git push --force-with-lease origin "${BOT_BRANCH}"

      # The stable branch and head filter keep this workflow to at most one
      # open grouped PR, even when the scheduler and manual trigger overlap.
      - name: Create or refresh the single grouped PR
        if: steps.update.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          cat > /tmp/managed-runtime-pin-pr-body.md <<'EOF'
          ## Summary

          Refresh the reviewed managed npm runtime defaults from stable `latest` metadata.

          The catalogue is validated before this PR is created. This workflow does not install or activate a runtime.
          EOF
          open_pr_number="$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BOT_BRANCH" --base main --state open --json number --jq '.[0].number // ""')"
          if [[ -z "$open_pr_number" ]]; then
            gh pr create \
              --repo "$GITHUB_REPOSITORY" \
              --base main \
              --head "$BOT_BRANCH" \
              --title "chore: update managed runtime pins" \
              --body-file /tmp/managed-runtime-pin-pr-body.md
          else
            gh pr edit "$open_pr_number" \
              --repo "$GITHUB_REPOSITORY" \
              --title "chore: update managed runtime pins" \
              --body-file /tmp/managed-runtime-pin-pr-body.md
          fi

      # GITHUB_TOKEN-created push and pull-request events do not recursively
      # start validation workflows. Dispatch the six required checks explicitly
      # against the exact bot-branch commit after the PR exists.
      - name: Dispatch required checks for generated PR
        if: steps.update.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          for workflow in \
            backend-tests.yml \
            frontend-tests.yml \
            e2e-tests.yml \
            architecture-lint.yml \
            lint-action-pinning.yml \
            lint-harness-files.yml
          do
            gh workflow run "$workflow" \
              --repo "$GITHUB_REPOSITORY" \
              --ref "$BOT_BRANCH"
          done