neiam /lambent_ex

name: dependency-updates
# Security updates as pull requests: scripts/dependency-update finds the
# Hex dependencies in mix.lock with a known vulnerability (osv-scanner,
# against OSV) that a newer version fixes, bumps them, and keeps one
# pull request — deps/security-hex — refreshed in place, closing it once
# there's nothing left to fix. The pull request is opened by the forge's
# CI account (gg-security) with this job's own token; its CI (audit.yml)
# is what shows the fixes landed. Nothing builds or tests a pull request
# yet, so check a bump builds before merging it: a merge to master
# builds the image and deploys.
#
# The front end's npm packages (assets/package-lock.json) aren't bumped
# here — the script knows Hex and crates.io only — but audit.yml still
# reports them.
#
# Daily, before the nightly audit, and by hand from the Actions page
# (`gg ci dispatch dependency-updates`).
on:
  schedule:
    - cron: "43 5 * * *"
  workflow_dispatch:

permissions:
  contents: write # push the deps/security-hex branch
  pull-requests: write # open, refresh and close its pull request

# A newer push supersedes this run: on a branch or PR the run in
# progress is cancelled; on master it finishes, and only a run still
# waiting is replaced.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

jobs:
  update:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4
        with:
          # The deps/security-* branches too, to tell whether a refresh
          # changed anything before pushing it.
          fetch-depth: 0

      # The same toolchain the Dockerfile builds with (Elixir 1.20.4 on OTP 28.5.0.8):
      # a lockfile is only as good as the resolver that wrote it.
      # OTP and Elixir from builds.hex.pm, the builds setup-beam would
      # fetch — taken directly, since setup-beam chooses one by ImageOS,
      # which this runner sets to "selfhosted" over anything a workflow
      # says.
      - name: OTP and Elixir
        env:
          OTP_VERSION: "28.5.0.8"
          ELIXIR_VERSION: "1.20.4"
        run: |
          ubuntu=$(. /etc/os-release && echo "$VERSION_ID")
          curl -sSfL "https://builds.hex.pm/builds/otp/ubuntu-${ubuntu}/OTP-${OTP_VERSION}.tar.gz" | tar xz -C /tmp
          # Installed where it's unpacked: Install's root is its own directory.
          (cd "/tmp/OTP-${OTP_VERSION}" && ./Install -minimal "/tmp/OTP-${OTP_VERSION}" > /dev/null)
          curl -sSfL -o /tmp/elixir.zip "https://builds.hex.pm/builds/elixir/v${ELIXIR_VERSION}-otp-${OTP_VERSION%%.*}.zip"
          unzip -q -d /tmp/elixir /tmp/elixir.zip
          echo "/tmp/OTP-${OTP_VERSION}/bin" >> "$GITHUB_PATH"
          echo /tmp/elixir/bin >> "$GITHUB_PATH"

      - name: Hex
        run: |
          mix local.hex --force
          mix local.rebar --force

      # Pinned and checked, as in audit.yml; bump both together.
      - name: Fetch osv-scanner
        env:
          OSV_VERSION: v2.6.0
          OSV_SHA256: ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108
        run: |
          curl -sSfL -o /tmp/osv-scanner \
            "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_amd64"
          echo "${OSV_SHA256}  /tmp/osv-scanner" | sha256sum -c -
          chmod +x /tmp/osv-scanner

      - name: Update
        env:
          OSV_SCANNER: /tmp/osv-scanner
          GITHUB_TOKEN: ${{ github.token }}
        run: scripts/dependency-update --base "${{ github.ref_name }}"