elizaos--eliza/.github/workflows/update-vendor-checksums.yml

name: Update vendor checksums

on:
  schedule:
    - cron: '0 0 * * 0'  # Every Sunday at 00:00 UTC
  workflow_dispatch:

# Default to least privilege. Override per-job where needed.
permissions:
  contents: read

jobs:
  update-checksums:
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

      - name: Download and hash platform-tools
        run: |
          set -euo pipefail

          CHECKSUMS_FILE="packages/os/setup/vendor/checksums.json"

          download_and_hash() {
            local platform="$1"
            local url="$2"
            local tmp_file
            tmp_file="$(mktemp --suffix=.zip)"

            echo "Downloading platform-tools for $platform…"
            curl -fsSL --retry 3 --retry-delay 5 -o "$tmp_file" "$url"

            local sha256
            sha256="$(sha256sum "$tmp_file" | awk '{print $1}')"
            echo "$platform: $sha256"

            # Inject sha256 into checksums.json using jq
            jq --arg platform "$platform" \
               --arg sha256 "$sha256" \
               --arg url "$url" \
               '.["platform-tools"][$platform].sha256 = $sha256 | .["platform-tools"][$platform].url = $url' \
               "$CHECKSUMS_FILE" > "${CHECKSUMS_FILE}.tmp"
            mv "${CHECKSUMS_FILE}.tmp" "$CHECKSUMS_FILE"

            rm -f "$tmp_file"
          }

          download_and_hash "darwin" "https://dl.google.com/android/repository/platform-tools-latest-darwin.zip"
          download_and_hash "linux"  "https://dl.google.com/android/repository/platform-tools-latest-linux.zip"
          download_and_hash "win32"  "https://dl.google.com/android/repository/platform-tools-latest-windows.zip"

          if git diff --quiet "$CHECKSUMS_FILE"; then
            echo "No platform-tools checksum or URL changes."
          else
            # Update the timestamp only when pinned vendor content changes.
            jq --arg ts "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
               '."last-updated" = $ts' \
               "$CHECKSUMS_FILE" > "${CHECKSUMS_FILE}.tmp"
            mv "${CHECKSUMS_FILE}.tmp" "$CHECKSUMS_FILE"
          fi

          echo "Updated checksums.json:"
          cat "$CHECKSUMS_FILE"

      - name: Create PR if checksums changed
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail

          CHECKSUMS_FILE="packages/os/setup/vendor/checksums.json"

          if git diff --quiet "$CHECKSUMS_FILE"; then
            echo "No changes to checksums — skipping PR."
            exit 0
          fi

          BRANCH="chore/update-vendor-checksums-$(date -u +%Y%m%d)-${GITHUB_RUN_ID}"

          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git checkout -b "$BRANCH"
          git add "$CHECKSUMS_FILE"
          git commit -m "chore: update vendor checksums $(date -u +%Y-%m-%d)"
          git push origin "$BRANCH"

          body_file="$(mktemp)"
          cat > "$body_file" <<'EOF'
          ## Automated vendor checksum update

          Weekly update of SHA-256 hashes for Android Platform Tools in
          `packages/os/setup/vendor/checksums.json`.

          - macOS platform-tools
          - Linux platform-tools
          - Windows platform-tools

          Sideloader is fetched at install time from the GitHub releases API
          and is not pinned here.

          > Generated by the `update-vendor-checksums` workflow.
          EOF

          set +e
          pr_output="$(gh pr create \
            --title "chore: update vendor checksums $(date -u +%Y-%m-%d)" \
            --body-file "$body_file" \
            --base develop \
            --head "$BRANCH" \
            --label "dependencies,automated" 2>&1)"
          pr_status=$?
          set -e

          echo "$pr_output"
          if [ "$pr_status" -ne 0 ]; then
            if grep -q "GitHub Actions is not permitted to create or approve pull requests" <<<"$pr_output"; then
              echo "::warning::GitHub repository policy blocked PR creation from Actions. The checksum update branch was pushed: $BRANCH"
              exit 0
            fi

            exit "$pr_status"
          fi