update-pull-request.yml

name: Update pull request

on:
  issue_comment:
    types:
      - created
  workflow_call:
    secrets:
      PULL_REQUEST_UPDATE_TOKEN:
        required: true
    inputs:
      dependabot:
        type: boolean
        required: false
        default: false
      pull-request:
        type: number
        required: false
        default: 0
      pull-request-title:
        type: string
        required: false
        default: ''

jobs:
  is-fork-pull-request:
    name: Determine whether this issue comment was on a pull request from a fork
    if: ${{ inputs.dependabot == true || (github.event.issue.pull_request && startsWith(github.event.comment.body, '@metamaskbot update-pr')) }}
    runs-on: ubuntu-latest
    outputs:
      IS_FORK: ${{ steps.is-fork.outputs.IS_FORK }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Determine whether this PR is from a fork
        id: is-fork
        run: echo "IS_FORK=$(gh pr view --json isCrossRepository --jq '.isCrossRepository' "${PR_NUMBER}" )" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ inputs.pull-request != 0 && inputs.pull-request || github.event.issue.number }}

  react-to-comment:
    name: React to the comment
    runs-on: ubuntu-latest
    needs:
      - is-fork-pull-request
    # Early exit if this is a fork, since later steps are skipped for forks.
    if: ${{ needs.is-fork-pull-request.outputs.IS_FORK == 'false' && inputs.dependabot == false }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: React to the comment
        run: |
          gh api \
            --method POST \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            "/repos/${REPO}/issues/comments/${COMMENT_ID}/reactions" \
            -f content='+1'
        env:
          COMMENT_ID: ${{ github.event.comment.id }}
          GITHUB_TOKEN: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}
          REPO: ${{ github.repository }}

  prepare:
    name: Prepare dependencies
    runs-on: ubuntu-latest
    needs:
      - is-fork-pull-request
    # Early exit if this is a fork, since later steps are skipped for forks.
    if: ${{ needs.is-fork-pull-request.outputs.IS_FORK == 'false' }}
    outputs:
      COMMIT_SHA: ${{ steps.commit-sha.outputs.COMMIT_SHA }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Checkout pull request
        run: gh pr checkout "${PR_NUMBER}"
        env:
          GITHUB_TOKEN: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}
          PR_NUMBER: ${{ inputs.pull-request != 0 && inputs.pull-request || github.event.issue.number }}
      - name: Checkout and setup environment
        uses: MetaMask/action-checkout-and-setup@v1
        with:
          is-high-risk-environment: false
          cache-node-modules: true
      - name: Get commit SHA
        id: commit-sha
        run: echo "COMMIT_SHA=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

  dedupe-yarn-lock:
    name: Deduplicate yarn.lock
    runs-on: ubuntu-latest
    needs: prepare
    outputs:
      YARN_LOCK_CHANGED: ${{ steps.check-yarn-lock.outputs.YARN_LOCK_CHANGED }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Checkout pull request
        run: gh pr checkout "${PR_NUMBER}"
        env:
          GITHUB_TOKEN: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}
          PR_NUMBER: ${{ inputs.pull-request != 0 && inputs.pull-request || github.event.issue.number }}
      - name: Checkout and setup environment
        uses: MetaMask/action-checkout-and-setup@v1
        with:
          is-high-risk-environment: false
      - name: Deduplicate yarn.lock
        run: yarn dedupe
      - name: Check if yarn.lock changed
        id: check-yarn-lock
        run: |
          git diff --exit-code yarn.lock || echo "YARN_LOCK_CHANGED=true" >> "$GITHUB_OUTPUT"
      - name: Save yarn.lock
        uses: actions/upload-artifact@v4
        with:
          name: yarn-lock-${{ needs.prepare.outputs.COMMIT_SHA }}
          path: yarn.lock

  build:
    name: Build packages
    runs-on: ubuntu-latest
    needs:
      - prepare
      - dedupe-yarn-lock
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Checkout pull request
        run: gh pr checkout "${PR_NUMBER}"
        env:
          GITHUB_TOKEN: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}
          PR_NUMBER: ${{ inputs.pull-request != 0 && inputs.pull-request || github.event.issue.number }}
      - name: Restore yarn.lock
        uses: actions/download-artifact@v4
        with:
          name: yarn-lock-${{ needs.prepare.outputs.COMMIT_SHA }}
      - name: Checkout and setup environment
        uses: MetaMask/action-checkout-and-setup@v1
        with:
          # If the Yarn lock changed we need to reinstall the dependencies.
          is-high-risk-environment: ${{ needs.dedupe-yarn-lock.outputs.YARN_LOCK_CHANGED == 'true' }}
      - name: Build packages
        run: yarn build:ci
      - name: Save packages
        uses: actions/upload-artifact@v4
        with:
          name: packages-${{ needs.prepare.outputs.COMMIT_SHA }}
          path: |
            .nvmrc
            packages/*/dist

  regenerate-lavamoat-policies:
    name: Regenerate LavaMoat policies
    runs-on: ubuntu-latest
    needs:
      - prepare
      - dedupe-yarn-lock
      - build
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Checkout pull request
        run: gh pr checkout "${PR_NUMBER}"
        env:
          GITHUB_TOKEN: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}
          PR_NUMBER: ${{ inputs.pull-request != 0 && inputs.pull-request || github.event.issue.number }}
      - name: Restore yarn.lock
        uses: actions/download-artifact@v4
        with:
          name: yarn-lock-${{ needs.prepare.outputs.COMMIT_SHA }}
      - name: Restore packages
        uses: actions/download-artifact@v4
        with:
          name: packages-${{ needs.prepare.outputs.COMMIT_SHA }}
      - name: Checkout and setup environment
        uses: MetaMask/action-checkout-and-setup@v1
        with:
          # If the Yarn lock changed we need to reinstall the dependencies.
          is-high-risk-environment: ${{ needs.dedupe-yarn-lock.outputs.YARN_LOCK_CHANGED == 'true' }}
      - name: Regenerate LavaMoat policies
        run: yarn build:lavamoat:policy
      - name: Save LavaMoat policies
        uses: actions/upload-artifact@v4
        with:
          name: lavamoat-policies-${{ needs.prepare.outputs.COMMIT_SHA }}
          path: |
            .nvmrc
            packages/snaps-execution-environments/lavamoat

  update-examples:
    name: Update examples
    runs-on: ubuntu-latest
    needs:
      - prepare
      - dedupe-yarn-lock
      - build
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Checkout pull request
        run: gh pr checkout "${PR_NUMBER}"
        env:
          GITHUB_TOKEN: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}
          PR_NUMBER: ${{ inputs.pull-request != 0 && inputs.pull-request || github.event.issue.number }}
      - name: Restore yarn.lock
        uses: actions/download-artifact@v4
        with:
          name: yarn-lock-${{ needs.prepare.outputs.COMMIT_SHA }}
      - name: Restore packages
        uses: actions/download-artifact@v4
        with:
          name: packages-${{ needs.prepare.outputs.COMMIT_SHA }}
      - name: Checkout and setup environment
        uses: MetaMask/action-checkout-and-setup@v1
        with:
          # If the Yarn lock changed we need to reinstall the dependencies.
          is-high-risk-environment: ${{ needs.dedupe-yarn-lock.outputs.YARN_LOCK_CHANGED == 'true' }}
      - name: Update examples
        run: yarn build:examples
      - name: Save examples
        uses: actions/upload-artifact@v4
        with:
          name: examples-${{ needs.prepare.outputs.COMMIT_SHA }}
          path: |
            .nvmrc
            packages/examples/packages

  commit-result:
    name: Commit result
    runs-on: ubuntu-latest
    if: ${{ !failure() && !cancelled() && needs.is-fork-pull-request.outputs.IS_FORK == 'false' }}
    needs:
      - is-fork-pull-request
      - prepare
      - dedupe-yarn-lock
      - regenerate-lavamoat-policies
      - update-examples
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          # Use PAT to ensure that the commit later can trigger status check
          # workflows.
          token: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}
      - name: Checkout pull request
        run: gh pr checkout "${PR_NUMBER}"
        env:
          GITHUB_TOKEN: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}
          PR_NUMBER: ${{ inputs.pull-request != 0 && inputs.pull-request || github.event.issue.number }}
      - name: Configure Git
        run: |
          git config --global user.name 'MetaMask Bot'
          git config --global user.email 'metamaskbot@users.noreply.github.com'
      - name: Get commit SHA
        id: commit-sha
        run: echo "COMMIT_SHA=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
      - name: Restore yarn.lock
        uses: actions/download-artifact@v4
        with:
          name: yarn-lock-${{ needs.prepare.outputs.COMMIT_SHA }}
      - name: Set commit prefix
        if: ${{ inputs.dependabot == true }}
        run: echo "COMMIT_PREFIX=[dependabot skip] " >> "$GITHUB_ENV"
      - name: Commit yarn.lock
        run: |
          git add yarn.lock
          git commit -m "${COMMIT_PREFIX}Deduplicate yarn.lock" || true
      - name: Restore LavaMoat policies
        uses: actions/download-artifact@v4
        with:
          name: lavamoat-policies-${{ needs.prepare.outputs.COMMIT_SHA }}
      - name: Commit LavaMoat policies
        run: |
          git add packages/snaps-execution-environments/lavamoat
          git commit -m "${COMMIT_PREFIX}Update LavaMoat policies" || true
      - name: Restore examples
        uses: actions/download-artifact@v4
        with:
          name: examples-${{ needs.prepare.outputs.COMMIT_SHA }}
      - name: Commit examples
        run: |
          git add packages/examples/packages
          git commit -m "${COMMIT_PREFIX}Update example snaps" || true
      - name: Push changes
        run: git push