Skip to content

Commit 7d22d0a

Browse files
shm11C3shm11C3
authored
feat: add setup-safe-chain action and auto-update workflow (#966)
1 parent 88bccf6 commit 7d22d0a

File tree

3 files changed

+178
-11
lines changed

3 files changed

+178
-11
lines changed

‎.github/actions/setup-node/action.yml‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,17 +19,8 @@ runs:
1919
node-version: ${{ inputs.node-version }}
2020
cache: "npm"
2121

22-
- name: Setup safe-chain (Windows)
23-
if: runner.os == 'Windows'
24-
shell: pwsh
25-
run: |
26-
iex (iwr "https://raw.githubusercontent.com/AikidoSec/safe-chain/main/install-scripts/install-safe-chain.ps1" -UseBasicParsing)
27-
28-
- name: Setup safe-chain (Unix)
29-
if: runner.os != 'Windows'
30-
shell: bash
31-
run: |
32-
curl -fsSL https://raw.githubusercontent.com/AikidoSec/safe-chain/main/install-scripts/install-safe-chain.sh | sh -s -- --ci
22+
- name: Setup safe-chain
23+
uses: ./.github/actions/setup-safe-chain
3324

3425
- name: Install dependencies
3526
if: inputs.install-deps == 'true'

‎.github/actions/setup-safe-chain/action.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: "Setup safe-chain"
2+
description: "Install pinned safe-chain with caching"
3+
inputs:
4+
safe-chain-version:
5+
description: "safe-chain version to install (pinned by default)"
6+
required: false
7+
default: "1.3.3"
8+
9+
runs:
10+
using: "composite"
11+
steps:
12+
- name: Cache safe-chain (Windows)
13+
if: runner.os == 'Windows'
14+
uses: actions/cache@v4
15+
with:
16+
path: ${{ env.USERPROFILE }}\\.safe-chain\\bin
17+
key: safe-chain-${{ runner.os }}-${{ runner.arch }}-${{ inputs.safe-chain-version }}
18+
19+
- name: Cache safe-chain (Unix)
20+
if: runner.os != 'Windows'
21+
uses: actions/cache@v4
22+
with:
23+
path: ~/.safe-chain/bin
24+
key: safe-chain-${{ runner.os }}-${{ runner.arch }}-${{ inputs.safe-chain-version }}
25+
26+
- name: Add safe-chain to PATH (Windows)
27+
if: runner.os == 'Windows'
28+
shell: pwsh
29+
run: |
30+
"$env:USERPROFILE\\.safe-chain\\bin" | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
31+
32+
- name: Add safe-chain to PATH (Unix)
33+
if: runner.os != 'Windows'
34+
shell: bash
35+
run: |
36+
echo "$HOME/.safe-chain/bin" >> "$GITHUB_PATH"
37+
38+
- name: Setup safe-chain (Windows)
39+
if: runner.os == 'Windows'
40+
shell: pwsh
41+
run: |
42+
$ErrorActionPreference = 'Stop'
43+
44+
$version = '${{ inputs.safe-chain-version }}'
45+
$env:SAFE_CHAIN_VERSION = $version
46+
47+
$installScriptUrl = "https://raw.githubusercontent.com/AikidoSec/safe-chain/$version/install-scripts/install-safe-chain.ps1"
48+
$scriptPath = Join-Path $env:RUNNER_TEMP 'install-safe-chain.ps1'
49+
50+
Invoke-WebRequest -Uri $installScriptUrl -OutFile $scriptPath -UseBasicParsing
51+
& $scriptPath -ci
52+
53+
- name: Setup safe-chain (Unix)
54+
if: runner.os != 'Windows'
55+
shell: bash
56+
env:
57+
SAFE_CHAIN_VERSION: ${{ inputs.safe-chain-version }}
58+
run: |
59+
set -euo pipefail
60+
61+
curl -fsSL "https://raw.githubusercontent.com/AikidoSec/safe-chain/${{ inputs.safe-chain-version }}/install-scripts/install-safe-chain.sh" | sh -s -- --ci

‎.github/workflows/auto-update-safe-chain.yml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
name: Auto update safe-chain version
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
# Every Monday 09:30 JST (00:30 UTC)
7+
- cron: "30 0 * * 1"
8+
9+
permissions:
10+
contents: write
11+
pull-requests: write
12+
13+
concurrency:
14+
group: auto-update-safe-chain
15+
cancel-in-progress: true
16+
17+
jobs:
18+
update:
19+
runs-on: ubuntu-latest
20+
21+
steps:
22+
- uses: actions/create-github-app-token@v2
23+
id: generate-token
24+
with:
25+
app-id: ${{ secrets.APP_ID }}
26+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
27+
28+
- name: Checkout
29+
uses: actions/checkout@v6
30+
with:
31+
fetch-depth: 1
32+
33+
- name: Resolve latest safe-chain release tag
34+
id: resolve
35+
env:
36+
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
37+
run: |
38+
set -euo pipefail
39+
40+
api_url='https://api.github.com/repos/AikidoSec/safe-chain/releases/latest'
41+
latest_tag="$(
42+
curl -fsSL \
43+
-H "Authorization: Bearer ${GH_TOKEN}" \
44+
-H 'Accept: application/vnd.github+json' \
45+
-H 'X-GitHub-Api-Version: 2022-11-28' \
46+
"$api_url" \
47+
| node -e 'let s=""; process.stdin.on("data",c=>s+=c); process.stdin.on("end",()=>{console.log(JSON.parse(s).tag_name)})'
48+
)"
49+
50+
if [ -z "$latest_tag" ]; then
51+
echo 'Failed to resolve latest safe-chain tag.' >&2
52+
exit 1
53+
fi
54+
55+
echo "latest_tag=$latest_tag" >> "$GITHUB_OUTPUT"
56+
57+
- name: Update pinned safe-chain version
58+
env:
59+
LATEST_TAG: ${{ steps.resolve.outputs.latest_tag }}
60+
run: |
61+
set -euo pipefail
62+
63+
file='.github/actions/setup-safe-chain/action.yml'
64+
65+
if ! grep -q '^ safe-chain-version:' "$file"; then
66+
echo "Expected 'safe-chain-version' input not found in $file" >&2
67+
exit 1
68+
fi
69+
70+
current="$(
71+
node -e 'const fs=require("fs"); const y=fs.readFileSync(process.argv[1],"utf8"); const m=y.match(/^\s*safe-chain-version:\n(?:.|\n)*?^\s*default:\s*"([^"]+)"/m); console.log(m?m[1]:"")' "$file"
72+
)"
73+
74+
if [ -z "$current" ]; then
75+
echo "Failed to parse current pinned version from $file" >&2
76+
exit 1
77+
fi
78+
79+
if [ "$current" = "$LATEST_TAG" ]; then
80+
echo "Already up-to-date: $current"
81+
exit 0
82+
fi
83+
84+
node -e '
85+
const fs=require("fs");
86+
const file=process.argv[1];
87+
const latest=process.argv[2];
88+
const text=fs.readFileSync(file,"utf8");
89+
const updated=text.replace(
90+
/(\n\s*safe-chain-version:\n(?:.|\n)*?\n\s*default:\s*")([^"]+)("\s*\n)/m,
91+
`$1${latest}$3`
92+
);
93+
if (updated===text) process.exit(2);
94+
fs.writeFileSync(file,updated);
95+
' "$file" "$LATEST_TAG"
96+
97+
- name: Create Pull Request
98+
uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
99+
with:
100+
token: ${{ steps.generate-token.outputs.token }}
101+
commit-message: "chore(ci): bump safe-chain"
102+
title: "chore(ci): bump safe-chain"
103+
body: |
104+
This PR was created automatically.
105+
106+
- Updates pinned safe-chain version in `.github/actions/setup-safe-chain/action.yml`
107+
- Schedule: weekly
108+
branch: chore/auto-safe-chain-bump
109+
add-paths: |
110+
.github/actions/setup-safe-chain/action.yml
111+
delete-branch: true
112+
labels: |
113+
dependencies
114+
automated
115+
signoff: false

0 commit comments

Comments
 (0)