refresh-lockfiles.yml

# This workflow periodically creates new environment lock files based on the newest
# available packages and dependencies.
#
# Environment specifications are given as conda environment.yml files found in
# `requirements/ci/py**.yml`.  These state the pacakges required, the conda channels
# that the packages will be pulled from, and any versions of packages that need to be
# pinned at specific versions.
#
# For environments that have changed, a pull request will be made and submitted
# to the master branch

name: Refresh Lockfiles


on:
  workflow_dispatch:
    inputs:
      clobber:
        description: |
          Force the workflow to run, potentially clobbering any commits already made to the branch. 
          Enter "yes" or "true" to run.
        default: "no"
  schedule:
    # Run once a week on a Saturday night 
    - cron: 1 0 * * 6


jobs:
  
  no_clobber:
    runs-on: ubuntu-latest
    steps:
      # check if the auto-update-lockfiles branch exists.  If it does, and someone other than
      # the lockfile bot has made the head commit, abort the workflow.
      # This job can be manually overridden by running directly from the github actions panel
      # (known as a "workflow_dispatch") and setting the `clobber` input to "yes".
      - uses: actions/script@v4
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            if (context.eventName == "workflow_dispatch") {
              const clobber = context.payload.inputs.clobber || "no";
              if (["yes", "true", "y"].includes(clobber.trim().toLowerCase())) {
                core.info("Manual override, continuing workflow, potentially overwriting previous commits to auto-update-lockfiles");
                return
              }
            }
            github.repos.getBranch({...context.repo, branch: "auto-update-lockfiles"}).then(res => {
              const committer = res.data.commit.commit.committer;
              if (committer && committer.name === "Lockfile bot") {
                core.info("Lockfile bot was the last to push to auto-update-lockfiles. Continue.");
              } else {
                core.setFailed("New commits to auto-update-lockfiles since bot last ran. Abort!");
              }
            }).catch(err => {
              if (err.status === 404) {
                  core.info("auto-update-lockfiles branch not found, continue");
              }
            })

  gen_lockfiles:
    # this is a matrix job: it splits to create new lockfiles for each
    # of the CI test python versions.
    # this list below should be changed when covering more python versions
    # TODO: generate this matrix automatically from the list of available py**.yml files
    #       ref: https://tomasvotruba.com/blog/2020/11/16/how-to-make-dynamic-matrix-in-github-actions/
    runs-on: ubuntu-latest
    needs: no_clobber
    
    strategy:
      matrix:
        python: ['36', '37', '38']
    
    steps:
      - uses: actions/checkout@v2
      - name: install conda-lock
        run: |
          source $CONDA/bin/activate base
          conda install -y -c conda-forge conda-lock
      - name: generate lockfile
        run: |
          $CONDA/bin/conda-lock lock -p linux-64 -f requirements/ci/py${{matrix.python}}.yml
          mv conda-linux-64.lock py${{matrix.python}}-linux-64.lock
      - name: output lockfile
        uses: actions/upload-artifact@v2
        with:
          path: py${{matrix.python}}-linux-64.lock
    
  create_pr:
    # once the matrix job has completed all the lock files will have been uploaded as artifacts.
    # Download the artifacts, add them to the repo, and create a PR.
    runs-on: ubuntu-latest
    needs: gen_lockfiles
    
    steps:
      - uses: actions/checkout@v2
      - name: get artifacts
        uses: actions/download-artifact@v2
        with:
          path: artifacts
          
      - name: Update lock files in repo
        run: |
          cp artifacts/artifact/*.lock requirements/ci/nox.lock
          rm -r artifacts
        
      - name: Create Pull Request
        uses: peter-evans/create-pull-request@052fc72b4198ba9fbc81b818c6e1859f747d49a8
        with:
          commit-message: Updated environment lockfiles
          committer: "Lockfile bot <noreply@github.com>"
          author: "Lockfile bot <noreply@github.com>"
          delete-branch: true
          branch: auto-update-lockfiles
          title: Update CI environment lockfiles
          body: |
            Lockfiles updated to the latest resolvable environment.