parse action versions out of workflow files (#420)

- parse action versions out of workflow files when the versions in that action file are managed by dependabot

This will allow us to configure dependabot version upgrades for repos that use mono_repo to generate (and re-generate) their actions configurations.

Code generate the hard coded versions from our own workflow file so that dependabot can manage that as well.

Author: devoncarew

.github/workflows/dart.yml

@@ -1,3 +1,8 @@
+## 6.5.7
+
+- Updated `mono_repo` to use the existing action versions from the generated
+  workflow file when dependabot is configured for the repo.
+
 ## 6.5.6
 
 - Restore the previous ordering behavior for jobs by using a secondary sort

mono_repo/CHANGELOG.md

@@ -228,5 +228,20 @@ Look at these repositories for examples of `mono_repo` usage:
 * https://github.com/dart-lang/webdev
 * https://github.com/google/json_serializable.dart
 
+## Mono_repo and Dependabot
+
+Historically, package:mono_repo and Dependabot couldn't be used together -
+they both wanted to maintain your GitHub workflow file. We've adopted mono_repo
+so that you can now use both it and Dependabot in your repo.
+
+When generating your workflow configuration (`mono_repo generate`) mono_repo
+will write out its current default action versions into the workflow file. If
+however it sees that the repo has a Dependabot configuration - has a file named
+`.github/dependabot.yaml` in the repo - mono_repo will instead parse the
+workflow file, read out the current action versions, and use those versions when
+re-generating the file. This lets mono_repo manage the overall structure of the
+file, while allowing Dependabot to independently move various action versions
+forward as necessary.
+
 [Dart packages]: https://dart.dev/guides/libraries/create-library-packages
 [setup your PATH]: https://dart.dev/tools/pub/cmd/pub-global#running-a-script-from-your-path

mono_repo/README.md

@@ -1,41 +1,43 @@
+import '../../root_config.dart';
+import 'action_versions.dart';
 import 'job.dart';
 import 'step.dart';
 
 enum ActionInfo implements Comparable<ActionInfo> {
   cache(
     name: 'Cache Pub hosted dependencies',
     repo: 'actions/cache',
-    version: '88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8', // v3.3.1
+    version: actionsCacheVersion,
   ),
   checkout(
     name: 'Checkout repository',
     repo: 'actions/checkout',
-    version: '8e5e7e5ab8b370d6c329ec480221332ada57f0ab', // v3.5.2
+    version: actionsCheckoutVersion,
   ),
   setupDart(
     name: 'Setup Dart SDK',
     repo: 'dart-lang/setup-dart',
-    version: 'd6a63dab3335f427404425de0fbfed4686d93c4f', // v1.5.0
+    version: dartLangSetupDartVersion,
   ),
   setupFlutter(
     name: 'Setup Flutter SDK',
     repo: 'subosito/flutter-action',
-    version: '48cafc24713cca54bbe03cdc3a423187d413aafa', // v2.10.0
+    version: subositoFlutterActionVersion,
   ),
 
   /// See https://github.com/marketplace/actions/coveralls-github-action
   coveralls(
     name: 'Upload coverage to Coveralls',
     repo: 'coverallsapp/github-action',
-    version: 'master',
+    version: coverallsappGithubActionVersion,
     completionJobFactory: _coverageCompletionJob,
   ),
 
   /// See https://github.com/marketplace/actions/codecov
   codecov(
     name: 'Upload coverage to codecov.io',
     repo: 'codecov/codecov-action',
-    version: 'main',
+    version: codecovCodecovActionVersion,
   );
 
   const ActionInfo({
@@ -48,16 +50,19 @@ enum ActionInfo implements Comparable<ActionInfo> {
   final String repo;
   final String version;
   final String name;
-  final Job Function()? completionJobFactory;
+  final Job Function(RootConfig rootConfig)? completionJobFactory;
 
   Step usage({
     String? name,
     String? id,
     Map<String, dynamic>? withContent,
+    Map<String, String>? versionOverrides,
   }) {
     name ??= this.name;
+    final useVersion =
+        (versionOverrides == null ? null : versionOverrides[repo]) ?? version;
     final step = Step.uses(
-      uses: '$repo@$version',
+      uses: '$repo@$useVersion',
       id: id,
       name: name,
       withContent: withContent,
@@ -71,7 +76,7 @@ enum ActionInfo implements Comparable<ActionInfo> {
   int compareTo(ActionInfo other) => index.compareTo(other.index);
 }
 
-Job _coverageCompletionJob() => Job(
+Job _coverageCompletionJob(RootConfig rootConfig) => Job(
       name: 'Mark Coveralls job finished',
       runsOn: 'ubuntu-latest',
       steps: [
@@ -82,6 +87,7 @@ Job _coverageCompletionJob() => Job(
             'github-token': r'${{ secrets.GITHUB_TOKEN }}',
             'parallel-finished': true
           },
+          versionOverrides: rootConfig.existingActionVersions,
         )
       ],
     );

mono_repo/lib/src/commands/github/action_info.dart

@@ -0,0 +1,14 @@
+// Copyright (c) 2023, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+/// This file is generated, and should not be modified by hand.
+///
+/// To regenerate it, run the `tool/generate_action_versions.dart` script.
+
+const actionsCacheVersion = '88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8';
+const dartLangSetupDartVersion = 'd6a63dab3335f427404425de0fbfed4686d93c4f';
+const actionsCheckoutVersion = '8e5e7e5ab8b370d6c329ec480221332ada57f0ab';
+const subositoFlutterActionVersion = '48cafc24713cca54bbe03cdc3a423187d413aafa';
+const coverallsappGithubActionVersion = 'master';
+const codecovCodecovActionVersion = 'main';

mono_repo/lib/src/commands/github/action_versions.dart

@@ -12,6 +12,11 @@ import '../../root_config.dart';
 import '../../user_exception.dart';
 import 'github_yaml.dart';
 
+const dependabotFileNames = [
+  '.github/dependabot.yaml',
+  '.github/dependabot.yml',
+];
+
 void generateGitHubActions(
   RootConfig rootConfig, {
   bool validateOnly = false,

mono_repo/lib/src/commands/github/generate.dart

@@ -122,7 +122,7 @@ Map<String, String> generateGitHubYml(RootConfig rootConfig) {
         Map.fromEntries(allJobs.map((e) => MapEntry(e.id, e.value)));
 
     for (var completion in completionMap.entries) {
-      final job = completion.key.completionJobFactory!()
+      final job = completion.key.completionJobFactory!(rootConfig)
         ..needs = completion.value.toList();
 
       jobList['job_${jobList.length + 1}'] = job;
@@ -204,7 +204,10 @@ Iterable<_MapEntryWithStage> _listJobs(
 
   for (var job in jobs) {
     if (job is _SelfValidateJob) {
-      yield jobEntry(_selfValidateJob(rootConfig.monoConfig), job.stageName);
+      yield jobEntry(
+        _selfValidateJob(rootConfig.monoConfig, rootConfig),
+        job.stageName,
+      );
       continue;
     }
 
@@ -340,6 +343,7 @@ extension on CIJobEntry {
       job.flavor,
       job.sdk,
       commandEntries,
+      rootConfig,
       config: rootConfig.monoConfig,
       additionalCacheKeys: {
         'packages': packages.join('-'),
@@ -382,7 +386,8 @@ Job _githubJob(
   String runsOn,
   PackageFlavor packageFlavor,
   String sdkVersion,
-  List<_CommandEntryBase> runCommands, {
+  List<_CommandEntryBase> runCommands,
+  RootConfig rootConfig, {
   required BasicConfiguration config,
   Map<String, String>? additionalCacheKeys,
 }) =>
@@ -393,17 +398,20 @@ Job _githubJob(
         if (!runsOn.startsWith('windows'))
           _cacheEntries(
             runsOn,
+            rootConfig: rootConfig,
             additionalCacheKeys: {
               'sdk': sdkVersion,
               if (additionalCacheKeys != null) ...additionalCacheKeys,
             },
           ),
-        packageFlavor.setupStep(sdkVersion),
+        packageFlavor.setupStep(sdkVersion, rootConfig),
         ..._beforeSteps(runCommands.whereType<_CommandEntry>()),
         ActionInfo.checkout.usage(
           id: 'checkout',
+          versionOverrides: rootConfig.existingActionVersions,
         ),
-        for (var command in runCommands) ...command.runContent(config),
+        for (var command in runCommands)
+          ...command.runContent(config, rootConfig),
       ],
     );
 
@@ -424,7 +432,7 @@ class _CommandEntryBase {
 
   _CommandEntryBase(this.name, this.run);
 
-  Iterable<Step> runContent(BasicConfiguration config) =>
+  Iterable<Step> runContent(BasicConfiguration config, RootConfig rootConfig) =>
       [Step.run(name: name, run: run)];
 }
 
@@ -444,15 +452,16 @@ class _CommandEntry extends _CommandEntryBase {
   });
 
   @override
-  Iterable<Step> runContent(BasicConfiguration config) => [
+  Iterable<Step> runContent(BasicConfiguration config, RootConfig rootConfig) =>
+      [
         Step.run(
           id: id,
           name: name,
           ifContent: ifCondition,
           workingDirectory: workingDirectory,
           run: run,
         ),
-        ...?type?.afterEachSteps(workingDirectory, config),
+        ...?type?.afterEachSteps(workingDirectory, config, rootConfig),
       ];
 }
 
@@ -464,6 +473,7 @@ class _CommandEntry extends _CommandEntryBase {
 /// store and retrieve the cache.
 Step _cacheEntries(
   String runsOn, {
+  required RootConfig rootConfig,
   Map<String, String>? additionalCacheKeys,
 }) {
   final cacheKeyParts = [
@@ -490,6 +500,7 @@ Step _cacheEntries(
       'key': restoreKeys.first,
       'restore-keys': restoreKeys.skip(1).join('\n'),
     },
+    versionOverrides: rootConfig.existingActionVersions,
   );
 }
 
@@ -500,7 +511,8 @@ String _maxLength(String input) {
   return input.substring(0, 512 - hash.length) + hash;
 }
 
-Job _selfValidateJob(BasicConfiguration config) => _githubJob(
+Job _selfValidateJob(BasicConfiguration config, RootConfig rootConfig) =>
+    _githubJob(
       selfValidateJobName,
       _ubuntuLatest,
       PackageFlavor.dart,
@@ -509,6 +521,7 @@ Job _selfValidateJob(BasicConfiguration config) => _githubJob(
         for (var command in selfValidateCommands)
           _CommandEntryBase(selfValidateJobName, command),
       ],
+      rootConfig,
       config: config,
     );
 
@@ -537,16 +550,18 @@ class _MapEntryWithStage {
 }
 
 extension on PackageFlavor {
-  Step setupStep(String sdkVersion) {
+  Step setupStep(String sdkVersion, RootConfig rootConfig) {
     switch (this) {
       case PackageFlavor.dart:
         return ActionInfo.setupDart.usage(
           withContent: {'sdk': sdkVersion},
+          versionOverrides: rootConfig.existingActionVersions,
         );
 
       case PackageFlavor.flutter:
         return ActionInfo.setupFlutter.usage(
           withContent: {'channel': sdkVersion},
+          versionOverrides: rootConfig.existingActionVersions,
         );
     }
   }

mono_repo/lib/src/commands/github/github_yaml.dart

@@ -7,7 +7,10 @@ import 'dart:io';
 
 import 'package:path/path.dart' as p;
 import 'package:pubspec_parse/pubspec_parse.dart';
+import 'package:yaml/yaml.dart';
 
+import 'commands/github/generate.dart';
+import 'commands/github/github_yaml.dart';
 import 'mono_config.dart';
 import 'package_config.dart';
 import 'user_exception.dart';
@@ -60,6 +63,7 @@ class RootConfig extends ListBase<PackageConfig> {
   final String rootDirectory;
   final MonoConfig monoConfig;
   final List<PackageConfig> _configs;
+  final Map<String, String>? existingActionVersions;
 
   factory RootConfig({String? rootDirectory, bool recursive = true}) {
     rootDirectory ??= p.current;
@@ -94,14 +98,35 @@ class RootConfig extends ListBase<PackageConfig> {
       );
     }
 
+    // If a dependabot configuration file exists, assume the action versions in
+    // the generated workflow file are maintained by dependabot; parse and use
+    // those versions.
+    Map<String, String>? existingActionVersions;
+    final hasDependabot = dependabotFileNames
+        .map((name) => File(p.join(rootDirectory!, name)))
+        .any((file) => file.existsSync());
+    final githubWorkflowFile =
+        File(p.join(rootDirectory, defaultGitHubWorkflowFilePath));
+    if (hasDependabot && githubWorkflowFile.existsSync()) {
+      existingActionVersions = parseActionVersions(
+        githubWorkflowFile.readAsStringSync(),
+      );
+    }
+
     return RootConfig._(
       rootDirectory,
       MonoConfig.fromRepo(rootDirectory: rootDirectory),
       configs,
+      existingActionVersions,
     );
   }
 
-  RootConfig._(this.rootDirectory, this.monoConfig, this._configs);
+  RootConfig._(
+    this.rootDirectory,
+    this.monoConfig,
+    this._configs,
+    this.existingActionVersions,
+  );
 
   @override
   int get length => _configs.length;
@@ -116,4 +141,42 @@ class RootConfig extends ListBase<PackageConfig> {
   @override
   void operator []=(int index, PackageConfig pkg) =>
       throw UnsupportedError('This List is read-only.');
+
+  /// Parse any github action versions from a workflow file.
+  ///
+  /// This returns a map of <action name> to <action version>.
+  static Map<String, String> parseActionVersions(String yamlText) {
+    // "dart-lang/setup-dart@6a218f2413a3e78e9087f638a238f6b40893203d"
+    final usageRegex = RegExp(r'([\w\.-]+)\/([\w\.-]+)@([\w\.]+)');
+
+    final yaml = loadYaml(yamlText);
+    final result = <String, String>{};
+
+    void collect(dynamic yaml) {
+      if (yaml is List) {
+        for (var item in yaml) {
+          collect(item);
+        }
+      } else if (yaml is Map) {
+        const usesKey = 'uses';
+
+        if (yaml.containsKey(usesKey)) {
+          // dart-lang/setup-dart@6a218f2413a3e78e9087f638a238f6b40893203d
+          final usage = yaml[usesKey] as String;
+          final match = usageRegex.firstMatch(usage);
+          if (match != null) {
+            result['${match.group(1)}/${match.group(2)}'] = match.group(3)!;
+          }
+        }
+
+        for (var item in yaml.entries) {
+          collect(item.value);
+        }
+      }
+    }
+
+    collect(yaml);
+
+    return result;
+  }
 }