conda-lock.yml

name: "Update conda lock files"

on:
  schedule:
    - cron: "37 5 * * 1"
  workflow_dispatch:

permissions:
  pull-requests: write
  contents: write

jobs:
  update-conda-lock-files:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: python3 -m pip install tox tox-conda conda-lock

      - name: Update conda
        run: conda update -q conda

      - name: Hash existing lock files
        run: |
          shopt -s globstar
          sha256sum **/locks/*.txt > ${{ runner.temp }}/lock_file_hashes
          cat ${{ runner.temp }}/lock_file_hashes

      - name: Switch branch
        run: |
          git config --local user.name "github-actions[bot]"
          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git switch -c conda-lock-files

      - name: Update CSET lock files
        run: tox -e py39-lock,py310-lock,py311-lock,py312-lock

      - name: Update workflow lock files
        run: |
          py_vers="3.9 3.10 3.11 3.12"
          for py_ver in $py_vers
          do
            cp "cset-workflow/requirements/environment.yml" "${{ runner.temp }}/${py_ver}_environment.yml"
            echo -e "\n  - python = $py_ver" >> "${{ runner.temp }}/${py_ver}_environment.yml"
            conda-lock --channel conda-forge --kind explicit --file "${{ runner.temp }}/${py_ver}_environment.yml" --platform linux-64 --filename-template "cset-workflow/requirements/locks/py$(echo $py_ver | sed 's/\.//')-lock-linux-64.txt" &
          done
          wait

      - name: Generate GitHub App Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.AUTH_APP_ID }}
          private-key: ${{ secrets.AUTH_APP_PRIVATE_KEY }}

      - name: Create pull requests
        run: |
          shopt -s globstar
          git diff --name-status
          if $(sha256sum --status -c ${{ runner.temp }}/lock_file_hashes); then
            echo "Lock files unchanged. Skipping pull request..."
            exit 0
          fi
          # Update lock_file_hashes so pushed branch name is unique.
          sha256sum **/locks/*.txt > ${{ runner.temp }}/lock_file_hashes
          git add **/locks/*.txt
          git commit -m "[CI] Update conda lock files"
          remote_branch_name="conda-lock-$(sha256sum ${{ runner.temp }}/lock_file_hashes | head -c 8)"
          git push --set-upstream origin "conda-lock-files:${remote_branch_name}"
          # Create PR on GitHub using GitHub REST API.
          request_body='{"title":"[CI] Update conda lock files","body":"Created automatically by GitHub Actions.","base":"main","head":"'"${remote_branch_name}"'"}'
          curl -LsS --fail-with-body \
            -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://api.github.com/repos/${{ github.repository }}/pulls \
            -d "$request_body"