conda-lock.yml

name: "Update conda lock files"

on:
  schedule:
    - cron: "37 5 * * 1"
  workflow_dispatch:

permissions:
  pull-requests: write
  contents: write

jobs:
  update-conda-lock-files:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Setup python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: python3 -m pip install conda-lock

      - name: Update conda
        run: conda update --channel conda-forge --quiet conda

      - name: Hash existing lock files
        run: |
          shopt -s globstar
          sha256sum **/locks/*.txt > ${{ runner.temp }}/lock_file_hashes
          cat ${{ runner.temp }}/lock_file_hashes

      - name: Switch branch
        run: |
          git config --local user.name "github-actions[bot]"
          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git switch -c conda-lock-files

      - name: Update CSET developer and workflow lock files
        run: |
          py_vers="3.10 3.11 3.12 3.13"
          for py_ver in $py_vers
          do
            # Developer lock files.
            cp "requirements/environment.yml" "${{ runner.temp }}/${py_ver}_dev_environment.yml"
            echo -e "\n  - python = $py_ver" >> "${{ runner.temp }}/${py_ver}_dev_environment.yml"
            conda-lock --channel conda-forge --kind explicit --file "${{ runner.temp }}/${py_ver}_dev_environment.yml" --platform linux-64 --filename-template "requirements/locks/py$(echo $py_ver | sed 's/\.//')-lock-linux-64.txt" &

            # Workflow lock files.
            cp "cset-workflow/requirements/environment.yml" "${{ runner.temp }}/${py_ver}_workflow_environment.yml"
            echo -e "\n  - python = $py_ver" >> "${{ runner.temp }}/${py_ver}_workflow_environment.yml"
            conda-lock --channel conda-forge --kind explicit --file "${{ runner.temp }}/${py_ver}_workflow_environment.yml" --platform linux-64 --filename-template "cset-workflow/requirements/locks/py$(echo $py_ver | sed 's/\.//')-lock-linux-64.txt" &
          done
          wait

      - name: Sort lock files to make diffs easier to review
        run: |
          shopt -s globstar
          for file in **/locks/*.txt
          do
            cat "$file" | (sed -u 4q; sort) > sorted.txt
            mv sorted.txt "$file"
          done

      - name: Generate GitHub App Token
        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69
        id: app-token
        with:
          app-id: ${{ secrets.AUTH_APP_ID }}
          private-key: ${{ secrets.AUTH_APP_PRIVATE_KEY }}

      - name: Create pull requests
        run: |
          shopt -s globstar
          git diff --name-status
          if $(sha256sum --status -c ${{ runner.temp }}/lock_file_hashes); then
            echo "Lock files unchanged. Skipping pull request..."
            exit 0
          fi
          # Update lock_file_hashes so pushed branch name is unique.
          sha256sum **/locks/*.txt > ${{ runner.temp }}/lock_file_hashes
          git add **/locks/*.txt
          git commit -m "[CI] Update conda lock files"
          remote_branch_name="conda-lock-$(sha256sum ${{ runner.temp }}/lock_file_hashes | head -c 8)"
          git push --set-upstream origin "conda-lock-files:${remote_branch_name}"
          # Create PR on GitHub using GitHub REST API.
          request_body='{"title":"[CI] Update conda lock files","body":"Created automatically by GitHub Actions.","base":"main","head":"'"${remote_branch_name}"'"}'
          curl -LsS --fail-with-body \
            -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://api.github.com/repos/${{ github.repository }}/pulls \
            -d "$request_body"