From 366167ffcb5e7b854a42cd4d93baba867763382d Mon Sep 17 00:00:00 2001
From: Vitor Carvalho <lightningspirit@gmail.com>
Date: Sat, 17 Oct 2026 17:35:51 +0100
Subject: [PATCH] Add a weekly Sysbox release check

Dependabot cannot update SYSBOX_VERSION in test.yml. The new workflow
opens an issue with the new version and its SHA-256 when a newer Sysbox
release exists. An issue, not a PR: PRs made with GITHUB_TOKEN do not
start the required sysbox check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/scripts/sysbox-release-check.sh | 49 +++++++++++++++++++++++++
 .github/workflows/sysbox-release.yml    | 20 ++++++++++
 .github/workflows/test.yml              |  2 +-
 README.md                               |  3 ++
 4 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100755 .github/scripts/sysbox-release-check.sh
 create mode 100644 .github/workflows/sysbox-release.yml

diff --git a/.github/scripts/sysbox-release-check.sh b/.github/scripts/sysbox-release-check.sh
new file mode 100755
index 0000000..6216e4b
--- /dev/null
+++ b/.github/scripts/sysbox-release-check.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Opens an issue when a newer Sysbox release exists than SYSBOX_VERSION in
+# .github/workflows/test.yml. Dependabot cannot update this version.
+#
+# Needs GH_TOKEN with "issues: write". DRY_RUN=true prints the issue only.
+set -euo pipefail
+cd "$(dirname "$0")/../.."
+
+current="$(sed -n 's/^  SYSBOX_VERSION: //p' .github/workflows/test.yml)"
+[[ -n "${current}" ]] || { echo "SYSBOX_VERSION not found in test.yml" >&2; exit 1; }
+
+release="$(gh api repos/nestybox/sysbox/releases/latest)"
+latest="$(jq -r '.tag_name | ltrimstr("v")' <<<"${release}")"
+echo "Sysbox: current ${current}, latest ${latest}"
+
+newest="$(printf '%s\n%s\n' "${current}" "${latest}" | sort -V | tail -n 1)"
+if [[ "${latest}" == "${current}" || "${newest}" == "${current}" ]]; then
+  echo "Up to date."
+  exit 0
+fi
+
+title="Update Sysbox to v${latest}"
+deb="sysbox-ce_${latest}.linux_amd64.deb"
+sha256="$(jq -r --arg n "${deb}" '.assets[] | select(.name == $n) | .digest // "" | ltrimstr("sha256:")' <<<"${release}")"
+url="$(jq -r '.html_url' <<<"${release}")"
+
+body="A new Sysbox release exists: [v${latest}](${url}). The CI tests use v${current}.
+
+Change these values in \`.github/workflows/test.yml\`:
+
+\`\`\`yaml
+  SYSBOX_VERSION: ${latest}
+  SYSBOX_SHA256: ${sha256:-<get it from the release page>}
+\`\`\`
+
+Then open a PR. The \`sysbox\` check tests the runner image with the new version.
+If it passes, update Sysbox on the runner hosts (x1-hel1) too."
+
+if [[ "${DRY_RUN:-false}" == "true" ]]; then
+  printf 'DRY_RUN: would open the issue "%s":\n\n%s\n' "${title}" "${body}"
+  exit 0
+fi
+
+if [[ -n "$(gh issue list --state open --search "\"${title}\" in:title" --json number --jq '.[0].number // empty')" ]]; then
+  echo "An open issue \"${title}\" exists."
+  exit 0
+fi
+
+gh issue create --title "${title}" --body "${body}"
diff --git a/.github/workflows/sysbox-release.yml b/.github/workflows/sysbox-release.yml
new file mode 100644
index 0000000..b695111
--- /dev/null
+++ b/.github/workflows/sysbox-release.yml
@@ -0,0 +1,20 @@
+name: Sysbox release check
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Open an issue for a new Sysbox release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: .github/scripts/sysbox-release-check.sh
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 317ce81..f58e01c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Lint shell scripts
-        run: shellcheck start.sh tests/*.sh
+        run: shellcheck start.sh tests/*.sh .github/scripts/*.sh
 
       - name: Install Sysbox
         run: |
diff --git a/README.md b/README.md
index 2b17cc9..3dbb174 100644
--- a/README.md
+++ b/README.md
@@ -159,6 +159,9 @@ The `Test` workflow installs Sysbox on a GitHub-hosted runner and runs:
 - `tests/swarm-smoke.sh`: `docker-stack.yml` on a one-node Swarm, the node
   label constraint, and the inner `dockerd` under the default runtime.
 
+The `Sysbox release check` workflow runs every Monday. It opens an issue when
+a newer Sysbox release exists than the version that the tests use.
+
 The tests do not register runners. `SKIP_REGISTRATION=true` keeps a runner
 container up after `dockerd` starts. Use it for tests only.