feat: automate actions/runner version bumps (bump script + scheduled PR)#55
Merged
Conversation
…PR workflow) Bumping the default actions/runner version was a recurring, deadline-driven, multi-file manual chore (copy checksums, edit runner-checksums.js, action.yml, config, tests, docs, remember npm ci before npm run package). Mechanical + recurring = automate it. - scripts/bump-runner.js codifies the whole recipe in one command: parseChecksums (reads the x64/arm64 SHA-256 from the release body, failing loudly on format drift), applyBump (adds the checksum entries and bumps the default version across action.yml, config, README, and tests — idempotent), then npm ci && npm run package (the gotcha, encoded not documented). Also the manual path: node scripts/bump-runner.js <version>. - .github/workflows/bump-runner.yml: weekly + manual dispatch; detects a newer release, runs the script, and opens a conventional-commit PR citing the release notes and checksum provenance. No auto-merge (removes toil, not judgment). Minimal permissions (contents/pull-requests: write), SHA-pinned actions, GITHUB_TOKEN only. No-op when already latest; skips if the bump branch already exists. - arm64 checksums handled when present (forward-compatible with #43); single-arch today is unaffected. Tests: parseChecksums against a real-format release-body fixture (whitespace tolerance, single-arch, format-drift), applyBump against a temp copy of the real repo files + idempotency (166 tests total). README "Updating the pinned runner version" section replaces the manual recipe; runner-checksums.js maintenance comment points to the automation. Closes #47 Signed-off-by: kurok <22548029+kurok@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #47 — roadmap (#49); pure toil elimination with a security-hygiene side effect (never stuck on a stale, minimum-version-enforced runner).
Problem
Bumping the default
actions/runneris a recurring, multi-file manual recipe (checksums →runner-checksums.js,action.yml, config, tests, docs;npm cibeforenpm run packageor verify-dist churns). GitHub ships runner releases ~monthly and eventually enforces a minimum version — so it's load-bearing and entirely mechanical.What's here
scripts/bump-runner.js— the codified recipe in one command:parseChecksums(body)extracts the linux x64/arm64 SHA-256 from the release body (HTML-comment markers), tolerant of whitespace, failing loudly on format drift.applyBump(root, version, {x64, arm64})adds the checksum entries (keeping history) and bumps the default version acrossaction.yml,src/config.js,README.md, andtests/config.test.js. Idempotent.npm ci && npm run package— the gotcha encoded in code, not prose.node scripts/bump-runner.js 2.336.0..github/workflows/bump-runner.yml— weekly + manual dispatch; detects a newer release, runs the script, opens a conventional-commit PR (fix: bump default actions/runner to X.Y.Z) with release notes + checksum provenance. No auto-merge. Minimal perms (contents/pull-requests: write), SHA-pinned actions,GITHUB_TOKENonly, no-ops when already latest, skips if the bump branch exists.Tests / build
tests/bump-runner.test.js:parseChecksumsagainst a real-format release-body fixture (whitespace tolerance, single-arch, format-drift throw);applyBumpagainst a temp copy of the actual repo files + idempotency + arm64-optional. 166 tests pass (was 159). Lint clean; dist rebuilt only from the runner-checksums.js comment update (verify-dist green).Forward-compat
arm64 checksums are handled when present in the table (composes with the ARM64 issue #43); single-arch today is unaffected.
Docs
README "Updating the pinned runner version" section replaces the manual recipe; the
runner-checksums.jsmaintenance comment now points to the script/bot.