update-compute-discovery.yml

name: Update Compute Discovery Document

on:
  schedule:
    # Runs every Monday at 09:00 UTC
    - cron: '0 9 * * 1'
  workflow_dispatch: # Allows manual trigger from the GitHub Actions UI

permissions:
  contents: read

jobs:
  update-compute-discovery:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Git user identity
        run: |
          git config user.name "google-cloud-cpp-bot"
          git config user.email "google-cloud-cpp-bot@google.com"

      - name: Run update_discovery_doc.sh
        run: |
          ./generator/discovery/update_discovery_doc.sh --no-create-branch

      - name: Run checkers
        run: |
          status=0
          ci/cloudbuild/build.sh -t checkers-pr || status=$?
          if [[ ${status} -eq 111 ]]; then
            echo "Checkers produced formatting and documentation updates. Committing changes..."
            # Exclude .github directory from automated commit to prevent workflow permission errors
            git add -A -- ':!.github'
            if ! git diff --cached --quiet; then
              git commit -m "chore: apply formatting from checkers"
            fi
          elif [[ ${status} -ne 0 ]]; then
            echo "Checkers failed with unexpected exit code ${status}."
            exit "${status}"
          fi

      - name: Push branch and create Pull Request if changes exist
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BOT_TOKEN: ${{ secrets.GOOGLE_CLOUD_CPP_BOT_TOKEN }}
        run: |
          # Fetch latest main from remote and rebase any newly generated commits on top of it.
          # This ensures the pushed branch includes any workflow updates made on main while the
          # long-running build was executing, avoiding push rejection due to missing workflow permissions.
          echo "Fetching latest main from remote..."
          git fetch "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" main
          echo "Rebasing onto latest main..."
          if ! git rebase FETCH_HEAD; then
            echo "::error::Rebase failed due to merge conflicts."
            git rebase --abort
            exit 1
          fi

          # Ensure no workflow files were inadvertently touched in the branch
          if git diff --name-only FETCH_HEAD HEAD | grep -q '^\.github/'; then
            echo "Changes to .github/ detected in branch. Discarding to prevent push rejection..."
            git checkout FETCH_HEAD -- .github
            git commit -a --amend --no-edit || true
          fi

          # Check if a new commit was made (HEAD differs from FETCH_HEAD)
          if [[ "$(git rev-parse HEAD)" != "$(git rev-parse FETCH_HEAD)" ]]; then
            if [[ -n "${BOT_TOKEN}" ]]; then
              BOT_USER="google-cloud-cpp-bot"
              echo "Ensuring fork ${BOT_USER}/google-cloud-cpp exists and is synced..."
              GH_TOKEN="${BOT_TOKEN}" gh api -X POST "repos/${GITHUB_REPOSITORY}/forks" --silent
              for _ in {1..15}; do
                if GH_TOKEN="${BOT_TOKEN}" gh api "repos/${BOT_USER}/google-cloud-cpp" --silent 2>/dev/null; then
                  break
                fi
                sleep 2
              done
              GH_TOKEN="${BOT_TOKEN}" gh api -X POST "repos/${BOT_USER}/google-cloud-cpp/merge-upstream" -f branch=main --silent || true

              echo "Changes detected. Pushing branch automation/update-compute-discovery to ${BOT_USER}/google-cloud-cpp..."
              git push "https://x-access-token:${BOT_TOKEN}@github.com/${BOT_USER}/google-cloud-cpp.git" HEAD:automation/update-compute-discovery --force
              HEAD_REF="${BOT_USER}:automation/update-compute-discovery"
              PR_CREATOR_TOKEN="${BOT_TOKEN}"
            else
              echo "Changes detected. Pushing branch automation/update-compute-discovery..."
              git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:automation/update-compute-discovery --force
              HEAD_REF="automation/update-compute-discovery"
              PR_CREATOR_TOKEN="${GH_TOKEN}"
            fi

            echo "Checking if a PR is already open..."
            if ! gh pr list --repo "${GITHUB_REPOSITORY}" --head "automation/update-compute-discovery" --json number -q '.[0].number' | grep -q '^[0-9]'; then
              echo "Opening new PR..."
              BODY="Automated update of Compute Engine Discovery Document and generated C++ client code.\n\nTriggered automatically by the \`update-compute-discovery\` workflow."
              PR_URL=$(GH_TOKEN="${PR_CREATOR_TOKEN}" gh pr create \
                --repo "${GITHUB_REPOSITORY}" \
                --title "feat(compute): update discovery doc and generate new services" \
                --body "$(printf '%b' "$BODY")" \
                --base main \
                --head "${HEAD_REF}")
              echo "Created PR: ${PR_URL}"
              gh pr edit "${PR_URL}" --repo "${GITHUB_REPOSITORY}" --add-label "api: compute"
            else
              echo "Pull request already exists for automation/update-compute-discovery. Branch has been updated."
            fi
          else
            echo "No changes committed. Nothing to push or create."
          fi