mega-linter-runner/generators/mega-linter-custom-flavor/templates/check-new-megalinter-version.yml

Local runner for MegaLinter

---
# =============================================================
# Check for New MegaLinter Version Workflow
#
# This workflow checks daily for new versions of the MegaLinter
# custom-builder action and creates a release if a new version is found.
#
# Usage:
# - Runs daily at 00:00 UTC via schedule
# - Can be manually triggered via workflow_dispatch
# - Compares MegaLinter tags with current repository tags
# - Creates a new release if a new MegaLinter version is detected
#
# The workflow will:
# 1. Fetch all tags from oxsecurity/megalinter repository
# 2. Fetch all tags from the current repository
# 3. Find new tags that exist in MegaLinter but not in current repo
# 4. Create a release with the new version tag
# 5. The release will trigger megalinter-custom-flavor-builder.yml
#
# Required permissions:
#   - contents: write (to create releases and tags)
#
# Required repository secrets:
#   - PAT_TOKEN: Personal Access Token with 'contents' and 'actions' permissions
#     This is required to trigger the builder workflow. Without it, the workflow
#     will fail and the release will be deleted (to be recreated once the token is set).
#
# SECURITY WARNING: Using a PAT comes with risk. Open-source projects have been
# heavily targeted by supply-chain attacks in recent months, and a leaked or
# compromised PAT can give attackers broad write access to your repository —
# better safe than sorry! If you do not need fully automatic daily version
# sync, you can skip the PAT entirely and trigger this workflow manually
# (Actions tab → "Check for New MegaLinter Version" → "Run workflow") whenever
# you want to bump to a new MegaLinter release. Only configure PAT_TOKEN if
# the daily automation is worth the trade-off, and always scope it to this
# single repository with the minimum required permissions.
#
# To create a Fine-grained PAT (still discouraged unless you need automation):
#   1. Go to GitHub Settings > Developer settings > Personal access tokens > Fine-grained tokens
#   2. Click "Generate new token"
#   3. Give it a descriptive name (e.g., "MegaLinter Auto-Release")
#   4. Set expiration (e.g., 90 days or 1 year)
#   5. Under "Repository access", select "Only select repositories"
#   6. Choose this repository (megalinter-custom-flavor-npm-groovy-lint)
#   7. Under "Permissions" > "Repository permissions":
#      - Contents: Read and write
#      - Actions: Read and write
#   8. Click "Generate token" and copy the token
#   9. In your repository, go to Settings > Secrets and variables > Actions
#   10. Click "New repository secret"
#   11. Name: PAT_TOKEN, Value: paste your token
# =============================================================
name: Check for New MegaLinter Version

on:
  schedule:
    # Run daily at 00:00 UTC
    - cron: "0 0 * * *"
  workflow_dispatch:

permissions:
  contents: write

jobs:
  check-new-version:
    name: Check for New MegaLinter Version
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Fetch MegaLinter Repository Tags
        id: fetch-megalinter-tags
        run: |
          echo "Fetching tags from oxsecurity/megalinter..."

          # Fetch all tags from MegaLinter repository (filtering for version tags only)
          MEGALINTER_TAGS=$(git ls-remote --tags --refs https://github.com/oxsecurity/megalinter.git | \
            grep -E 'refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$' | \
            sed 's/.*refs\/tags\///' | \
            sort -V | \
            tail -n 20)

          echo "Latest MegaLinter tags:"
          echo "$MEGALINTER_TAGS"

          # Get the latest tag
          LATEST_MEGALINTER_TAG=$(echo "$MEGALINTER_TAGS" | tail -n 1)
          echo "latest_tag=$LATEST_MEGALINTER_TAG" >> $GITHUB_OUTPUT

          # Save all tags to a file
          echo "$MEGALINTER_TAGS" > megalinter_tags.txt

      - name: Fetch Current Repository Tags
        id: fetch-repo-tags
        run: |
          echo "Fetching tags from current repository..."

          # Fetch all version tags from current repository
          REPO_TAGS=$(git tag -l 'v*' | sort -V)

          echo "Current repository tags:"
          echo "$REPO_TAGS"

          # Get the latest tag from current repository
          if [ -z "$REPO_TAGS" ]; then
            LATEST_REPO_TAG=""
            echo "No existing tags in repository"
          else
            LATEST_REPO_TAG=$(echo "$REPO_TAGS" | tail -n 1)
            echo "Latest repository tag: $LATEST_REPO_TAG"
          fi

          echo "latest_repo_tag=$LATEST_REPO_TAG" >> $GITHUB_OUTPUT

      - name: Find New Version
        id: find-new-version
        env:
          LATEST_MEGALINTER_TAG: ${{ steps.fetch-megalinter-tags.outputs.latest_tag }}
          LATEST_REPO_TAG: ${{ steps.fetch-repo-tags.outputs.latest_repo_tag }}
        run: |
          echo "Comparing versions..."

          echo "Latest MegaLinter tag: $LATEST_MEGALINTER_TAG"
          echo "Latest repository tag: $LATEST_REPO_TAG"

          # Function to compare semantic versions
          version_greater_than() {
            # Remove 'v' prefix for comparison
            ver1="${1#v}"
            ver2="${2#v}"
            
            # Use sort -V to compare versions
            if [ "$(printf '%s\n' "$ver1" "$ver2" | sort -V | tail -n1)" = "$ver1" ] && [ "$ver1" != "$ver2" ]; then
              return 0  # ver1 > ver2
            else
              return 1  # ver1 <= ver2
            fi
          }

          # Check if we should create a new release
          if [ -z "$LATEST_REPO_TAG" ]; then
            echo "No existing tags in repository. Will create release for $LATEST_MEGALINTER_TAG"
            echo "new_version_found=true" >> $GITHUB_OUTPUT
            echo "new_version=$LATEST_MEGALINTER_TAG" >> $GITHUB_OUTPUT
          elif version_greater_than "$LATEST_MEGALINTER_TAG" "$LATEST_REPO_TAG"; then
            echo "✅ New version found! $LATEST_MEGALINTER_TAG > $LATEST_REPO_TAG"
            echo "new_version_found=true" >> $GITHUB_OUTPUT
            echo "new_version=$LATEST_MEGALINTER_TAG" >> $GITHUB_OUTPUT
          else
            echo "ℹ️ No new version. Repository is up to date."
            echo "new_version_found=false" >> $GITHUB_OUTPUT
          fi

      - name: Create Release for New Version
        if: steps.find-new-version.outputs.new_version_found == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NEW_VERSION: ${{ steps.find-new-version.outputs.new_version }}
        run: |
          echo "Creating release for version $NEW_VERSION..."

          # Create a release using GitHub CLI (will also create the tag)
          gh release create "$NEW_VERSION" \
            --title "MegaLinter Custom Flavor $NEW_VERSION" \
            --notes "Automated release to sync with MegaLinter version $NEW_VERSION.

          This release was automatically created to build a custom MegaLinter flavor based on the upstream MegaLinter release $NEW_VERSION.

          For more information about changes in this version, see the [MegaLinter changelog](https://github.com/oxsecurity/megalinter/releases/tag/$NEW_VERSION)." \
            --latest

      - name: Trigger Custom Flavor Builder Workflow
        if: steps.find-new-version.outputs.new_version_found == 'true'
        env:
          # Use PAT_TOKEN if available, otherwise fall back to GITHUB_TOKEN
          # Note: GITHUB_TOKEN doesn't have permission to trigger workflows
          GITHUB_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
          NEW_VERSION: ${{ steps.find-new-version.outputs.new_version }}
        run: |
          echo "Triggering megalinter-custom-flavor-builder workflow..."

          # Trigger the workflow using GitHub CLI and capture output
          set +e  # Don't exit immediately on error
          gh workflow run megalinter-custom-flavor-builder.yml \
            --ref main \
            --field megalinter-version="$NEW_VERSION" \
            --field is-latest="true" \
            2>&1 | tee workflow_trigger.log
          EXIT_CODE=$?
          set -e  # Re-enable exit on error

          # Check for errors in the output
          if grep -q "could not create workflow dispatch event" workflow_trigger.log || \
             grep -q "Resource not accessible by integration" workflow_trigger.log || \
             grep -q "HTTP 403" workflow_trigger.log || \
             [ $EXIT_CODE -ne 0 ]; then
            
            echo "::error::❌ Failed to trigger workflow!"
            echo ""
            cat workflow_trigger.log
            echo ""
            
            if grep -q "Resource not accessible by integration" workflow_trigger.log || grep -q "HTTP 403" workflow_trigger.log; then
              echo "::error::The workflow could not be triggered due to insufficient token permissions."
              echo "::error::"
              echo "::error::Deleting the release so it can be recreated once PAT_TOKEN is configured..."
              
              # Delete the release and tag that was just created
              gh release delete "$NEW_VERSION" --yes --cleanup-tag 2>&1 || echo "::warning::Could not delete release (it may not exist or already be deleted)"
              
              echo "::error::"
              echo "::error::⚠️ PAT_TOKEN is REQUIRED to create releases and trigger the builder workflow."
              echo "::error::"
              echo "::error::To fix this, create a Fine-grained Personal Access Token (recommended - more secure):"
              echo "::error::1. Go to: https://github.com/settings/personal-access-tokens/new"
              echo "::error::2. Token name: 'MegaLinter Auto-Release'"
              echo "::error::3. Expiration: Choose 90 days or 1 year"
              echo "::error::4. Repository access: Select 'Only select repositories'"
              echo "::error::5. Choose repository: ${GITHUB_REPOSITORY}"
              echo "::error::6. Repository permissions:"
              echo "::error::   - Contents: Read and write"
              echo "::error::   - Actions: Read and write"
              echo "::error::7. Click 'Generate token' and copy it"
              echo "::error::8. Go to: https://github.com/${GITHUB_REPOSITORY}/settings/secrets/actions"
              echo "::error::9. Click 'New repository secret'"
              echo "::error::10. Name: 'PAT_TOKEN', Value: paste your token"
              echo "::error::"
              echo "::error::Once configured, run this workflow again (manually or wait for the next scheduled run)."
            fi
            
            exit 1
          fi

          echo "✅ Builder workflow triggered successfully with version: $NEW_VERSION"

      - name: Summary
        if: always()
        env:
          LATEST_MEGALINTER_TAG: ${{ steps.fetch-megalinter-tags.outputs.latest_tag }}
          LATEST_REPO_TAG: ${{ steps.fetch-repo-tags.outputs.latest_repo_tag }}
          NEW_VERSION_FOUND: ${{ steps.find-new-version.outputs.new_version_found }}
          NEW_VERSION: ${{ steps.find-new-version.outputs.new_version }}
          GH_REPO: ${GITHUB_REPOSITORY}
        run: |
          echo "## Check for New MegaLinter Version Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [ "${NEW_VERSION_FOUND}" == "true" ]; then
            echo "New version found: **${NEW_VERSION}**" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "A new release has been created, which will trigger the custom flavor builder workflow." >> $GITHUB_STEP_SUMMARY
          else
            echo "No new versions found. Repository is up to date with MegaLinter." >> $GITHUB_STEP_SUMMARY
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Version Comparison:**" >> $GITHUB_STEP_SUMMARY
          echo "- Latest MegaLinter version: **$LATEST_MEGALINTER_TAG**" >> $GITHUB_STEP_SUMMARY

          if [ -n "$LATEST_REPO_TAG" ]; then
            echo "- Latest repository version: **$LATEST_REPO_TAG**" >> $GITHUB_STEP_SUMMARY
          else
            echo "- Latest repository version: **No tags found**" >> $GITHUB_STEP_SUMMARY
          fi