airflow/.github/workflows/update-constraints-on-push-stable.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: Update constraints on push for stable branch (always)
on:  # yamllint disable-line rule:truthy
  push:
    branches:
      - v[0-9]+-[0-9]+-stable
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
env:
  GITHUB_REPOSITORY: ${{ github.repository }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  GITHUB_USERNAME: ${{ github.actor }}
  VERBOSE: "true"
jobs:
  build-info:
    name: "Build info"
    runs-on: ["ubuntu-slim"]
    outputs:
      default-branch: ${{ steps.selective-checks.outputs.default-branch }}
      default-constraints-branch: ${{ steps.selective-checks.outputs.default-constraints-branch }}
      default-python-version: ${{ steps.selective-checks.outputs.default-python-version }}
      python-versions: ${{ steps.selective-checks.outputs.python-versions }}
      python-versions-list-as-string: ${{ steps.selective-checks.outputs.python-versions-list-as-string }}
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: Fetch incoming commit ${{ github.sha }} with its parent
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 2
          persist-credentials: false
      - name: "Install Breeze"
        uses: ./.github/actions/breeze
        with:
          free-space: "false"
        id: breeze
      - name: "Save github context to file"
        # See ci-amd.yml for the full rationale: avoids ARG_MAX on big PRs by writing the
        # github context to a file, and the single-quoted heredoc makes the zizmor
        # template-injection finding a false positive (no bash expansion happens inside it).
        shell: bash
        run: |  # zizmor: ignore[template-injection]
          cat > "${RUNNER_TEMP}/github_context.json" << '__GITHUB_CONTEXT_END__'
          ${{ toJson(github) }}
          __GITHUB_CONTEXT_END__
      - name: Selective checks
        id: selective-checks
        env:
          PR_LABELS: "[]"
          COMMIT_REF: "${{ github.sha }}"
          VERBOSE: "false"
          GITHUB_CONTEXT_INPUT: "${{ runner.temp }}/github_context.json"
        run: breeze ci selective-check 2>> ${GITHUB_OUTPUT}

  build-ci-images:
    name: "Build CI images"
    needs: [build-info]
    uses: ./.github/workflows/ci-image-build.yml
    permissions:
      contents: read
      packages: write
    with:
      runners: '["ubuntu-22.04"]'
      platform: "linux/amd64"
      push-image: "false"
      upload-image-artifact: "true"
      upload-mount-cache-artifact: "false"
      python-versions: ${{ needs.build-info.outputs.python-versions }}
      branch: ${{ needs.build-info.outputs.default-branch }}
      constraints-branch: ${{ needs.build-info.outputs.default-constraints-branch }}
      use-uv: "true"
      upgrade-to-newer-dependencies: "false"
      docker-cache: "registry"
      disable-airflow-repo-cache: "false"

  generate-constraints:
    name: "Generate constraints"
    needs: [build-info, build-ci-images]
    uses: ./.github/workflows/generate-constraints.yml
    with:
      runners: '["ubuntu-22.04"]'
      platform: "linux/amd64"
      python-versions-list-as-string: ${{ needs.build-info.outputs.python-versions-list-as-string }}
      python-versions: ${{ needs.build-info.outputs.python-versions }}
      generate-pypi-constraints: "true"
      generate-no-providers-constraints: "true"
      debug-resources: "false"
      use-uv: "true"
    secrets:
      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

  update-constraints:
    runs-on: ["ubuntu-22.04"]
    timeout-minutes: 20
    name: "Commit and push constraints"
    needs: [build-info, generate-constraints]
    # Shared with the other constraints publishers, so they never push to one branch at once.
    concurrency:
      group: constraints-publish-${{ needs.build-info.outputs.default-constraints-branch }}
      cancel-in-progress: false
    permissions:
      contents: write
      packages: read
    env:
      PYTHON_VERSIONS: ${{ needs.build-info.outputs.python-versions-list-as-string }}
    steps:
      - name: "Cleanup repo"
        shell: bash
        run: sudo rm -rf ${GITHUB_WORKSPACE}/*
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - name: "Set constraints branch name"
        id: constraints-branch
        run: ./scripts/ci/constraints/ci_branch_constraints.sh >> ${GITHUB_OUTPUT}
      - name: Checkout ${{ steps.constraints-branch.outputs.branch }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          path: "constraints"
          ref: ${{ steps.constraints-branch.outputs.branch }}
          persist-credentials: true
          fetch-depth: 0
      - name: "Download constraints from the generate-constraints job"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
        with:
          pattern: constraints-*
          path: ./files
      - name: "Diff in constraints for Python: ${{ needs.build-info.outputs.python-versions-list-as-string }}"
        run: ./scripts/ci/constraints/ci_diff_constraints.sh
      - name: >-
          Commit changed constraint files for Python:
          ${{ needs.build-info.outputs.python-versions-list-as-string }}
        run: ./scripts/ci/constraints/ci_commit_constraints.sh
      - name: "Push changes"
        working-directory: "constraints"
        run: git push

  notify-on-failure:
    name: "Notify on failure"
    runs-on: ["ubuntu-slim"]
    needs: [build-info, build-ci-images, generate-constraints, update-constraints]
    if: failure()
    env:
      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
    steps:
      - name: "Send Slack notification"
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d  # v4.0.0
        with:
          method: chat.postMessage
          token: ${{ env.SLACK_BOT_TOKEN }}
          # yamllint disable rule:line-length
          payload: |
            channel: "internal-airflow-ci-cd"
            text: "🚨 Update constraints workflow failed on branch *${{ github.ref_name }}*\n\n*Details:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View the failure log>"
            blocks:
              - type: "section"
                text:
                  type: "mrkdwn"
                  text: "🚨 Update constraints workflow failed on *${{ github.ref_name }}*\n\n*Details:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View the failure log>"
          # yamllint enable rule:line-length