parse action versions out of workflow files

mono_repo/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 6.5.7
+
+- Updated `mono_repo` to use the existing action versions from the generated
+  workflow file when dependabot is configured for the repo.
+
 ## 6.5.6
 
 - Restore the previous ordering behavior for jobs by using a secondary sort

mono_repo/README.md

@@ -228,5 +228,20 @@ Look at these repositories for examples of `mono_repo` usage:
 * https://github.com/dart-lang/webdev
 * https://github.com/google/json_serializable.dart
 
+## Mono_repo and Dependabot
+
+Historically, package:mono_repo and Dependabot couldn't be used together -
+they both wanted to maintain your GitHub workflow file. We've adopted mono_repo
+so that you can now use both it and Dependabot in your repo.
+
+When generating your workflow configuration (`mono_repo generate`) mono_repo
+will write out its current default action versions into the workflow file. If
+however it sees that the repo has a Dependabot configuration - has a file named
+`.github/dependabot.yaml` in the repo - mono_repo will instead parse the
+workflow file, read out the current action versions, and use those versions when
+re-generating the file. This lets mono_repo manage the overall structure of the
+file, while allowing Dependabot to independently move various action versions
+forward as necessary.
+
 [Dart packages]: https://dart.dev/guides/libraries/create-library-packages
 [setup your PATH]: https://dart.dev/tools/pub/cmd/pub-global#running-a-script-from-your-path

mono_repo/lib/src/commands/github/action_info.dart

@@ -1,41 +1,43 @@
+import '../../root_config.dart';
+import 'action_versions.dart';
 import 'job.dart';
 import 'step.dart';
 
 enum ActionInfo implements Comparable<ActionInfo> {
   cache(
     name: 'Cache Pub hosted dependencies',
     repo: 'actions/cache',
-    version: '88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8', // v3.3.1
+    version: actionsCacheVersion,
   ),
   checkout(
     name: 'Checkout repository',
     repo: 'actions/checkout',
-    version: '8e5e7e5ab8b370d6c329ec480221332ada57f0ab', // v3.5.2
+    version: actionsCheckoutVersion,
   ),
   setupDart(
     name: 'Setup Dart SDK',
     repo: 'dart-lang/setup-dart',
-    version: 'd6a63dab3335f427404425de0fbfed4686d93c4f', // v1.5.0
+    version: dartLangSetupDartVersion,
   ),
   setupFlutter(
     name: 'Setup Flutter SDK',
     repo: 'subosito/flutter-action',
-    version: '48cafc24713cca54bbe03cdc3a423187d413aafa', // v2.10.0
+    version: subositoFlutterActionVersion,
   ),
 
   /// See https://github.com/marketplace/actions/coveralls-github-action
   coveralls(
     name: 'Upload coverage to Coveralls',
     repo: 'coverallsapp/github-action',
-    version: 'master',
+    version: coverallsappGithubActionVersion,
     completionJobFactory: _coverageCompletionJob,
   ),
 
   /// See https://github.com/marketplace/actions/codecov
   codecov(
     name: 'Upload coverage to codecov.io',
     repo: 'codecov/codecov-action',
-    version: 'main',
+    version: codecovCodecovActionVersion,
   );
 
   const ActionInfo({
@@ -48,16 +50,19 @@ enum ActionInfo implements Comparable<ActionInfo> {
   final String repo;
   final String version;
   final String name;
-  final Job Function()? completionJobFactory;
+  final Job Function(RootConfig rootConfig)? completionJobFactory;
 
   Step usage({
     String? name,
     String? id,
     Map<String, dynamic>? withContent,
+    Map<String, String>? versionOverrides,
   }) {
     name ??= this.name;
+    final useVersion =
+        (versionOverrides == null ? null : versionOverrides[repo]) ?? version;
     final step = Step.uses(
-      uses: '$repo@$version',
+      uses: '$repo@$useVersion',
       id: id,
       name: name,
       withContent: withContent,
@@ -71,7 +76,7 @@ enum ActionInfo implements Comparable<ActionInfo> {
   int compareTo(ActionInfo other) => index.compareTo(other.index);
 }
 
-Job _coverageCompletionJob() => Job(
+Job _coverageCompletionJob(RootConfig rootConfig) => Job(
       name: 'Mark Coveralls job finished',
       runsOn: 'ubuntu-latest',
       steps: [
@@ -82,6 +87,7 @@ Job _coverageCompletionJob() => Job(
             'github-token': r'${{ secrets.GITHUB_TOKEN }}',
             'parallel-finished': true
           },
+          versionOverrides: rootConfig.existingActionVersions,
         )
       ],
     );

mono_repo/lib/src/commands/github/action_versions.dart

@@ -0,0 +1,14 @@
+// Copyright (c) 2023, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+/// This file is generated, and should not be modified by hand.
+///
+/// To regenerate it, run the `tool/generate_action_versions.dart` script.
+
+const actionsCacheVersion = '88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8';
+const dartLangSetupDartVersion = 'd6a63dab3335f427404425de0fbfed4686d93c4f';
+const actionsCheckoutVersion = '8e5e7e5ab8b370d6c329ec480221332ada57f0ab';
+const subositoFlutterActionVersion = '48cafc24713cca54bbe03cdc3a423187d413aafa';
+const coverallsappGithubActionVersion = 'master';
+const codecovCodecovActionVersion = 'main';

mono_repo/lib/src/commands/github/generate.dart

@@ -12,6 +12,11 @@ import '../../root_config.dart';
 import '../../user_exception.dart';
 import 'github_yaml.dart';
 
+const dependabotFileNames = [
+  '.github/dependabot.yaml',
+  '.github/dependabot.yml',
+];
+
 void generateGitHubActions(
   RootConfig rootConfig, {
   bool validateOnly = false,

mono_repo/lib/src/commands/github/github_yaml.dart

@@ -122,7 +122,7 @@ Map<String, String> generateGitHubYml(RootConfig rootConfig) {
         Map.fromEntries(allJobs.map((e) => MapEntry(e.id, e.value)));
 
     for (var completion in completionMap.entries) {
-      final job = completion.key.completionJobFactory!()
+      final job = completion.key.completionJobFactory!(rootConfig)
         ..needs = completion.value.toList();
 
       jobList['job_${jobList.length + 1}'] = job;
@@ -204,7 +204,10 @@ Iterable<_MapEntryWithStage> _listJobs(
 
   for (var job in jobs) {
     if (job is _SelfValidateJob) {
-      yield jobEntry(_selfValidateJob(rootConfig.monoConfig), job.stageName);
+      yield jobEntry(
+        _selfValidateJob(rootConfig.monoConfig, rootConfig),
+        job.stageName,
+      );
       continue;
     }
 
@@ -340,6 +343,7 @@ extension on CIJobEntry {
       job.flavor,
       job.sdk,
       commandEntries,
+      rootConfig,
       config: rootConfig.monoConfig,
       additionalCacheKeys: {
         'packages': packages.join('-'),
@@ -382,7 +386,8 @@ Job _githubJob(
   String runsOn,
   PackageFlavor packageFlavor,
   String sdkVersion,
-  List<_CommandEntryBase> runCommands, {
+  List<_CommandEntryBase> runCommands,
+  RootConfig rootConfig, {
   required BasicConfiguration config,
   Map<String, String>? additionalCacheKeys,
 }) =>
@@ -393,17 +398,20 @@ Job _githubJob(
         if (!runsOn.startsWith('windows'))
           _cacheEntries(
             runsOn,
+            rootConfig: rootConfig,
             additionalCacheKeys: {
               'sdk': sdkVersion,
               if (additionalCacheKeys != null) ...additionalCacheKeys,
             },
           ),
-        packageFlavor.setupStep(sdkVersion),
+        packageFlavor.setupStep(sdkVersion, rootConfig),
         ..._beforeSteps(runCommands.whereType<_CommandEntry>()),
         ActionInfo.checkout.usage(
           id: 'checkout',
+          versionOverrides: rootConfig.existingActionVersions,
         ),
-        for (var command in runCommands) ...command.runContent(config),
+        for (var command in runCommands)
+          ...command.runContent(config, rootConfig),
       ],
     );
 
@@ -424,7 +432,7 @@ class _CommandEntryBase {
 
   _CommandEntryBase(this.name, this.run);
 
-  Iterable<Step> runContent(BasicConfiguration config) =>
+  Iterable<Step> runContent(BasicConfiguration config, RootConfig rootConfig) =>
       [Step.run(name: name, run: run)];
 }
 
@@ -444,15 +452,16 @@ class _CommandEntry extends _CommandEntryBase {
   });
 
   @override
-  Iterable<Step> runContent(BasicConfiguration config) => [
+  Iterable<Step> runContent(BasicConfiguration config, RootConfig rootConfig) =>
+      [
         Step.run(
           id: id,
           name: name,
           ifContent: ifCondition,
           workingDirectory: workingDirectory,
           run: run,
         ),
-        ...?type?.afterEachSteps(workingDirectory, config),
+        ...?type?.afterEachSteps(workingDirectory, config, rootConfig),
       ];
 }
 
@@ -464,6 +473,7 @@ class _CommandEntry extends _CommandEntryBase {
 /// store and retrieve the cache.
 Step _cacheEntries(
   String runsOn, {
+  required RootConfig rootConfig,
   Map<String, String>? additionalCacheKeys,
 }) {
   final cacheKeyParts = [
@@ -490,6 +500,7 @@ Step _cacheEntries(
       'key': restoreKeys.first,
       'restore-keys': restoreKeys.skip(1).join('\n'),
     },
+    versionOverrides: rootConfig.existingActionVersions,
   );
 }
 
@@ -500,7 +511,8 @@ String _maxLength(String input) {
   return input.substring(0, 512 - hash.length) + hash;
 }
 
-Job _selfValidateJob(BasicConfiguration config) => _githubJob(
+Job _selfValidateJob(BasicConfiguration config, RootConfig rootConfig) =>
+    _githubJob(
       selfValidateJobName,
       _ubuntuLatest,
       PackageFlavor.dart,
@@ -509,6 +521,7 @@ Job _selfValidateJob(BasicConfiguration config) => _githubJob(
         for (var command in selfValidateCommands)
           _CommandEntryBase(selfValidateJobName, command),
       ],
+      rootConfig,
       config: config,
     );
 
@@ -537,16 +550,18 @@ class _MapEntryWithStage {
 }
 
 extension on PackageFlavor {
-  Step setupStep(String sdkVersion) {
+  Step setupStep(String sdkVersion, RootConfig rootConfig) {
     switch (this) {
       case PackageFlavor.dart:
         return ActionInfo.setupDart.usage(
           withContent: {'sdk': sdkVersion},
+          versionOverrides: rootConfig.existingActionVersions,
         );
 
       case PackageFlavor.flutter:
         return ActionInfo.setupFlutter.usage(
           withContent: {'channel': sdkVersion},
+          versionOverrides: rootConfig.existingActionVersions,
         );
     }
   }

mono_repo/lib/src/root_config.dart

@@ -7,7 +7,10 @@ import 'dart:io';
 
 import 'package:path/path.dart' as p;
 import 'package:pubspec_parse/pubspec_parse.dart';
+import 'package:yaml/yaml.dart';
 
+import 'commands/github/generate.dart';
+import 'commands/github/github_yaml.dart';
 import 'mono_config.dart';
 import 'package_config.dart';
 import 'user_exception.dart';
@@ -60,6 +63,7 @@ class RootConfig extends ListBase<PackageConfig> {
   final String rootDirectory;
   final MonoConfig monoConfig;
   final List<PackageConfig> _configs;
+  final Map<String, String>? existingActionVersions;
 
   factory RootConfig({String? rootDirectory, bool recursive = true}) {
     rootDirectory ??= p.current;
@@ -94,14 +98,35 @@ class RootConfig extends ListBase<PackageConfig> {
       );
     }
 
+    // If a dependabot configuration file exists, assume the action versions in
+    // the generated workflow file are maintained by dependabot; parse and use
+    // those versions.
+    Map<String, String>? existingActionVersions;
+    final hasDependabot = dependabotFileNames
+        .map((name) => File(p.join(rootDirectory!, name)))
+        .any((file) => file.existsSync());
+    final githubWorkflowFile =
+        File(p.join(rootDirectory, defaultGitHubWorkflowFilePath));
+    if (hasDependabot && githubWorkflowFile.existsSync()) {
+      existingActionVersions = parseActionVersions(
+        githubWorkflowFile.readAsStringSync(),
+      );
+    }
+
     return RootConfig._(
       rootDirectory,
       MonoConfig.fromRepo(rootDirectory: rootDirectory),
       configs,
+      existingActionVersions,
     );
   }
 
-  RootConfig._(this.rootDirectory, this.monoConfig, this._configs);
+  RootConfig._(
+    this.rootDirectory,
+    this.monoConfig,
+    this._configs,
+    this.existingActionVersions,
+  );
 
   @override
   int get length => _configs.length;
@@ -116,4 +141,42 @@ class RootConfig extends ListBase<PackageConfig> {
   @override
   void operator []=(int index, PackageConfig pkg) =>
       throw UnsupportedError('This List is read-only.');
+
+  /// Parse any github action versions from a workflow file.
+  ///
+  /// This returns a map of <action name> to <action version>.
+  static Map<String, String> parseActionVersions(String yamlText) {
+    // "dart-lang/setup-dart@6a218f2413a3e78e9087f638a238f6b40893203d"
+    final usageRegex = RegExp(r'([\w\.-]+)\/([\w\.-]+)@([\w\.]+)');
+
+    final yaml = loadYaml(yamlText);
+    final result = <String, String>{};
+
+    void collect(dynamic yaml) {
+      if (yaml is List) {
+        for (var item in yaml) {
+          collect(item);
+        }
+      } else if (yaml is Map) {
+        const usesKey = 'uses';
+
+        if (yaml.containsKey(usesKey)) {
+          // dart-lang/setup-dart@6a218f2413a3e78e9087f638a238f6b40893203d
+          final usage = yaml[usesKey] as String;
+          final match = usageRegex.firstMatch(usage);
+          if (match != null) {
+            result['${match.group(1)}/${match.group(2)}'] = match.group(3)!;
+          }
+        }
+
+        for (var item in yaml.entries) {
+          collect(item.value);
+        }
+      }
+    }
+
+    collect(yaml);
+
+    return result;
+  }
 }