parse action versions out of workflow files

.github/dependabot.yaml

@@ -0,0 +1,8 @@
+# Dependabot configuration file.
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"

mono_repo/README.md

@@ -206,5 +206,20 @@ Look at these repositories for examples of `mono_repo` usage:
 * https://github.com/dart-lang/webdev
 * https://github.com/google/json_serializable.dart
 
+## Mono_repo and Dependabot
+
+Historically, package:mono_repo and Dependabot couldn't be used together -
+they both wanted to maintain your GitHub workflow file. We've adopted mono_repo
+so that you can now use both it and Dependabot on your repo.
+
+When generating your workflow configuration (`mono_repo generate`) mono_repo
+will write out its current default action versions into the workflow file. If
+however it sees that the repo has a Dependabot configuration - has a file named
+`.github/dependabot.yaml` in the repo - mono_repo will instead parse that file,
+read out the current action versions, and use those versions when generating
+the workflow file. This lets mono_repo manage the overall structure of the
+file, while allowing Dependabot to independently move various action versions
+forward as necessary.
+
 [Dart packages]: https://dart.dev/guides/libraries/create-library-packages
 [setup your PATH]: https://dart.dev/tools/pub/cmd/pub-global#running-a-script-from-your-path

mono_repo/lib/src/commands/github/action_info.dart

@@ -1,3 +1,4 @@
+import '../../root_config.dart';
 import 'job.dart';
 import 'step.dart';
 
@@ -35,7 +36,7 @@ enum ActionInfo implements Comparable<ActionInfo> {
   codecov(
     name: 'Upload coverage to codecov.io',
     repo: 'codecov/codecov-action',
-    version: 'main',
+    version: 'd9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70',
   );
 
   const ActionInfo({
@@ -48,16 +49,19 @@ enum ActionInfo implements Comparable<ActionInfo> {
   final String repo;
   final String version;
   final String name;
-  final Job Function()? completionJobFactory;
+  final Job Function(RootConfig rootConfig)? completionJobFactory;
 
   Step usage({
     String? name,
     String? id,
     Map<String, dynamic>? withContent,
+    Map<String, String>? versionOverrides,
   }) {
     name ??= this.name;
+    final useVersion =
+        (versionOverrides == null ? null : versionOverrides[repo]) ?? version;
     final step = Step.uses(
-      uses: '$repo@$version',
+      uses: '$repo@$useVersion',
       id: id,
       name: name,
       withContent: withContent,
@@ -71,7 +75,7 @@ enum ActionInfo implements Comparable<ActionInfo> {
   int compareTo(ActionInfo other) => index.compareTo(other.index);
 }
 
-Job _coverageCompletionJob() => Job(
+Job _coverageCompletionJob(RootConfig rootConfig) => Job(
       name: 'Mark Coveralls job finished',
       runsOn: 'ubuntu-latest',
       steps: [
@@ -82,6 +86,7 @@ Job _coverageCompletionJob() => Job(
             'github-token': r'${{ secrets.GITHUB_TOKEN }}',
             'parallel-finished': true
           },
+          versionOverrides: rootConfig.existingActionVersions,
         )
       ],
     );

mono_repo/lib/src/commands/github/generate.dart

@@ -20,6 +20,8 @@ final defaultGitHubWorkflowFilePath =
 String githubWorkflowFilePath(String filename) =>
     '$githubWorkflowDirectory/$filename.yml';
 
+const dependabotFileName = '.github/dependabot.yaml';
+
 void generateGitHubActions(
   RootConfig rootConfig, {
   bool validateOnly = false,

mono_repo/lib/src/commands/github/github_yaml.dart

@@ -114,7 +114,7 @@ Map<String, String> generateGitHubYml(RootConfig rootConfig) {
         Map.fromEntries(allJobs.map((e) => MapEntry(e.id, e.value)));
 
     for (var completion in completionMap.entries) {
-      final job = completion.key.completionJobFactory!()
+      final job = completion.key.completionJobFactory!(rootConfig)
         ..needs = completion.value.toList();
 
       jobList['job_${jobList.length + 1}'] = job;
@@ -196,7 +196,10 @@ Iterable<_MapEntryWithStage> _listJobs(
 
   for (var job in jobs) {
     if (job is _SelfValidateJob) {
-      yield jobEntry(_selfValidateJob(rootConfig.monoConfig), job.stageName);
+      yield jobEntry(
+        _selfValidateJob(rootConfig.monoConfig, rootConfig),
+        job.stageName,
+      );
       continue;
     }
 
@@ -332,6 +335,7 @@ extension on CIJobEntry {
       job.flavor,
       job.sdk,
       commandEntries,
+      rootConfig,
       config: rootConfig.monoConfig,
       additionalCacheKeys: {
         'packages': packages.join('-'),
@@ -374,7 +378,8 @@ Job _githubJob(
   String runsOn,
   PackageFlavor packageFlavor,
   String sdkVersion,
-  List<_CommandEntryBase> runCommands, {
+  List<_CommandEntryBase> runCommands,
+  RootConfig rootConfig, {
   required BasicConfiguration config,
   Map<String, String>? additionalCacheKeys,
 }) =>
@@ -385,17 +390,20 @@ Job _githubJob(
         if (!runsOn.startsWith('windows'))
           _cacheEntries(
             runsOn,
+            rootConfig: rootConfig,
             additionalCacheKeys: {
               'sdk': sdkVersion,
               if (additionalCacheKeys != null) ...additionalCacheKeys,
             },
           ),
-        packageFlavor.setupStep(sdkVersion),
+        packageFlavor.setupStep(sdkVersion, rootConfig),
         ..._beforeSteps(runCommands.whereType<_CommandEntry>()),
         ActionInfo.checkout.usage(
           id: 'checkout',
+          versionOverrides: rootConfig.existingActionVersions,
         ),
-        for (var command in runCommands) ...command.runContent(config),
+        for (var command in runCommands)
+          ...command.runContent(config, rootConfig),
       ],
     );
 
@@ -416,7 +424,7 @@ class _CommandEntryBase {
 
   _CommandEntryBase(this.name, this.run);
 
-  Iterable<Step> runContent(BasicConfiguration config) =>
+  Iterable<Step> runContent(BasicConfiguration config, RootConfig rootConfig) =>
       [Step.run(name: name, run: run)];
 }
 
@@ -436,15 +444,16 @@ class _CommandEntry extends _CommandEntryBase {
   });
 
   @override
-  Iterable<Step> runContent(BasicConfiguration config) => [
+  Iterable<Step> runContent(BasicConfiguration config, RootConfig rootConfig) =>
+      [
         Step.run(
           id: id,
           name: name,
           ifContent: ifCondition,
           workingDirectory: workingDirectory,
           run: run,
         ),
-        ...?type?.afterEachSteps(workingDirectory, config),
+        ...?type?.afterEachSteps(workingDirectory, config, rootConfig),
       ];
 }
 
@@ -456,6 +465,7 @@ class _CommandEntry extends _CommandEntryBase {
 /// store and retrieve the cache.
 Step _cacheEntries(
   String runsOn, {
+  required RootConfig rootConfig,
   Map<String, String>? additionalCacheKeys,
 }) {
   final cacheKeyParts = [
@@ -482,6 +492,7 @@ Step _cacheEntries(
       'key': restoreKeys.first,
       'restore-keys': restoreKeys.skip(1).join('\n'),
     },
+    versionOverrides: rootConfig.existingActionVersions,
   );
 }
 
@@ -492,7 +503,8 @@ String _maxLength(String input) {
   return input.substring(0, 512 - hash.length) + hash;
 }
 
-Job _selfValidateJob(BasicConfiguration config) => _githubJob(
+Job _selfValidateJob(BasicConfiguration config, RootConfig rootConfig) =>
+    _githubJob(
       selfValidateJobName,
       _ubuntuLatest,
       PackageFlavor.dart,
@@ -501,6 +513,7 @@ Job _selfValidateJob(BasicConfiguration config) => _githubJob(
         for (var command in selfValidateCommands)
           _CommandEntryBase(selfValidateJobName, command),
       ],
+      rootConfig,
       config: config,
     );
 
@@ -529,16 +542,18 @@ class _MapEntryWithStage {
 }
 
 extension on PackageFlavor {
-  Step setupStep(String sdkVersion) {
+  Step setupStep(String sdkVersion, RootConfig rootConfig) {
     switch (this) {
       case PackageFlavor.dart:
         return ActionInfo.setupDart.usage(
           withContent: {'sdk': sdkVersion},
+          versionOverrides: rootConfig.existingActionVersions,
         );
 
       case PackageFlavor.flutter:
         return ActionInfo.setupFlutter.usage(
           withContent: {'channel': sdkVersion},
+          versionOverrides: rootConfig.existingActionVersions,
         );
     }
   }

mono_repo/lib/src/root_config.dart

@@ -7,7 +7,9 @@ import 'dart:io';
 
 import 'package:path/path.dart' as p;
 import 'package:pubspec_parse/pubspec_parse.dart';
+import 'package:yaml/yaml.dart';
 
+import 'commands/github/generate.dart';
 import 'mono_config.dart';
 import 'package_config.dart';
 import 'user_exception.dart';
@@ -60,6 +62,7 @@ class RootConfig extends ListBase<PackageConfig> {
   final String rootDirectory;
   final MonoConfig monoConfig;
   final List<PackageConfig> _configs;
+  final Map<String, String>? existingActionVersions;
 
   factory RootConfig({String? rootDirectory, bool recursive = true}) {
     rootDirectory ??= p.current;
@@ -94,14 +97,30 @@ class RootConfig extends ListBase<PackageConfig> {
       );
     }
 
+    // If a dependabot configuration file exists, assume the action versions in
+    // the generated workflow file are maintained by dependabot; parse and use
+    // those versions.
+    Map<String, String>? existingActionVersions;
+    if (File(dependabotFileName).existsSync() &&
+        File(defaultGitHubWorkflowFilePath).existsSync()) {
+      existingActionVersions =
+          parseActionVersions(File(defaultGitHubWorkflowFilePath));
+    }
+
     return RootConfig._(
       rootDirectory,
       MonoConfig.fromRepo(rootDirectory: rootDirectory),
       configs,
+      existingActionVersions,
     );
   }
 
-  RootConfig._(this.rootDirectory, this.monoConfig, this._configs);
+  RootConfig._(
+    this.rootDirectory,
+    this.monoConfig,
+    this._configs,
+    this.existingActionVersions,
+  );
 
   @override
   int get length => _configs.length;
@@ -116,4 +135,42 @@ class RootConfig extends ListBase<PackageConfig> {
   @override
   void operator []=(int index, PackageConfig pkg) =>
       throw UnsupportedError('This List is read-only.');
+
+  /// Parse any github action versions from a workflow file.
+  ///
+  /// This returns a map of <action name> to <action version>.
+  static Map<String, String> parseActionVersions(File workflowFile) {
+    // "dart-lang/setup-dart@6a218f2413a3e78e9087f638a238f6b40893203d"
+    final usageRegex = RegExp(r'([\w-]+)\/([\w-]+)@([\w\.]+)');
+
+    final yaml = loadYaml(workflowFile.readAsStringSync());
+    final result = <String, String>{};
+
+    void collect(dynamic yaml) {
+      if (yaml is List) {
+        for (var item in yaml) {
+          collect(item);
+        }
+      } else if (yaml is Map) {
+        const usesKey = 'uses';
+
+        if (yaml.containsKey(usesKey)) {
+          // dart-lang/setup-dart@6a218f2413a3e78e9087f638a238f6b40893203d
+          final usage = yaml[usesKey] as String;
+          final match = usageRegex.firstMatch(usage);
+          if (match != null) {
+            result['${match.group(1)}/${match.group(2)}'] = match.group(3)!;
+          }
+        }
+
+        for (var item in yaml.entries) {
+          collect(item.value);
+        }
+      }
+    }
+
+    collect(yaml);
+
+    return result;
+  }
 }