rustcfml-version-check.yml

name: RustCFML — version check

# Daily: check github.com/RustCFML/RustCFML for a newer release than the pinned
# tools/rustcfml/ENGINE_VERSION. When one exists, run the full core suite
# against it (compare mode vs the pinned baseline). If GREEN, bump the pin and
# regenerate baseline.json via a PR. If the suite has new failures, the
# candidate is REJECTED: the pin stays, the run finishes with a warning and a
# named diff in the job summary, and one issue is opened per candidate +
# failure fingerprint (repeat runs stay quiet). The run goes red only when the
# candidate could not be evaluated (lookup, download, boot, response) (#3687).
#
# A workflow_dispatch from another branch tests that branch's scripts but
# never opens a bump PR or an issue (the notifier runs in dry-run mode).

on:
  schedule:
    - cron: '30 8 * * *'   # daily, 08:30 UTC
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write
  issues: write   # notify-rejection.sh: one issue per rejected candidate

jobs:
  check:
    name: Check for newer RustCFML
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout develop (or the dispatched ref)
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || 'develop' }}
          fetch-depth: 1

      - name: Check for a newer release and run the suite
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash tools/rustcfml/check-version.sh

      - name: Notify once for a rejected candidate
        # Also after a failed check step: when the newest release is rejected and the
        # stable fallback then can't be evaluated, check-version.sh exits 1, but the
        # newest's rejection (exported to GITHUB_ENV before that) must still be filed.
        # Not on a cancelled run.
        if: ${{ !cancelled() && env.RUSTCFML_REJECTED != '' }}
        env:
          GH_TOKEN: ${{ github.token }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          # Only develop notifies for real; a branch dispatch prints the decision.
          NOTIFY_DRY_RUN: ${{ github.ref != 'refs/heads/develop' && '1' || '' }}
        run: bash tools/rustcfml/notify-rejection.sh "$RUSTCFML_RESULT_JSON"

      - name: Open bump PR
        # Only from develop: a branch dispatch that happens to go green must not
        # open a bump PR built on a feature branch.
        #
        # add-paths: the suite run leaves logs and caches in the working tree
        # (public/logs/, tools/ci/__pycache__/), and create-pull-request stages
        # every change by default, so commit only the files bump-pin.sh and
        # --write-baseline produce (#4577).
        #
        # CI: a PR opened with GITHUB_TOKEN does not trigger workflows. Whoever
        # handles the bump PR pushes a commit (an empty one is fine) to its
        # branch to start CI, as for the develop version bump.
        if: env.RUSTCFML_LATEST != '' && github.ref == 'refs/heads/develop'
        uses: peter-evans/create-pull-request@v8.1.1
        with:
          add-paths: |
            tools/rustcfml/ENGINE_VERSION
            tools/rustcfml/ENGINE_SHA256
            tools/rustcfml/baseline.json
            cli/lucli/services/rustcfml/RustCFMLEngine.cfc
          branch: "auto-bump/rustcfml-${{ env.RUSTCFML_LATEST }}"
          title: "chore(rustcfml): bump engine pin to ${{ env.RUSTCFML_LATEST }}"
          body: |
            Automated RustCFML engine bump (daily version check).

            **Pinned** `${{ env.RUSTCFML_PINNED }}` → **`${{ env.RUSTCFML_LATEST }}`**.

            The full core suite ran **green** against the new engine, so this PR
            bumps `tools/rustcfml/ENGINE_VERSION` and the per-asset sha256 pins in
            `tools/rustcfml/ENGINE_SHA256` (from the release's published digests),
            plus the CLI's copies of both in
            `cli/lucli/services/rustcfml/RustCFMLEngine.cfc`, and regenerates
            `tools/rustcfml/baseline.json` to the new engine's result set.

            If the suite had shown new failures, the pin would have been left
            unchanged and this PR would not exist.
          commit-message: "chore(rustcfml): bump engine pin to ${{ env.RUSTCFML_LATEST }}"
          delete-branch: true