supabase/.github/workflows/lint-ratchet-decrease.yml

name: Decrease lint ratchet baselines

on:
  schedule:
    - cron: '0 0 * * SUN'
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  decrease-baselines:
    runs-on: blacksmith-4vcpu-ubuntu-2404

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          sparse-checkout: |
            apps/www
            apps/docs
            apps/design-system
            apps/ui-library
            apps/learn
            packages
            patches

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        name: Install pnpm
        with:
          run_install: false

      - name: Use Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install deps
        run: pnpm install --frozen-lockfile

      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.GH_AUTOFIX_APP_CLIENT_ID }}
          private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

      - name: Decrease ESLint ratchet baselines and open PR
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          set -eo pipefail
          DEFAULT_BRANCH=${DEFAULT_BRANCH:-master}

          BRANCH="bot/decrease-lint-ratchet-baselines"

          git fetch origin "$DEFAULT_BRANCH" --depth=1
          if git ls-remote --exit-code --heads origin "$BRANCH" > /dev/null 2>&1; then
            git fetch origin "$BRANCH":"$BRANCH" --depth=1
            git switch "$BRANCH"
            git reset --hard "origin/$DEFAULT_BRANCH"
          else
            git switch --create "$BRANCH" "origin/$DEFAULT_BRANCH"
          fi

          # Keep going past an app that regressed so the others still get decreased;
          # the job fails at the end if any app did.
          failed=""
          APPS="www docs design-system ui-library learn"
          for app in $APPS; do
            pnpm --filter "./apps/$app" run lint:ratchet --decrease-baselines || failed="$failed $app"
          done

          if git diff --quiet; then
            echo "No baseline updates detected."
            if [ -n "$failed" ]; then
              echo "::error title=Ratchet regressions::New violations on $DEFAULT_BRANCH in:$failed"
              exit 1
            fi
            exit 0
          fi

          git config user.name 'github-actions[bot]'
          git config user.email 'github-actions[bot]@users.noreply.github.com'

          for app in $APPS; do git add "apps/$app/.github/eslint-rule-baselines.json"; done
          git commit --message "chore: decrease lint ratchet baselines"
          git -c credential.helper= push --force "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${BRANCH}"

          pr_url=$(gh pr list --state open --head "$BRANCH" --json url --jq '.[0].url // ""' 2>/dev/null || echo "")
          if [ -z "$pr_url" ]; then
            gh pr create \
              --title "[bot] Decrease lint ratchet baselines" \
              --body "Automated weekly decrease of lint ratchet baselines." \
              --base "$DEFAULT_BRANCH" \
              --head "$BRANCH"
          else
            gh pr comment "$pr_url" --body "Updated lint ratchet baselines with the latest weekly decreases."
          fi

          if [ -n "$failed" ]; then
            echo "::error title=Ratchet regressions::New violations on $DEFAULT_BRANCH in:$failed"
            exit 1
          fi