Update.sh

#!/usr/bin/env bash

export PATH="/usr/local/bin:/opt/homebrew/bin:$PATH"

# Colors for output
RED='\033[0;31m'

GREEN='\033[0;32m'

YELLOW='\033[1;33m'

BLUE='\033[0;34m'

NC='\033[0m' # No Color

# Function to print colored output
print_status() {
	\echo -e "${BLUE}[STATUS]${NC} $1"
}

print_success() {
	\echo -e "${GREEN}[SUCCESS]${NC} $1"
}

print_error() {
	\echo -e "${RED}[ERROR]${NC} $1"
}

print_warning() {
	\echo -e "${YELLOW}[WARNING]${NC} $1"
}


# Generated by Maintain Workflow --Absorb
# Actions discovered in /Volumes/CORSAIR/Developer/macOS/Application/PlayForm/Cargo/Summary at absorb time (informational).
DiscoveredActions=( "actions/checkout" "ad-m/github-push-action" "dependabot/fetch-metadata" "pozil/auto-assign-issue" "dtolnay/rust-toolchain" "actions/cache" "rust-lang/crates-io-auth-action" "actions-rs/toolchain" "actions-rs/cargo" )
print_status "Starting Update.sh script"

# Find workflow .yml/.yaml files, ignoring common non-source directories
\find .github -type f \( -iname "*.yml" -o -iname "*.yaml" \) -print0 | while IFS= read -r -d $'\0' file; do
	print_status "Processing file: $file"

	temp_file=$(\mktemp)

	# Byte-preserving append: writes the argument without a trailing newline,
	# then adds the newline only when the source line had one (tracked by
	# $Newline). Prevents `while read` from dropping an unterminated last line.
	append_line() {
		\printf '%s' "$1" >>"$temp_file"

		[ "${Newline:-1}" -eq 1 ] && \printf '\n' >>"$temp_file"
	}

	Newline=1

	while IFS= read -r line || { Newline=0; [ -n "$line" ]; }; do
		if [[ "$line" =~ uses:\ [^[:space:]]+ ]]; then
			print_status "Found uses in $file: $line"

			# Extract the full action reference (no surrounding quotes, no existing # comment)
			action_part=$(\echo "$line" | \sed -E 's/.*uses:\ ([^[:space:]"'"'"']+).*/\1/' | \sed -E 's/\s*#.*//')

			print_status "Action part: $action_part"

			# Split into action_name and current_reference
			if [[ "$action_part" == *@* ]]; then
				action_name=$(\echo "$action_part" | \cut -d '@' -f 1)
				current_reference=$(\echo "$action_part" | \cut -d '@' -f 2)
				print_status "Current reference: $current_reference"
			else
				action_name="$action_part"
				current_reference=""
				print_status "No reference specified"
			fi

			IFS='/' read -r -a parts <<<"$action_name"

			if [ ${#parts[@]} -lt 2 ]; then
				print_error "Invalid action name: $action_name"

				append_line "$line"

				continue
			fi

			repo_part="${parts[0]}/${parts[1]}"

			path_part=$(
				IFS='/'
				\echo "${parts[@]:2}"
			)

			print_status "Repo: $repo_part, Path: $path_part"

			if [[ "$repo_part" == ./* || "$repo_part" == ./. ]]; then
				print_warning "Skipping local action: $action_part"

				append_line "$line"

				continue
			fi

			# Get the latest tag - use the newest semantic version from ALL tags,
			# not just tags[0] (the API returns tags in an arbitrary order).
			latest_tag=$(\gh api "repos/$repo_part/tags?per_page=100" | \jq -r '.[].name' |
				\grep -E '^v?[0-9]+\.[0-9]+\.[0-9]+$' |
				\sed 's/^v//' | \sort -V | tail -1 | \sed 's/^/v/')

			if [ -z "$latest_tag" ] || [ "$latest_tag" = "v" ]; then
				# Fallback: no semver tags found, take the first available tag.
				latest_tag=$(\gh api "repos/$repo_part/tags" | \jq -r '.[0].name')
			fi

			if [ -z "$latest_tag" ] || [ "$latest_tag" == "null" ]; then
				print_error "Failed to get tag for $repo_part"

				append_line "$line"

				continue
			fi

			print_status "Latest tag: $latest_tag"

			# Resolve the tag ref to a SHA. For ANNOTATED tags, ref.object.sha is the
			# tag-object SHA, NOT the commit. Follow it to the real commit SHA, which
			# is what GitHub Actions requires in `uses:`.
			ref_json=$(\gh api "repos/$repo_part/git/ref/tags/$latest_tag")
			if [ -z "$ref_json" ] || [ "$ref_json" == "null" ]; then
				print_error "Failed to resolve ref for $repo_part @ $latest_tag"

				append_line "$line"

				continue
			fi

			obj_type=$(\echo "$ref_json" | \jq -r '.object.type')
			obj_sha=$(\echo "$ref_json" | \jq -r '.object.sha')

			if [ "$obj_type" = "tag" ]; then
				# Annotated tag: the object is itself a tag; fetch its commit.
				commit_sha=$(\gh api "repos/$repo_part/git/tags/$obj_sha" | \jq -r '.object.sha')
			else
				# Lightweight tag: the object is the commit directly.
				commit_sha="$obj_sha"
			fi

			if [ -z "$commit_sha" ] || [ "$commit_sha" == "null" ]; then
				print_error "Failed to resolve commit SHA for $repo_part @ $latest_tag"

				append_line "$line"

				continue
			fi

			print_status "Commit SHA: $commit_sha"

			# Build the new action reference: action@sha # tag
			if [ -n "$path_part" ]; then
				new_action_part="${repo_part}/${path_part}@${commit_sha} # ${latest_tag}"
			else
				new_action_part="${repo_part}@${commit_sha} # ${latest_tag}"
			fi

			print_status "New action part: $new_action_part"

			# Use sed to replace the entire uses: reference including any existing comments
			# This handles: @tag, @sha # oldcomment, @sha # old1 # old2, etc.
			# Use POSIX [[:space:]] instead of \s: BSD sed (macOS) does not
			# support GNU \s, which silently left every line untouched.
			new_line=$(\echo "$line" | \sed -E 's|(uses:[[:space:]]+)[^[:space:]"'"'"']+.*|\1'"${new_action_part}"'|')

			print_success "→ ${new_line}"

			append_line "$new_line"
		else
			append_line "$line"
		fi
	done <"$file"

	\mv "$temp_file" "$file"

	print_success "Updated $file"
done


print_status "Absorb verification"
FAILED=0
for Action in "${DiscoveredActions[@]}"; do
	if \grep -rq "uses:[[:space:]]*${Action}@" .github; then
		print_success "\u2192 ${Action} referenced in .github/"
	else
		print_error "\u2192 ${Action} not referenced in .github/"
		FAILED=$((FAILED+1))
	fi
done
[ "$FAILED" -eq 0 ] && print_success "Absorb Update.sh complete" || print_error "Absorb Update.sh finished with ${FAILED} unverified action(s)"
print_status "Update complete"