docker-elk/.github/workflows/update.yml

name: Update Elastic release

on:
  schedule:
    - cron: '0 0 * * 0'  # At 00:00 every Sunday

jobs:

  check-and-update:
    name: Check and update Elastic release
    runs-on: ubuntu-latest
    strategy:
      matrix:
        branch:
          - main
          - tls
          - release-8.x

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ matrix.branch }}
          sparse-checkout-cone-mode: false
          sparse-checkout: /.env
      - name: Read current stack version
        id: current-release
        run: |
          source .env
          : ${ELASTIC_VERSION:?unset}
          echo "version=${ELASTIC_VERSION}" >>"$GITHUB_OUTPUT"

      - uses: actions/setup-node@v6
      - run: npm install semver

      - name: Get latest release version
        uses: actions/github-script@v8
        id: get-latest-release
        with:
          script: |
            const semver = require('semver')

            const latestVersion = await github.
              paginate(github.rest.repos.listReleases, {
                owner: 'elastic',
                repo: 'elasticsearch'
              })
              .then(releases => {
                for (const release of releases) {
                  // Results are returned sorted by created_at, so it is safe to assume
                  // that the first encountered match is also the series' latest release.

                  const version=semver.clean(release.tag_name)

                  if (semver.satisfies(version, '^${{ steps.current-release.outputs.version }}')) {
                    return version
                  }
                }
              });

            if (latestVersion) {
              // Return an object so that the result can be handled as structured data
              // instead of a quoted string in subsequent steps.
              return { version: latestVersion }
            }

      # Subsequent executions of actions/checkout omit to revert this setting to 'false',
      # even if sparse-checkout is later disabled (see actions/checkout#2034).
      - name: Disable sparse checkout
        run: git config core.sparseCheckout false
      # Removes untracked files created by npm (node_modules/, package.json, ...).
      # Disables previous sparse checkout.
      - name: Clean checkout
        uses: actions/checkout@v6
        if: steps.get-latest-release.outputs.result && fromJson(steps.get-latest-release.outputs.result).version != steps.current-release.outputs.version
        with:
          ref: ${{ matrix.branch }}

      - name: Update stack version
        id: update-files
        if: steps.get-latest-release.outputs.result && fromJson(steps.get-latest-release.outputs.result).version != steps.current-release.outputs.version
        run: |
          cur_ver=${{ steps.current-release.outputs.version }}
          new_ver=${{ fromJson(steps.get-latest-release.outputs.result).version }}

          # Escape period characters so sed interprets them literally
          cur_ver="${cur_ver//./\\.}"

          declare -a upd_files=( .env README.md */Dockerfile extensions/*/Dockerfile )
          if [ -f tls/README.md ]; then
              upd_files+=( tls/README.md )
          fi

          sed -i "s/${cur_ver}/${new_ver}/g" "${upd_files[@]}"

          git_status="$(git status --porcelain)"
          if [[ ${git_status} ]]; then
              echo -e 'Changes to be committed:\n'
              echo "${git_status}"
              echo 'has-changes=true' >>"$GITHUB_OUTPUT"
          fi

      - name: Impersonate update bot
        uses: actions/create-github-app-token@v2
        id: generate-token
        if: steps.update-files.outputs.has-changes
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Send pull request to update to new version
        if: steps.update-files.outputs.has-changes
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ steps.generate-token.outputs.token }}
          branch: update/${{ matrix.branch }}
          commit-message: Update to v${{ fromJson(steps.get-latest-release.outputs.result).version }}
          title: Update to v${{ fromJson(steps.get-latest-release.outputs.result).version }}
          delete-branch: true