update-cloudflared.yml

name: New cloudflared Release

permissions:
  contents: write
  pull-requests: write
  actions: write

on:
  schedule:
    - cron: '0 */12 * * *'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      needs_update: ${{ steps.update_guard.outputs.needs_update }}
      tag: ${{ steps.update_guard.outputs.tag }}
      title: ${{ steps.update_guard.outputs.title }}
      release_id: ${{ steps.draft_release.outputs.release_id }}
    steps:
      - name: Get latest upstream release info
        id: upstream_release
        uses: actions/github-script@v8
        with:
          script: |
            const { data } = await github.rest.repos.getLatestRelease({
              owner: 'cloudflare',
              repo: 'cloudflared'
            });
            core.setOutput('tag_name', data.tag_name);
            core.setOutput('name', data.name ?? data.tag_name);

      - name: Get latest release in this repo (if any)
        id: current_release
        uses: actions/github-script@v8
        with:
          script: |
            try {
              const { data } = await github.rest.repos.getLatestRelease({
                owner: context.repo.owner,
                repo: context.repo.repo
              });
              core.setOutput('tag_name', data.tag_name);
            } catch (error) {
              if (error.status === 404) {
                core.info('No existing release found in this repository.');
              } else {
                throw error;
              }
            }

      - name: Decide whether an update is required
        id: update_guard
        env:
          UPSTREAM_TAG: ${{ steps.upstream_release.outputs.tag_name }}
          UPSTREAM_TITLE: ${{ steps.upstream_release.outputs.name }}
          CURRENT_TAG: ${{ steps.current_release.outputs.tag_name }}
        run: |
          if [ -z "${UPSTREAM_TAG}" ]; then
            echo "Failed to determine upstream tag" >&2
            exit 1
          fi

          if [ "${UPSTREAM_TAG}" = "${CURRENT_TAG}" ]; then
            echo 'needs_update=false' >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "needs_update=true" >> "$GITHUB_OUTPUT"
          echo "tag=${UPSTREAM_TAG}" >> "$GITHUB_OUTPUT"
          {
            echo 'title<<EOF'
            echo "${UPSTREAM_TITLE}"
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

      - name: Checkout customizations branch
        if: steps.update_guard.outputs.needs_update == 'true'
        uses: actions/checkout@v6
        with:
          ref: customizations
          fetch-depth: 0

      - name: Prepare release branch
        if: steps.update_guard.outputs.needs_update == 'true'
        env:
          TAG: ${{ steps.update_guard.outputs.tag }}
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email 'github-actions[bot]@users.noreply.github.com'

          branch="release-${TAG}"

          # 1) Add upstream and fetch the tag
          git remote add upstream https://github.com/cloudflare/cloudflared.git
          git fetch upstream --depth=1 tag "${TAG}"

          # 2) Create new branch off the upstream tag
          git checkout -b "${branch}" "FETCH_HEAD"

          # 3) Merge in your customizations
          git fetch origin customizations
          git merge --no-commit --no-ff origin/customizations || true

          # 4) Re-apply BSD-portability file overlays (these shims rarely drift in upstream)
          rm -rf .github/workflows
          git checkout origin/customizations -- \
            cmd/cloudflared/generic_service.go \
            diagnostic/network/collector_unix_test.go \
            diagnostic/network/collector_unix.go \
            diagnostic/system_collector_unix.go \
            ingress/icmp_posix.go \
            ingress/icmp_posix_test.go \
            Makefile \
            patches

          # 5) Reset QUIC-related files to pristine upstream — the customizations
          #    branch still carries stale full-file copies of these from an older
          #    upstream base, which the step-3 merge leaves with conflict markers.
          #    The .patch in step 6 replaces them with the surgical delta we care about.
          #    (connection/errors_test.go from customizations is added net-new and
          #    has no upstream counterpart; we leave it where step 3 placed it.)
          git checkout "refs/tags/${TAG}" -- \
            connection/errors.go \
            connection/quic_connection.go \
            supervisor/tunnel.go \
            supervisor/tunnel_test.go

          # 6) Apply surgical patches for QUIC behavior changes.
          #    Patches express *intent* and survive surrounding upstream churn.
          #    If a patch fails to apply, this fails the workflow loudly so a
          #    human can re-derive the patch against the new upstream state.
          for patch in patches/*.patch; do
            echo "→ Applying ${patch}"
            git apply --3way "${patch}"
          done

          # 7) Finalise and push
          git add -A
          git commit -m "chore: apply customizations on ${TAG}"
          git push --force-with-lease origin "${branch}"

      - name: Create or update draft release
        id: draft_release
        if: steps.update_guard.outputs.needs_update == 'true'
        uses: actions/github-script@v8
        env:
          TAG: ${{ steps.update_guard.outputs.tag }}
          TITLE: ${{ steps.update_guard.outputs.title }}
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const tag = process.env.TAG;
            const title = process.env.TITLE || tag;
            const targetCommitish = `release-${tag}`;
            const body = [
              `Automated cloudflared release of version **${tag}**`,
              'Stock upstream cloudflared with BSD tweaks from `customizations` branch in this repo.'
            ].join('\n');
            const findReleaseByTag = async () => {
              let page = 1;

              while (true) {
                const { data } = await github.rest.repos.listReleases({
                  owner,
                  repo,
                  per_page: 100,
                  page
                });

                const match = data.find((release) => release.tag_name === tag);
                if (match) {
                  return match;
                }

                if (data.length < 100) {
                  return null;
                }

                page += 1;
              }
            };

            const existing = await findReleaseByTag();

            if (existing) {
              await github.rest.repos.updateRelease({
                owner,
                repo,
                release_id: existing.id,
                tag_name: tag,
                target_commitish: targetCommitish,
                name: title,
                body,
                draft: true,
                prerelease: false
              });

              core.setOutput('release_id', String(existing.id));
              core.info(`Updated existing draft release for ${tag}.`);
              return;
            }

            const { data: created } = await github.rest.repos.createRelease({
              owner,
              repo,
              tag_name: tag,
              target_commitish: targetCommitish,
              name: title,
              body,
              draft: true,
              prerelease: false
            });

            core.setOutput('release_id', String(created.id));
            core.info(`Created draft release for ${tag}.`);

  build_native:
    if: needs.prepare.outputs.needs_update == 'true'
    needs: prepare
    permissions:
      contents: write
      actions: write
    uses: ./.github/workflows/build_unix.yaml
    with:
      tag: ${{ needs.prepare.outputs.tag }}
    secrets: inherit

  publish_release:
    if: needs.prepare.outputs.needs_update == 'true' && needs.build_native.result == 'success'
    needs:
      - prepare
      - build_native
    runs-on: ubuntu-latest
    steps:
      - name: Publish draft release
        uses: actions/github-script@v8
        env:
          TAG: ${{ needs.prepare.outputs.tag }}
          TITLE: ${{ needs.prepare.outputs.title }}
          RELEASE_ID: ${{ needs.prepare.outputs.release_id }}
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const tag = process.env.TAG;
            const title = process.env.TITLE || tag;
            const releaseId = Number(process.env.RELEASE_ID);

            if (!releaseId) {
              throw new Error(`Missing release ID for tag ${tag}.`);
            }

            const { data: release } = await github.rest.repos.getRelease({
              owner,
              repo,
              release_id: releaseId
            });

            if (release.tag_name !== tag) {
              throw new Error(`Release ${releaseId} belongs to tag ${release.tag_name}, expected ${tag}.`);
            }

            if (!release.draft) {
              core.info(`Release ${tag} is already published.`);
              return;
            }

            await github.rest.repos.updateRelease({
              owner,
              repo,
              release_id: releaseId,
              name: title,
              draft: false,
              prerelease: false
            });

            core.info(`Published release ${tag}.`);

      - name: Prune older successful runs
        if: success()
        uses: actions/github-script@v8
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const keepSuccessfulRuns = 7;
            const workflowRef = process.env.GITHUB_WORKFLOW_REF || '';
            const workflowFile = workflowRef
              ? workflowRef.split('@')[0].split('/').pop()
              : 'update-cloudflared.yml';

            let kept = 0;
            let page = 1;
            let permissionDenied = false;

            while (true) {
              const { data } = await github.rest.actions.listWorkflowRuns({
                owner,
                repo,
                workflow_id: workflowFile,
                status: 'completed',
                per_page: 100,
                page
              });

              const runs = data.workflow_runs;
              if (!runs.length) {
                break;
              }

              for (const run of runs) {
                if (permissionDenied) {
                  break;
                }

                if (run.conclusion !== 'success') {
                  continue;
                }

                kept += 1;
                if (kept <= keepSuccessfulRuns) {
                  continue;
                }

                core.info(`Deleting run ${run.id} from ${run.created_at}`);
                try {
                  await github.rest.actions.deleteWorkflowRun({
                    owner,
                    repo,
                    run_id: run.id
                  });
                } catch (error) {
                  if (error.status === 403) {
                    core.warning('GITHUB_TOKEN lacks permission to delete workflow runs; skipping further pruning.');
                    permissionDenied = true;
                    break;
                  }
                  throw error;
                }
              }

              if (permissionDenied) {
                break;
              }

              if (runs.length < 100) {
                break;
              }

              page += 1;
            }