Update WAProto #136 #136
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update WAProto | |
| on: | |
| schedule: | |
| - cron: '0 3 * * *' | |
| workflow_dispatch: | |
| # Dynamic run name with run number | |
| run-name: "Update WAProto #${{ github.run_number }}" | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| actions: write | |
| jobs: | |
| update-proto: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20.x | |
| - name: Enable Corepack and Set Yarn Version | |
| run: | | |
| corepack enable | |
| corepack prepare yarn@4.x --activate | |
| - name: Configure Git for HTTPS | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Force git to use HTTPS instead of SSH for GitHub repositories | |
| git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" | |
| git config --global url."https://github.com/".insteadOf "git@github.com:" | |
| # Configure git to use GITHUB_TOKEN for authentication | |
| git config --global url."https://x-access-token:${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/" | |
| - name: Install packages | |
| run: | | |
| yarn install --immutable | |
| yarn --cwd proto-extract install --immutable | |
| - name: Update WAProto.proto | |
| id: wa_proto_info | |
| run: | | |
| yarn --cwd proto-extract start > wa-logs.txt | |
| WA_VERSION=$(cat wa-logs.txt | perl -n -e'/Current version\: (.+)/ && print $1') | |
| WA_JS_URL=$(cat wa-logs.txt | perl -n -e'/Found source JS URL\: (.+)/ && print $1') | |
| echo "wa_version=$WA_VERSION" >> $GITHUB_OUTPUT | |
| echo "wa_js_url=$WA_JS_URL" >> $GITHUB_OUTPUT | |
| # Display version prominently | |
| echo "📱 WhatsApp Proto Version: v$WA_VERSION" | |
| echo "🔗 Source JS URL: $WA_JS_URL" | |
| - name: GenerateStatics | |
| run: yarn gen:protobuf | |
| # audit CI-03: `wa_version` comes from a regex over output produced by | |
| # an external proto-extract run that fetches `web.whatsapp.com`. Pass | |
| # it through an env var AND a numeric-only filter (`tr -cd '0-9.'`) | |
| # so a hostile injection in the upstream output can't escape the JSON | |
| # literal or the shell context. Empty input falls through to a hard | |
| # fail rather than producing `{"version": []}`. | |
| - name: Update baileys-version.json | |
| env: | |
| WA_VERSION: ${{steps.wa_proto_info.outputs.wa_version}} | |
| run: | | |
| SAFE_VERSION=$(printf '%s' "$WA_VERSION" | tr -cd '0-9.') | |
| # Reject anything that isn't EXACTLY `N.N.N` — `tr -cd '0-9.'` strips | |
| # non-numeric chars but leaves trailing/leading dots ("2.3000." | |
| # would survive) and the resulting JSON literal would be malformed: | |
| # `{"version": [2, 3000, ]}`. Tight regex makes baileys-version.json | |
| # corruption impossible. (audit CI-03 followup, threads 8 + 10) | |
| if ! printf '%s' "$SAFE_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then | |
| echo "::error::wa_version not a valid N.N.N triple after sanitisation: '$SAFE_VERSION' (raw='$WA_VERSION')" | |
| exit 1 | |
| fi | |
| WA_NUMBERS=$(printf '%s' "$SAFE_VERSION" | sed "s/\./, /g") | |
| echo "{\"version\": [$WA_NUMBERS]}" > src/Defaults/baileys-version.json | |
| # Confirm update | |
| echo "✅ Updated baileys-version.json to v$SAFE_VERSION" | |
| cat src/Defaults/baileys-version.json | |
| - name: Create Pull Request | |
| id: create_pr | |
| uses: peter-evans/create-pull-request@v5 | |
| with: | |
| commit-message: 'chore: update proto/version to v${{steps.wa_proto_info.outputs.wa_version}}' | |
| title: 'chore: update WhatsApp proto to v${{steps.wa_proto_info.outputs.wa_version}}' | |
| branch: 'update-proto/stable' | |
| delete-branch: true | |
| labels: 'update-proto' | |
| body: | | |
| ## 📦 Automated WhatsApp Proto Update | |
| **Version:** `v${{steps.wa_proto_info.outputs.wa_version}}` | |
| **Source JS URL:** ${{steps.wa_proto_info.outputs.wa_js_url}} | |
| ### Changes | |
| - ✅ Updated `WAProto/*` (protobuf definitions) | |
| - ✅ Updated `src/Defaults/baileys-version.json` | |
| ### Update Frequency | |
| Daily at 03:00 UTC (00:00 BRT) | |
| add-paths: | | |
| WAProto/* | |
| src/Defaults/baileys-version.json | |
| - name: Enable Auto-merge | |
| if: steps.create_pr.outputs.pull-request-number != '' | |
| # audit CI-P1-B — `wa_version` was interpolated raw into the shell | |
| # here (and in Summary below), bypassing the sanitisation that only | |
| # happened inside the "Update baileys-version.json" step. Pass | |
| # through env vars + filter so a hostile WhatsApp source response | |
| # can't escape into command execution. | |
| env: | |
| GH_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }} | |
| PR_NUMBER_INPUT: ${{ steps.create_pr.outputs.pull-request-number }} | |
| WA_VERSION_RAW: ${{ steps.wa_proto_info.outputs.wa_version }} | |
| run: | | |
| PR_NUMBER=$(printf '%s' "$PR_NUMBER_INPUT" | tr -cd '0-9') | |
| WA_VERSION=$(printf '%s' "$WA_VERSION_RAW" | tr -cd '0-9.') | |
| echo "🔀 Enabling auto-merge for PR #$PR_NUMBER (v$WA_VERSION)..." | |
| # Enable auto-merge with squash method | |
| set +e | |
| AUTO_MERGE_OUTPUT=$(gh pr merge "$PR_NUMBER" \ | |
| --repo "${{ github.repository }}" \ | |
| --squash \ | |
| --auto \ | |
| --delete-branch 2>&1) | |
| AUTO_MERGE_EXIT=$? | |
| set -e | |
| if [ $AUTO_MERGE_EXIT -eq 0 ]; then | |
| echo "✅ Auto-merge enabled for PR #$PR_NUMBER (v$WA_VERSION)" | |
| echo "$AUTO_MERGE_OUTPUT" | |
| echo "⏳ PR will be merged automatically once all checks pass" | |
| else | |
| echo "::warning::Failed to enable auto-merge for PR #$PR_NUMBER (v$WA_VERSION)" | |
| echo "::group::Auto-merge Error Output" | |
| echo "$AUTO_MERGE_OUTPUT" | |
| echo "::endgroup::" | |
| # Fall back to waiting for checks and then merging | |
| echo "🔄 Falling back to wait-and-merge strategy..." | |
| # Wait for checks to start | |
| echo "⏳ Waiting 30 seconds for checks to start..." | |
| sleep 30 | |
| # Wait for checks to complete (max 5 minutes) | |
| echo "⏳ Waiting for checks to complete..." | |
| WAIT_COUNT=0 | |
| MAX_WAIT=60 # 60 * 5 seconds = 5 minutes | |
| while [ $WAIT_COUNT -lt $MAX_WAIT ]; do | |
| set +e | |
| CHECK_STATUS=$(gh pr checks "$PR_NUMBER" --repo "${{ github.repository }}" 2>&1) | |
| CHECK_EXIT=$? | |
| set -e | |
| if [ $CHECK_EXIT -eq 0 ]; then | |
| echo "📊 Current check status:" | |
| echo "$CHECK_STATUS" | |
| # Check if all checks passed | |
| if echo "$CHECK_STATUS" | grep -q "All checks have passed"; then | |
| echo "✅ All checks passed!" | |
| break | |
| fi | |
| # Check if any check failed | |
| if echo "$CHECK_STATUS" | grep -qE "(fail|failure|error)"; then | |
| echo "❌ Some checks failed, aborting merge" | |
| exit 1 | |
| fi | |
| fi | |
| WAIT_COUNT=$((WAIT_COUNT + 1)) | |
| echo "⏳ Waiting... ($WAIT_COUNT/$MAX_WAIT)" | |
| sleep 5 | |
| done | |
| if [ $WAIT_COUNT -ge $MAX_WAIT ]; then | |
| echo "::warning::Timeout waiting for checks to complete" | |
| echo "::warning::PR #$PR_NUMBER requires manual merge: https://github.com/${{ github.repository }}/pull/$PR_NUMBER" | |
| exit 0 | |
| fi | |
| # Try to merge now that checks passed | |
| echo "🔀 Attempting to merge PR #$PR_NUMBER..." | |
| set +e | |
| MERGE_OUTPUT=$(gh pr merge "$PR_NUMBER" \ | |
| --repo "${{ github.repository }}" \ | |
| --squash \ | |
| --delete-branch \ | |
| --yes 2>&1) | |
| MERGE_EXIT=$? | |
| set -e | |
| if [ $MERGE_EXIT -eq 0 ]; then | |
| echo "✅ PR #$PR_NUMBER (v$WA_VERSION) merged successfully" | |
| echo "$MERGE_OUTPUT" | |
| else | |
| echo "::error::Failed to merge PR #$PR_NUMBER (v$WA_VERSION)" | |
| echo "::group::Merge Error Output" | |
| echo "$MERGE_OUTPUT" | |
| echo "::endgroup::" | |
| # Try with admin flag | |
| echo "🔧 Attempting merge with admin override..." | |
| set +e | |
| ADMIN_OUTPUT=$(gh pr merge "$PR_NUMBER" \ | |
| --repo "${{ github.repository }}" \ | |
| --squash \ | |
| --delete-branch \ | |
| --admin 2>&1) | |
| ADMIN_EXIT=$? | |
| set -e | |
| if [ $ADMIN_EXIT -eq 0 ]; then | |
| echo "✅ PR #$PR_NUMBER (v$WA_VERSION) merged with admin override" | |
| echo "$ADMIN_OUTPUT" | |
| else | |
| echo "::error::Failed to merge even with admin override" | |
| echo "::group::Admin Merge Error Output" | |
| echo "$ADMIN_OUTPUT" | |
| echo "::endgroup::" | |
| echo "::warning::Consider configuring a Personal Access Token (PAT) with full repo permissions as GH_PAT secret" | |
| echo "::warning::PR #$PR_NUMBER requires manual merge: https://github.com/${{ github.repository }}/pull/$PR_NUMBER" | |
| exit 0 | |
| fi | |
| fi | |
| fi | |
| - name: Summary | |
| if: always() | |
| # audit CI-P1-B — `wa_js_url` had NEVER been sanitised anywhere. It | |
| # came verbatim from a regex over `web.whatsapp.com`'s response. We | |
| # accept only valid HTTPS URL characters here; everything else is | |
| # stripped before the value reaches Markdown / shell. | |
| env: | |
| WA_VERSION_RAW: ${{ steps.wa_proto_info.outputs.wa_version }} | |
| WA_JS_URL_RAW: ${{ steps.wa_proto_info.outputs.wa_js_url }} | |
| PR_NUMBER_RAW: ${{ steps.create_pr.outputs.pull-request-number }} | |
| run: | | |
| echo "### 📦 WAProto Update" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| WA_VERSION=$(printf '%s' "$WA_VERSION_RAW" | tr -cd '0-9.') | |
| # The `-` MUST be the last char in the class, otherwise `_-+` | |
| # is parsed as the (invalid) range from `_` (0x5F) to `+` (0x2B) | |
| # and GNU `tr` aborts with "reverse collating sequence order", | |
| # breaking every Summary step run. | |
| WA_JS_URL=$(printf '%s' "$WA_JS_URL_RAW" | tr -cd 'A-Za-z0-9:/?&=._+~%#-') | |
| PR_NUMBER=$(printf '%s' "$PR_NUMBER_RAW" | tr -cd '0-9') | |
| echo "**Version:** \`v$WA_VERSION\`" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if [ -n "$PR_NUMBER" ]; then | |
| echo "✅ **PR #$PR_NUMBER created with auto-merge enabled**" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "**Changes:**" >> $GITHUB_STEP_SUMMARY | |
| echo "- 📦 Updated WAProto/* (protobuf definitions)" >> $GITHUB_STEP_SUMMARY | |
| echo "- 📝 Updated baileys-version.json" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "**Source:** [$WA_JS_URL]($WA_JS_URL)" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "🔀 PR will merge automatically once checks pass" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "ℹ️ No changes detected - already up to date" >> $GITHUB_STEP_SUMMARY | |
| fi |