From 746d1164dc392815a5ade9f4fabc66a910862522 Mon Sep 17 00:00:00 2001
From: Max Thomson <git@mnt.dev>
Date: Sun, 16 Aug 2026 23:42:32 -0700
Subject: [PATCH] [ci] Upstream update daily

---
 .github/workflows/upstream.yml | 101 +++++++++++++++++++++++++++++++++
 Taskfile.yml                   |  14 ++++-
 2 files changed, 113 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/upstream.yml

diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
new file mode 100644
index 0000000..4631612
--- /dev/null
+++ b/.github/workflows/upstream.yml
@@ -0,0 +1,101 @@
+name: Upstream
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '17 6 * * *'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  bump:
+    name: Check for an upstream release
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      GH_TOKEN: ${{ secrets.BUMP_TOKEN }}
+    steps:
+      - name: Check bump token
+        env:
+          BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
+        run: |
+          if [ -z "$BUMP_TOKEN" ]; then
+            echo "::error::Missing BUMP_TOKEN secret. See the comment at the top of .github/workflows/upstream.yml for the permissions it needs."
+            exit 1
+          fi
+
+      - name: Checkout patches
+        uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.BUMP_TOKEN }}
+
+      - name: Set up Task
+        uses: arduino/setup-task@v2
+        with:
+          version: 3.x
+
+      - name: Pin the latest upstream release
+        run: task update-tag
+
+      - name: Decide whether there is anything to open
+        id: bump
+        run: |
+          tag=$(head -n 1 upstream.tag)
+
+          if git diff --quiet -- upstream.tag; then
+            echo "Already pinned to the latest upstream release (\`$tag\`)." >> "$GITHUB_STEP_SUMMARY"
+            echo "bump=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          branch="bump/$tag"
+          if git ls-remote --exit-code --heads origin "$branch" >/dev/null 2>&1; then
+            echo "\`$branch\` already exists - leaving it alone." >> "$GITHUB_STEP_SUMMARY"
+            echo "bump=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          {
+            echo "bump=true"
+            echo "tag=$tag"
+            echo "branch=$branch"
+            echo "old=$(git show HEAD:upstream.tag | head -n 1)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Open the pull request
+        if: steps.bump.outputs.bump == 'true'
+        env:
+          TAG: ${{ steps.bump.outputs.tag }}
+          OLD: ${{ steps.bump.outputs.old }}
+          BRANCH: ${{ steps.bump.outputs.branch }}
+        run: |
+          git config user.name 'Max Thomson'
+          git config user.email 'git@mnt.dev'
+          git switch -c "$BRANCH"
+          git commit -m "[upstream] Bump to $TAG" upstream.tag
+          git push origin "$BRANCH"
+
+          gh pr create --base master --head "$BRANCH" \
+            --title "[upstream] Bump to $TAG" \
+            --body "$(cat <<EOF
+          Organic Maps published a new Android release. This bumps the pinned tag only - \`patches/\` is untouched.
+
+          | | |
+          |---|---|
+          | From | \`$OLD\` |
+          | To | \`$TAG\` |
+          | Release | https://github.com/organicmaps/organicmaps/releases/tag/$TAG |
+          | Changes | https://github.com/organicmaps/organicmaps/compare/$OLD...$TAG |
+
+          The Build check replays \`patches/\` onto the new tag and builds the beta APK, so it is the
+          real test of this bump.
+          EOF
+          )"
+
+          echo "Opened a PR bumping \`$OLD\` -> \`$TAG\`." >> "$GITHUB_STEP_SUMMARY"
diff --git a/Taskfile.yml b/Taskfile.yml
index 77dca23..162ca9b 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -54,8 +54,18 @@ tasks:
       TARGET_TAG:
         sh: '{{if .TAG}}echo {{.TAG}}{{else}}task latest-tag{{end}}'
     cmds:
-      - echo {{.TARGET_TAG}} > {{.VERSION_FILE}}
-      - curl -sL {{.API_BASE}}/git/refs/tags/{{.TARGET_TAG}} | jq -r '.object.sha' >> {{.VERSION_FILE}}
+      - |
+        tag='{{.TARGET_TAG}}'
+        if [ -z "$tag" ] || [ "$tag" = null ]; then
+          echo 'Could not resolve the latest upstream tag. GitHub API rate limit?' >&2
+          exit 1
+        fi
+        sha=$(curl -sL {{.API_BASE}}/git/refs/tags/"$tag" | jq -r '.object.sha')
+        if ! printf '%s' "$sha" | grep -Eq '^[0-9a-f]{40}$'; then
+          echo "Could not resolve a commit for $tag, got '$sha'. Does that tag exist? GitHub API rate limit?" >&2
+          exit 1
+        fi
+        printf '%s\n%s\n' "$tag" "$sha" > {{.VERSION_FILE}}
       # No backticks in this message: inside a double-quoted shell string they are command
       # substitution, so naming the task here actually ran it.
       - 'echo "Pinned to {{.TARGET_TAG}}. Run: task apply-patches"'