dependency-updates.yml

name: dependency-updates
on:
  push:
    branches:
      - develop
  schedule:
    - cron: "0 * * * *"
  workflow_dispatch:
permissions:
  contents: write
  pull-requests: write
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false
defaults:
  run:
    shell: bash
jobs:
  version-updates:
    name: ${{ matrix.name }}-update
    runs-on: ubuntu-slim
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: aws-lc
            arg: AWSLC
            repo: aws/aws-lc
          - name: nginx
            arg: NGINX
            repo: nginx/nginx
          - name: ngx_http_brotli_module
            arg: NB
            repo: HanadaLee/ngx_http_brotli_module
            bad: "v1.0.0rc"
            fine: master
          - name: ngx_http_unbrotli_filter_module
            arg: NUB
            repo: HanadaLee/ngx_http_unbrotli_filter_module
            bad: ""
            fine: main
          - name: zstd-nginx-module
            arg: ZNM
            repo: hsw/zstd-nginx-module
          - name: ngx_http_unzstd_filter_module
            arg: NHUZFM
            repo: HanadaLee/ngx_http_unzstd_filter_module
            bad: ""
            fine: main
          - name: ngx-fancyindex
            arg: NF
            repo: aperezdc/ngx-fancyindex
          - name: headers-more-nginx-module
            arg: HMNM
            repo: openresty/headers-more-nginx-module
          - name: ngx_devel_kit
            arg: NDK
            repo: vision5/ngx_devel_kit
          - name: lua-nginx-module
            arg: LNM
            repo: openresty/lua-nginx-module
          - name: njs
            arg: NJS
            repo: nginx/njs
          - name: nginx-auth-ldap
            arg: NAL
            repo: kvspb/nginx-auth-ldap
            bad: "v0.1"
            fine: master
          - name: vts
            arg: VTS
            repo: vozlt/nginx-module-vts
          - name: nginx-ntlm-module
            arg: NNTLM
            repo: gabihodoroaga/nginx-ntlm-module
            bad: "v1.19.3-beta.1"
            fine: master
          - name: ngx_http_geoip2_module
            arg: NHG2M
            repo: leev/ngx_http_geoip2_module
          - name: lua-resty-core
            arg: LRC
            repo: openresty/lua-resty-core
          - name: lua-resty-lrucache
            arg: LRL
            repo: openresty/lua-resty-lrucache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update ${{ matrix.name }} version
        id: update
        run: |
          VER="$(
          git ls-remote --tags --refs https://github.com/${{ matrix.repo }} \
              | cut -d/ -f3 \
              | sed 's|rc|~&|I' \
              | sort -V \
              | sed 's|~||' \
              | tail -1
          )"
          if [ "$VER" = "${{ matrix.bad }}" ]; then VER="${{ matrix.fine }}"; fi
          SHA="$(git ls-remote https://github.com/${{ matrix.repo }} "$VER" | cut -f1)"
          echo "compare=https://github.com/${{ matrix.repo }}/compare/$(sed -n 's|^ARG ${{ matrix.arg }}_VER=\(.*\) #.*|\1|p' Dockerfile)...$SHA" >> $GITHUB_OUTPUT
          sed -i "s|ARG ${{ matrix.arg }}_VER=.*|ARG ${{ matrix.arg }}_VER=$SHA # $VER|" Dockerfile
          echo "version=$VER" >> $GITHUB_OUTPUT
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update ${{ matrix.name }} version to ${{ steps.update.outputs.version }}
          branch: update-${{ matrix.name }}-version
          title: update ${{ matrix.name }} version to ${{ steps.update.outputs.version }}
          body: ${{ steps.update.outputs.compare }}

  lua-cs-bouncer-update:
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update lua-cs-bouncer version
        id: update
        run: |
          LCSB_VER="$(
          git ls-remote --tags --refs https://github.com/crowdsecurity/lua-cs-bouncer \
              | cut -d/ -f3 \
              | sed 's|rc|~&|I' \
              | sort -V \
              | sed 's|~||' \
              | tail -1
          )"
          LCSB_SHA="$(git ls-remote https://github.com/crowdsecurity/lua-cs-bouncer "$LCSB_VER" | cut -f1)"
          echo "compare=https://github.com/crowdsecurity/lua-cs-bouncer/compare/$(sed -n 's|^ARG LCSB_VER=\(.*\) #.*|\1|p' Dockerfile)...$LCSB_SHA" >> $GITHUB_OUTPUT
          sed -i "s|ARG LCSB_VER=.*|ARG LCSB_VER=$LCSB_SHA # $LCSB_VER|" Dockerfile
          sed -i "s|crowdsec-npmplus-bouncer/.*\"|crowdsec-npmplus-bouncer/$LCSB_VER\"|" rootfs/usr/local/nginx/conf/conf.d/crowdsec.conf.disabled
          echo "version=$LCSB_VER" >> $GITHUB_OUTPUT
          curl -sSfL https://raw.githubusercontent.com/crowdsecurity/lua-cs-bouncer/refs/tags/"$LCSB_VER"/config_example.conf -o rootfs/etc/crowdsec.conf.original
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update lua-cs-bouncer version to ${{ steps.update.outputs.version }}
          branch: update-lua-cs-bouncer-version
          title: update lua-cs-bouncer version to ${{ steps.update.outputs.version }}
          body: ${{ steps.update.outputs.compare }}
  cs-nginx-bouncer-update:
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update cs-nginx-bouncer config
        run: |
          curl -sSfL https://raw.githubusercontent.com/crowdsecurity/cs-nginx-bouncer/main/nginx/crowdsec_nginx.conf -o rootfs/usr/local/nginx/conf/conf.d/crowdsec.conf.original
          sed -i "s|crowdsec-nginx-bouncer/.*\"|crowdsec-nginx-bouncer/version\"|" rootfs/usr/local/nginx/conf/conf.d/crowdsec.conf.original
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update cs-nginx-bouncer config
          branch: update-cs-nginx-bouncer-config
          title: update cs-nginx-bouncer config
          body: https://github.com/crowdsecurity/cs-nginx-bouncer/commits/main/nginx/crowdsec_nginx.conf

  patch-hash-update:
    name: ${{ matrix.name }}-${{ matrix.pull }}-patch-update
    runs-on: ubuntu-slim
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: nginx
            repo: nginx/nginx
            pull: 689
          - name: nginx
            repo: nginx/nginx
            pull: 1219
          - name: nginx
            repo: nginx/nginx
            pull: 1333
          - name: nginx
            repo: nginx/nginx
            pull: 1430
          - name: fancyindex
            repo: aperezdc/ngx-fancyindex
            pull: 176
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update ${{ matrix.name }} ${{ matrix.pull }} patch hash
        run: |
          HASH="$(curl -sSfL https://patch-diff.githubusercontent.com/raw/${{ matrix.repo }}/pull/${{ matrix.pull }}.patch | sha256sum | cut -d" " -f1)"
          sed -i "\|pull/${{ matrix.pull }}.patch|{n;s|[0-9a-f]\{64\}|$HASH|}" Dockerfile
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update ${{ matrix.name }} ${{ matrix.pull }} patch hash
          branch: update-${{ matrix.name }}-${{ matrix.pull }}-patch-hash
          title: update ${{ matrix.name }} ${{ matrix.pull }} patch hash
          body: https://github.com/${{ matrix.repo }}/pull/${{ matrix.pull }}

  dynamic_tls_records-update:
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update dynamic_tls_records version
        id: update
        run: |
          git clone --depth 1 https://github.com/nginx-modules/ngx_http_tls_dyn_size ngx_http_tls_dyn_size
          DTR_VER="$(
          ls ngx_http_tls_dyn_size/nginx__dynamic_tls_records_*.patch \
              | sed "s|ngx_http_tls_dyn_size/nginx__dynamic_tls_records_\([0-9.]\+\)+.patch|\1|g" \
              | sort -V \
              | tail -1
          )"
          rm -r ngx_http_tls_dyn_size
          sed -i "s|ARG DTR_VER=.*|ARG DTR_VER=$DTR_VER|" Dockerfile
          DTR_HASH="$(curl -sSfL https://raw.githubusercontent.com/nginx-modules/ngx_http_tls_dyn_size/master/nginx__dynamic_tls_records_"$DTR_VER"%2B.patch | sha256sum | cut -d" " -f1)"
          sed -i "\|dynamic_tls_records|{n;s|[0-9a-f]\{64\}|$DTR_HASH|}" Dockerfile
          echo "version=$DTR_VER" >> $GITHUB_OUTPUT
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update dynamic_tls_records version to ${{ steps.update.outputs.version }}
          branch: update-dynamic_tls_records-version
          title: update dynamic_tls_records version to ${{ steps.update.outputs.version }}
          body: update dynamic_tls_records version to ${{ steps.update.outputs.version }}
  resolver_conf_parsing-update:
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update resolver_conf_parsing version
        id: update
        run: |
          git clone --depth 1 https://github.com/openresty/openresty openresty
          RCP_VER="$(
          ls openresty/patches/nginx \
              | sort -V \
              | tail -1
          )"
          rm -r openresty
          sed -i "s|ARG RCP_VER=.*|ARG RCP_VER=$RCP_VER|" Dockerfile
          RCP_HASH="$(curl -sSfL https://raw.githubusercontent.com/openresty/openresty/master/patches/nginx/"$RCP_VER"/nginx-"$RCP_VER"-resolver_conf_parsing.patch | sha256sum | cut -d" " -f1)"
          sed -i "\|resolver_conf_parsing|{n;s|[0-9a-f]\{64\}|$RCP_HASH|}" Dockerfile
          echo "version=$RCP_VER" >> $GITHUB_OUTPUT
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update resolver_conf_parsing version to ${{ steps.update.outputs.version }}
          branch: update-resolver_conf_parsing-version
          title: update resolver_conf_parsing version to ${{ steps.update.outputs.version }}
          body: update resolver_conf_parsing version to ${{ steps.update.outputs.version }}
  zlib-ng-patch-update:
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update zlib-ng-patch version
        id: update
        run: |
          git clone --depth 1 https://github.com/zlib-ng/patches zlib-ng-patches
          ZNP_VER="$(
          ls zlib-ng-patches/nginx/*-zlib-ng.patch \
              | sed "s|zlib-ng-patches/nginx/\([0-9.]\+\)-zlib-ng.patch|\1|g" \
              | sort -V \
              | tail -1
          )"
          rm -r zlib-ng-patches
          sed -i "s|ARG ZNP_VER=.*|ARG ZNP_VER=$ZNP_VER|" Dockerfile
          ZNP_HASH="$(curl -sSfL https://raw.githubusercontent.com/zlib-ng/patches/master/nginx/"$ZNP_VER"-zlib-ng.patch | sha256sum | cut -d" " -f1)"
          sed -i "\|zlib-ng.patch|{n;s|[0-9a-f]\{64\}|$ZNP_HASH|}" Dockerfile
          echo "version=$ZNP_VER" >> $GITHUB_OUTPUT
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update zlib-ng-patch version to ${{ steps.update.outputs.version }}
          branch: update-zlib-ng-patch-version
          title: update zlib-ng-patch version to ${{ steps.update.outputs.version }}
          body: update zlib-ng-patch version to ${{ steps.update.outputs.version }}

  certbot-ocsp-fetcher-update:
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update certbot-ocsp-fetcher version
        id: update
        run: |
          COF_SHA="$(git ls-remote https://github.com/tomwassenberg/certbot-ocsp-fetcher main | cut -f1)"
          echo "compare=https://github.com/tomwassenberg/certbot-ocsp-fetcher/compare/$(sed -n 's|^ARG COF_VER=\(.*\) #.*|\1|p' Dockerfile)...$COF_SHA" >> $GITHUB_OUTPUT
          sed -i "s|ARG COF_VER=.*|ARG COF_VER=$COF_SHA # main|" Dockerfile
          COF_HASH="$(curl -sSfL https://raw.githubusercontent.com/tomwassenberg/certbot-ocsp-fetcher/"$COF_SHA"/certbot-ocsp-fetcher | sha256sum | cut -d" " -f1)"
          sed -i "\|raw.githubusercontent.com/tomwassenberg|{n;s|[0-9a-f]\{64\}|$COF_HASH|}" Dockerfile
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update certbot-ocsp-fetcher version
          branch: update-certbot-ocsp-fetcher-version
          title: update certbot-ocsp-fetcher version
          body: ${{ steps.update.outputs.compare }}
  nginxbeautifier-update:
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update nginxbeautifier version
        id: update
        run: |
          NBF_SHA="$(git ls-remote https://github.com/vasilevich/nginxbeautifier master | cut -f1)"
          if [ "$NBF_SHA" = "ac5fd769a49c79bf2d750b6456a4565c6c99578d" ]; then NBF_SHA="$(sed -n 's|^ARG NBF_VER=\(.*\) #.*|\1|p' Dockerfile)"; fi
          echo "compare=https://github.com/vasilevich/nginxbeautifier/compare/$(sed -n 's|^ARG NBF_VER=\(.*\) #.*|\1|p' Dockerfile)...$NBF_SHA" >> $GITHUB_OUTPUT
          sed -i "s|ARG NBF_VER=.*|ARG NBF_VER=$NBF_SHA # master|" Dockerfile
          NBF_HASH="$(curl -sSfL https://raw.githubusercontent.com/vasilevich/nginxbeautifier/"$NBF_SHA"/index.js | sha256sum | cut -d" " -f1)"
          sed -i "\|nginxbeautifier/\"\$NBF_VER\"/index.js|{n;s|[0-9a-f]\{64\}|$NBF_HASH|}" Dockerfile
          NBF_HASH="$(curl -sSfL https://raw.githubusercontent.com/vasilevich/nginxbeautifier/"$NBF_SHA"/nginxbeautifier.js | sha256sum | cut -d" " -f1)"
          sed -i "\|nginxbeautifier/\"\$NBF_VER\"/nginxbeautifier.js|{n;s|[0-9a-f]\{64\}|$NBF_HASH|}" Dockerfile
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update nginxbeautifier version
          branch: update-nginxbeautifier-version
          title: update nginxbeautifier version
          body: ${{ steps.update.outputs.compare }}

  owasp-headers-remove-update:
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: update owasp headers-remove list
        id: update
        run: |
          curl -sSfL https://raw.githubusercontent.com/OWASP/www-project-secure-headers/master/ci/headers_remove.json -o /tmp/headers_remove.json
          jq -r '.headers[] | select(. != "Server") | "more_clear_headers \(tojson);"' /tmp/headers_remove.json > rootfs/usr/local/nginx/conf/headers-remove.conf
          echo "version=$(jq -r .last_update_utc /tmp/headers_remove.json)" >> $GITHUB_OUTPUT
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true
          delete-branch: true
          commit-message: update owasp headers-remove list to ${{ steps.update.outputs.version }}
          branch: update-owasp-headers-remove-list
          title: update owasp headers-remove list to ${{ steps.update.outputs.version }}
          body: https://github.com/OWASP/www-project-secure-headers/commits/master/ci/headers_remove.json