Skip to content

deps(deps): update dependency openssl/openssl to v4 #5

deps(deps): update dependency openssl/openssl to v4

deps(deps): update dependency openssl/openssl to v4 #5

name: Update nginx SHA256 checksums
# Triggered automatically when Renovate opens/updates a PR that touches the nginx installers.
# Downloads the new tarballs, calculates SHA256 hashes, and commits them back to the PR branch.
on:
pull_request:
branches: [main]
paths:
- 'nginx/nginx_installer.sh'
- 'nginx/nginx_installer.ps1'
permissions:
contents: write
jobs:
update-checksums:
name: Recalculate SHA256 checksums
runs-on: ubuntu-latest
if: startsWith(github.head_ref, 'renovate/')
steps:
- name: Checkout PR branch
uses: actions/checkout@v6
with:
ref: ${{ github.head_ref }}
token: ${{ secrets.GITHUB_TOKEN }}
- name: Read versions from bash installer
id: versions
run: |
echo "nginx=$(grep -oP 'NGINX_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT
echo "openssl=$(grep -oP 'OPENSSL_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT
echo "pcre2=$(grep -oP 'PCRE2_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT
echo "zlib=$(grep -oP 'ZLIB_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT
echo "headers_more=$(grep -oP 'HEADERS_MORE_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT
echo "zstd=$(grep -oP 'ZSTD_MODULE_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT
echo "acme=$(grep -oP 'ACME_MODULE_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT
- name: Download tarballs and calculate SHA256
id: checksums
run: |
set -euo pipefail
TMPDIR=$(mktemp -d)
cd "$TMPDIR"
download_and_hash() {
local url="$1" file="$2"
if ! wget -q "$url" -O "$file"; then
echo "ERROR: Failed to download $url" >&2
exit 1
fi
sha256sum "$file" | awk '{print $1}'
}
NGINX_SHA=$(download_and_hash \
"https://github.com/nginx/nginx/releases/download/release-${{ steps.versions.outputs.nginx }}/nginx-${{ steps.versions.outputs.nginx }}.tar.gz" \
"nginx.tar.gz")
OPENSSL_SHA=$(download_and_hash \
"https://github.com/openssl/openssl/releases/download/openssl-${{ steps.versions.outputs.openssl }}/openssl-${{ steps.versions.outputs.openssl }}.tar.gz" \
"openssl.tar.gz")
PCRE2_SHA=$(download_and_hash \
"https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${{ steps.versions.outputs.pcre2 }}/pcre2-${{ steps.versions.outputs.pcre2 }}.tar.gz" \
"pcre2.tar.gz")
ZLIB_SHA=$(download_and_hash \
"https://github.com/madler/zlib/releases/download/v${{ steps.versions.outputs.zlib }}/zlib-${{ steps.versions.outputs.zlib }}.tar.gz" \
"zlib.tar.gz")
HEADERS_MORE_SHA=$(download_and_hash \
"https://github.com/openresty/headers-more-nginx-module/archive/refs/tags/v${{ steps.versions.outputs.headers_more }}.tar.gz" \
"headers-more.tar.gz")
ZSTD_SHA=$(download_and_hash \
"https://github.com/tokers/zstd-nginx-module/archive/refs/tags/${{ steps.versions.outputs.zstd }}.tar.gz" \
"zstd.tar.gz")
ACME_SHA=$(download_and_hash \
"https://github.com/nginx/nginx-acme/releases/download/v${{ steps.versions.outputs.acme }}/nginx-acme-${{ steps.versions.outputs.acme }}.tar.gz" \
"acme.tar.gz")
echo "nginx=$NGINX_SHA" >> $GITHUB_OUTPUT
echo "openssl=$OPENSSL_SHA" >> $GITHUB_OUTPUT
echo "pcre2=$PCRE2_SHA" >> $GITHUB_OUTPUT
echo "zlib=$ZLIB_SHA" >> $GITHUB_OUTPUT
echo "headers_more=$HEADERS_MORE_SHA" >> $GITHUB_OUTPUT
echo "zstd=$ZSTD_SHA" >> $GITHUB_OUTPUT
echo "acme=$ACME_SHA" >> $GITHUB_OUTPUT
- name: Update checksums in bash installer
run: |
sed -i "s/NGINX_SHA256=\"[^\"]*\"/NGINX_SHA256=\"${{ steps.checksums.outputs.nginx }}\"/" nginx/nginx_installer.sh
sed -i "s/OPENSSL_SHA256=\"[^\"]*\"/OPENSSL_SHA256=\"${{ steps.checksums.outputs.openssl }}\"/" nginx/nginx_installer.sh
sed -i "s/PCRE2_SHA256=\"[^\"]*\"/PCRE2_SHA256=\"${{ steps.checksums.outputs.pcre2 }}\"/" nginx/nginx_installer.sh
sed -i "s/ZLIB_SHA256=\"[^\"]*\"/ZLIB_SHA256=\"${{ steps.checksums.outputs.zlib }}\"/" nginx/nginx_installer.sh
sed -i "s/HEADERS_MORE_SHA256=\"[^\"]*\"/HEADERS_MORE_SHA256=\"${{ steps.checksums.outputs.headers_more }}\"/" nginx/nginx_installer.sh
sed -i "s/ZSTD_MODULE_SHA256=\"[^\"]*\"/ZSTD_MODULE_SHA256=\"${{ steps.checksums.outputs.zstd }}\"/" nginx/nginx_installer.sh
sed -i "s/ACME_MODULE_SHA256=\"[^\"]*\"/ACME_MODULE_SHA256=\"${{ steps.checksums.outputs.acme }}\"/" nginx/nginx_installer.sh
- name: Update checksums in PowerShell installer
run: |
sed -i "s/\(\$Script:NGINX_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.nginx }}'/" nginx/nginx_installer.ps1
sed -i "s/\(\$Script:OPENSSL_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.openssl }}'/" nginx/nginx_installer.ps1
sed -i "s/\(\$Script:PCRE2_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.pcre2 }}'/" nginx/nginx_installer.ps1
sed -i "s/\(\$Script:ZLIB_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.zlib }}'/" nginx/nginx_installer.ps1
sed -i "s/\(\$Script:HEADERS_MORE_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.headers_more }}'/" nginx/nginx_installer.ps1
sed -i "s/\(\$Script:ZSTD_MODULE_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.zstd }}'/" nginx/nginx_installer.ps1
sed -i "s/\(\$Script:ACME_MODULE_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.acme }}'/" nginx/nginx_installer.ps1
- name: Commit updated checksums
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add nginx/nginx_installer.sh nginx/nginx_installer.ps1
if git diff --staged --quiet; then
echo "Checksums are already up to date, nothing to commit."
else
git commit -m "chore: update nginx dependency SHA256 checksums"
git push
fi