From 8769d5127fba23b078213cdd39c1dca85a52144e Mon Sep 17 00:00:00 2001
From: Giovanni Ferri <giovanni@syscode.uk>
Date: Fri, 7 Aug 2026 21:55:54 +0100
Subject: [PATCH] ci(reconcile): auto-rewrite derived files when versions.yaml
 changes

Editing omni/versions.yaml to a version that needs no new build (re-pin,
rollback, canary tweak) used to leave oci-lab's machine classes and cluster
template stale: only the talos-images build rewrote them, and it does not run
when nothing needs to be built.

On a push to main touching omni/versions.yaml this workflow runs
check-version-drift.py --write and commits the derived-file fix.

The installer_built() guard keeps the two writers from racing:
  * Already-built target  -> --write succeeds, derived files committed here.
  * Not-yet-built target  -> the guard refuses, the job fails with a clear
    'build first' message, and the operator runs the talos-images build as
    before; that build ships the installer and rewrites derived files (4.2).
So pin-then-build stays the release model for genuinely new versions, while
re-pins become fully automatic.

Verified in a throwaway worktree: v1.13.6 re-pin rewrote both machine classes
(rc 0, clean diff); v9.9.9 unbuilt refused (rc 1, derived files untouched).
The paths filter means the reconcile commit (no versions.yaml change) cannot
re-trigger the workflow.
---
 .github/workflows/reconcile.yml | 63 +++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 .github/workflows/reconcile.yml

diff --git a/.github/workflows/reconcile.yml b/.github/workflows/reconcile.yml
new file mode 100644
index 0000000..ce4bb7a
--- /dev/null
+++ b/.github/workflows/reconcile.yml
@@ -0,0 +1,63 @@
+name: Reconcile derived versions
+
+# Close the 4.1b gap: editing omni/versions.yaml to a version that needs no new
+# build (a re-pin, rollback, or canary tweak) leaves the derived files stale,
+# because the talos-images build — which is what normally rewrites them — does
+# not run when nothing needs to be built.
+#
+# This workflow makes the snowed adjustment automatic. On a push to main that
+# touches omni/versions.yaml it runs the same drift checker in --write mode,
+# which rewrites oci-lab's machine classes and cluster template to match the
+# new pin. Hand-offs:
+#   * Already-built installer  -> --write succeeds, derived files committed here.
+#   * Not-yet-built installer  -> --write's installer_built() guard refuses with
+#     a clear message and the job fails. The operator then runs the talos-images
+#     build for that version (the only path that can ship a brand-new installer);
+#     that build rewrites the derived files and opens the upgrade PR as before.
+# This keeps build-then-pin for genuinely new versions (single writer, correct
+# ordering behind the build) while letting the gate reconcile re-pins.
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "omni/versions.yaml"
+
+permissions:
+  contents: write
+
+jobs:
+  reconcile:
+    name: Reconcile derived files from versions.yaml
+    runs-on: ubuntu-latest
+    concurrency:
+      group: reconcile-versions
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install PyYAML
+        run: pip install pyyaml --quiet
+
+      - name: Reconcile derived files
+        id: reconcile
+        run: |
+          python3 scripts/check-version-drift.py --write
+          status=$(git status --porcelain -- omni/machine-classes/ omni/cluster-templates/oci-lab.yaml)
+          if [ -z "${status}" ]; then
+            echo "No derived files needed updating."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Commit reconciled derived files
+        if: steps.reconcile.outputs.changed == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add omni/machine-classes/ omni/cluster-templates/oci-lab.yaml
+          git commit -m "chore: reconcile derived files with omni/versions.yaml"
+          git push origin main