ci: open an issue when a workflow fails on main

Also moves the actions off Node 20.

.github/workflows/build.yml

@@ -52,7 +52,7 @@ jobs:
 
     steps:
       - name: Check out Modrinth Enhanced
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       # Everything below works on the patched tree in build/upstream, so this
       # has to come first: a patch that no longer applies fails the build here,
@@ -70,7 +70,7 @@ jobs:
           echo "upstream=$UPSTREAM_REF" >> "$GITHUB_OUTPUT"
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version-file: build/upstream/.nvmrc
 
@@ -79,7 +79,7 @@ jobs:
         run: corepack enable
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: 17
@@ -125,7 +125,7 @@ jobs:
         run: scripts/check.sh
 
       - name: Upload installers
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: modrinth-enhanced-${{ matrix.name }}
           path: build/artifacts/*

.github/workflows/notify.yml

@@ -0,0 +1,110 @@
+name: Notify
+
+# Opens an issue when a workflow fails on main, so it reaches GitHub's
+# notifications, the mobile app and email, and comments on it for every further
+# failure. Closes it again once that workflow passes.
+
+on:
+  workflow_run:
+    workflows: [Build, Upstream release]
+    types: [completed]
+
+permissions:
+  actions: read
+  issues: write
+
+concurrency:
+  group: notify-${{ github.event.workflow_run.name }}
+  cancel-in-progress: false
+
+jobs:
+  notify:
+    name: Notify
+    runs-on: ubuntu-latest
+    # A pull request shows its own checks.
+    if: >-
+      github.event.workflow_run.event != 'pull_request' &&
+      github.event.workflow_run.head_branch == github.event.repository.default_branch
+    steps:
+      - name: Open, update or close the failure issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          OWNER: ${{ github.repository_owner }}
+          WORKFLOW: ${{ github.event.workflow_run.name }}
+          CONCLUSION: ${{ github.event.workflow_run.conclusion }}
+          EVENT: ${{ github.event.workflow_run.event }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+          RUN_URL: ${{ github.event.workflow_run.html_url }}
+          SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          set -euo pipefail
+          title="$WORKFLOW is failing"
+          label=ci-failure
+          issue="$(
+            gh issue list --state open --label "$label" --json number,title |
+              jq -r --arg title "$title" '.[] | select(.title == $title) | .number' |
+              head -1
+          )"
+
+          case "$CONCLUSION" in
+          success)
+            if [ -n "$issue" ]; then
+              gh issue close "$issue" --comment "Passing again: $RUN_URL"
+            fi
+            exit 0
+            ;;
+          failure | timed_out | startup_failure) ;;
+          *) exit 0 ;;
+          esac
+
+          failed="$(
+            gh api "repos/$GH_REPO/actions/runs/$RUN_ID/jobs?per_page=100" --jq '
+              .jobs[] | select(.conclusion == "failure" or .conclusion == "timed_out")'
+          )"
+          jobs="$(
+            jq -r '"- [\(.name)](\(.html_url))" +
+              ([.steps[]? | select(.conclusion == "failure") | .name] |
+                if length > 0 then ": " + join(", ") else "" end)' <<<"$failed"
+          )"
+
+          # The lines leading up to the first error of the first failed job,
+          # enough to see what broke without opening the log.
+          excerpt=""
+          job_id="$(jq -r '.id' <<<"$failed" | head -1)"
+          if [ -n "$job_id" ]; then
+            excerpt="$(
+              curl -fsSL -H "Authorization: Bearer $GH_TOKEN" \
+                "$GITHUB_API_URL/repos/$GH_REPO/actions/jobs/$job_id/logs" |
+                sed -E 's/^[0-9TZ:.-]+ //; s/\x1b\[[0-9;]*m//g' |
+                awk '{ print } /^##\[error\]/ { exit }' |
+                tail -40 || true
+            )"
+          fi
+
+          body="$(cat <<EOF
+          [$WORKFLOW]($RUN_URL) failed ($CONCLUSION) on \`${SHA:0:7}\`, started by \`$EVENT\`.
+
+          ${jobs:-No failed job was reported.}
+          EOF
+          )"
+          if [ -n "$excerpt" ]; then
+            body="$body
+
+          <details>
+          <summary>Log</summary>
+
+          \`\`\`
+          $excerpt
+          \`\`\`
+
+          </details>"
+          fi
+
+          if [ -n "$issue" ]; then
+            gh issue comment "$issue" --body "$body"
+          else
+            gh label create "$label" --color d73a4a \
+              --description "A workflow is failing on main" --force
+            gh issue create --title "$title" --label "$label" --body "@$OWNER $body"
+          fi

.github/workflows/upstream-release.yml

@@ -36,7 +36,7 @@ jobs:
       revision: ${{ steps.check.outputs.revision }}
       proceed: ${{ steps.check.outputs.proceed }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Decide what to release
         id: check
@@ -101,7 +101,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # The whole history: the release notes are the commits since the last one.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -121,7 +121,7 @@ jobs:
           git push origin HEAD:${{ github.event.repository.default_branch }}
 
       - name: Download installers
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
           merge-multiple: true