[build] add reusable commit-changes.yml workflow

.github/workflows/ci-lint.yml

@@ -53,43 +53,23 @@ jobs:
       run: ./scripts/github-actions/check-format.sh
       artifact-name: format-changes
 
-  commit-fixes:
-    name: Commit fixes
+  fork-format-error:
+    name: Fork format instructions
     needs: format
-    if: failure() && github.event_name == 'pull_request'
+    if: failure() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      actions: read
     steps:
-      - name: Check Permissions
-        if: github.event.pull_request.head.repo.fork == true
+      - name: Format instructions
         run: |
           echo "::error::Code needs formatting. Run ./scripts/format.sh locally and push changes."
           exit 1
-      - name: Checkout PR
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-      - name: Download format changes
-        uses: actions/download-artifact@v4
-        with:
-          name: format-changes
-      - name: Apply and commit fixes
-        id: apply
-        run: |
-          if [ -s changes.patch ]; then
-            git apply --index changes.patch
-            rm changes.patch
-            git config --local user.name "Selenium CI Bot"
-            git config --local user.email "selenium-ci@users.noreply.github.com"
-            git commit -m "Auto-format code"
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::notice::No formatting changes needed."
-          fi
-      - name: Push fixes
-        if: steps.apply.outputs.has_changes == 'true'
-        run: |
-          git push
-          echo "::notice::Auto-formatted and pushed. New CI run will start."
+
+  commit-fixes:
+    name: Commit fixes
+    needs: format
+    if: failure() && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
+    uses: ./.github/workflows/commit-changes.yml
+    with:
+      artifact-name: format-changes
+      commit-message: "Auto-format code"
+      ref: ${{ github.event.pull_request.head.ref }}

.github/workflows/ci-renovate-rbe.yml

@@ -42,28 +42,10 @@ jobs:
     name: Commit Repins
     needs: pin
     if: github.event.repository.fork == false
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Download repin patch
-        uses: actions/download-artifact@v4
-        with:
-          name: repin-changes
-        continue-on-error: true
-      - name: Apply patch and commit
-        run: |
-          if [ -f changes.patch ] && [ -s changes.patch ]; then
-            git apply --index changes.patch
-            git config --local user.email "selenium-ci@users.noreply.github.com"
-            git config --local user.name "Selenium CI Bot"
-            git commit -m 'Repin dependencies'
-            git push
-          else
-            echo "No changes to commit"
-          fi
+    uses: ./.github/workflows/commit-changes.yml
+    with:
+      artifact-name: repin-changes
+      commit-message: "Repin dependencies"
 
   check-format:
     needs: commit-repins

.github/workflows/commit-changes.yml

@@ -0,0 +1,88 @@
+name: Commit Changes
+
+on:
+  workflow_call:
+    inputs:
+      artifact-name:
+        description: Name of artifact containing changes.patch
+        required: true
+        type: string
+      commit-message:
+        description: Commit message
+        required: true
+        type: string
+      ref:
+        description: Git ref to checkout
+        required: false
+        type: string
+        default: ''
+      push-branch:
+        description: Branch to push to (defaults to current branch, uses force push)
+        required: false
+        type: string
+        default: ''
+    outputs:
+      changes-committed:
+        description: Whether changes were committed and pushed
+        value: ${{ jobs.commit.outputs.committed }}
+    secrets:
+      SELENIUM_CI_TOKEN:
+        required: false
+
+jobs:
+  commit:
+    name: Commit Changes
+    runs-on: ubuntu-latest
+    outputs:
+      committed: ${{ steps.commit.outputs.committed }}
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          token: ${{ secrets.SELENIUM_CI_TOKEN || github.token }}
+      - name: Download patch
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ inputs.artifact-name }}
+        continue-on-error: true
+      - name: Apply and commit
+        id: commit
+        run: |
+          if [ -f changes.patch ] && [ -s changes.patch ]; then
+            if ! git apply --index changes.patch; then
+              echo "::error::Failed to apply patch"
+              echo "committed=false" >> "$GITHUB_OUTPUT"
+              exit 1
+            fi
+            git config --local user.email "selenium-ci@users.noreply.github.com"
+            git config --local user.name "Selenium CI Bot"
+            if ! git commit -m "$COMMIT_MESSAGE"; then
+              echo "::error::Failed to commit changes"
+              echo "committed=false" >> "$GITHUB_OUTPUT"
+              exit 1
+            fi
+            if [ -n "$PUSH_BRANCH" ]; then
+              if ! git push origin HEAD:"$PUSH_BRANCH" --force; then
+                echo "::error::Failed to push to $PUSH_BRANCH"
+                echo "committed=false" >> "$GITHUB_OUTPUT"
+                exit 1
+              fi
+            else
+              if ! git push; then
+                echo "::error::Failed to push"
+                echo "committed=false" >> "$GITHUB_OUTPUT"
+                exit 1
+              fi
+            fi
+            echo "::notice::Changes committed and pushed"
+            echo "committed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::No changes to commit"
+            echo "committed=false" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          COMMIT_MESSAGE: ${{ inputs.commit-message }}
+          PUSH_BRANCH: ${{ inputs.push-branch }}

.github/workflows/pin-browsers.yml

@@ -16,38 +16,37 @@ jobs:
       run: bazel run //scripts:pinned_browsers
       artifact-name: pinned-browsers
 
-  pull-request:
+  push-changes:
+    name: Push Changes
+    needs: update
     if: github.event.repository.fork == false
+    uses: ./.github/workflows/commit-changes.yml
+    with:
+      artifact-name: pinned-browsers
+      commit-message: "Update pinned browser versions"
+      push-branch: pinned-browser-updates
+    secrets:
+      SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
+
+  create-pr:
+    name: Create Pull Request
+    needs: push-changes
+    if: github.event.repository.fork == false && needs.push-changes.outputs.changes-committed == 'true'
     runs-on: ubuntu-latest
-    needs: update
     steps:
-      - name: Checkout repository
+      - name: Checkout
         uses: actions/checkout@v4
-      - name: Download patch
-        uses: actions/download-artifact@v4
-        with:
-          name: pinned-browsers
-      - name: Apply Patch
-        run: |
-          git apply changes.patch
-          rm changes.patch
-      - name: Check Changes
+      - name: Create Pull Request
+        env:
+          GH_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
         run: |
-          if [[ -n $(git status --porcelain common/repositories.bzl) ]]; then
-            echo "CHANGES_FOUND=true" >> "$GITHUB_ENV"
+          existing=$(gh pr list --head pinned-browser-updates --json number --jq '.[0].number // empty')
+          if [ -n "$existing" ]; then
+            echo "::notice::PR #$existing already exists"
+          else
+            gh pr create \
+              --head pinned-browser-updates \
+              --base trunk \
+              --title "[dotnet][rb][java][js][py] Automated Browser Version Update" \
+              --body $'This is an automated pull request to update pinned browsers and drivers\n\nMerge after verify the new browser versions properly passing the tests and no bugs need to be filed'
           fi
-      - name: Create Pull Request
-        if: env.CHANGES_FOUND == 'true'
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.SELENIUM_CI_TOKEN }}
-          add-paths: common/repositories.bzl
-          commit-message: "Update pinned browser versions"
-          committer: Selenium CI Bot <selenium-ci@users.noreply.github.com>
-          author: Selenium CI Bot <selenium-ci@users.noreply.github.com>
-          title: "[dotnet][rb][java][js][py] Automated Browser Version Update"
-          body: |
-            This is an automated pull request to update pinned browsers and drivers
-
-            Merge after verify the new browser versions properly passing the tests and no bugs need to be filed
-          branch: "pinned-browser-updates"

.github/workflows/pre-release.yml

@@ -30,7 +30,7 @@ jobs:
     secrets:
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
 
-  # Rust jobs run in parallel with approval since work is not on trunk
+  # Run rust jobs in parallel with approval since work is not on trunk
   generate-rust-version:
     name: Generate Rust Version
     if: github.event.repository.fork == false
@@ -43,29 +43,13 @@ jobs:
   push-rust-version:
     name: Push Rust Version
     needs: generate-rust-version
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.SELENIUM_CI_TOKEN }}
-          fetch-depth: 0
-      - name: Download rust version patch
-        uses: actions/download-artifact@v4
-        with:
-          name: rust-version
-      - name: Apply and push
-        run: |
-          if [ -f changes.patch ] && [ -s changes.patch ]; then
-            git apply --index changes.patch
-            git config --local user.email "selenium-ci@users.noreply.github.com"
-            git config --local user.name "Selenium CI Bot"
-            git commit -m "update selenium manager version and rust changelog"
-            git push origin HEAD:rust-release-${{ inputs.version }} --force
-          else
-            echo "::error::No changes to apply for rust version update"
-            exit 1
-          fi
+    uses: ./.github/workflows/commit-changes.yml
+    with:
+      artifact-name: rust-version
+      commit-message: "update selenium manager version and rust changelog"
+      push-branch: rust-release-${{ inputs.version }}
+    secrets:
+      SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
 
   selenium-manager:
     name: Release Selenium Manager

.github/workflows/release.yml

@@ -151,29 +151,12 @@ jobs:
   update-version:
     name: Push Nightly Versions
     needs: [prepare, reset-version, unrestrict-trunk]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.SELENIUM_CI_TOKEN }}
-      - name: Download version reset patch
-        uses: actions/download-artifact@v4
-        with:
-          name: version-reset
-      - name: Apply and push
-        run: |
-          if [ -f changes.patch ] && [ -s changes.patch ]; then
-            git apply --index changes.patch
-            git config --local user.email "selenium-ci@users.noreply.github.com"
-            git config --local user.name "Selenium CI Bot"
-            git commit -m "[build] Reset versions to nightly after ${{ needs.prepare.outputs.tag }} release"
-            git push
-          else
-            echo "::notice::No version changes to apply"
-          fi
+    uses: ./.github/workflows/commit-changes.yml
+    with:
+      artifact-name: version-reset
+      commit-message: "[build] Reset versions to nightly after ${{ needs.prepare.outputs.tag }} release"
+    secrets:
+      SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
 
   nightly:
     name: Publish Nightly Packages