instruction: Create a GitHub Actions workflow for CI/CD automation with automated testing
output: ## alerting-update-module.yml
  
  **Repository:** grafana/grafana
  **File Type:** Github Workflow
  **Purpose:** Production configuration from grafana project
  
  ```yaml
  name: Update Alerting Module
  
  on:
    workflow_dispatch:
  
  concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true
  
  jobs:
    update-grafana:
      runs-on: ubuntu-latest
      permissions:
        contents: write
        pull-requests: write
        id-token: write
  
      steps:
        - name: Checkout repository
          uses: actions/checkout@v4 # 4.2.2
          with:
            persist-credentials: false
        - name: Check if update branch exists
          run: |
            if git ls-remote --heads origin update-alerting-module | grep -q 'update-alerting-module'; then
              echo "Branch 'update-alerting-module' already exists. There might be an open PR with Grafana updates."
              echo "Please review and merge/close the existing PR before running this workflow again."
              exit 1
            fi
  
        - name: Setup Go
          uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # 5.5.0
          with:
            "go-version-file": "go.mod"
  
        - name: Extract current commit hash of alerting module
          id: current-commit
          run: |
            FROM_COMMIT=$(go list -m -json github.com/grafana/alerting | jq -r '.Version' | grep -oP '(?<=-)[a-f0-9]+$')
            echo "from_commit=$FROM_COMMIT" >> "$GITHUB_OUTPUT"
  
        - name: Get current branch name
          id: current-branch-name
          run: echo "name=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> "$GITHUB_OUTPUT"
  
        - name: Get latest commit
          id: latest-commit
          env:
            GH_TOKEN: ${{ github.token }}
            BRANCH: ${{ steps.current-branch-name.outputs.name }}
          run: |
            TO_COMMIT="$(gh api repos/grafana/alerting/commits/"$BRANCH" --jq '.sha')"
             if [ -z "$TO_COMMIT" ]; then
              echo "Branch $BRANCH not found in alerting repo"
              exit 1
            fi
            echo "to_commit=$TO_COMMIT" >> "$GITHUB_OUTPUT"
  
        - name: Compare commit hashes
          run: |
            FROM_COMMIT="${{ steps.current-commit.outputs.from_commit }}"
            TO_COMMIT="${{ steps.latest-commit.outputs.to_commit }}"
            
            # Compare just the length of the shorter hash
            SHORT_TO_COMMIT="${TO_COMMIT:0:${#FROM_COMMIT}}"
            
            if [ "$FROM_COMMIT" = "$SHORT_TO_COMMIT" ]; then
              echo "Current version ($FROM_COMMIT) is already at latest ($SHORT_TO_COMMIT). No update needed."
              exit 0
            fi
            echo "Updates available: $FROM_COMMIT -> $TO_COMMIT"
  
        - name: Check for commit history
          id: check-commits
          env:
            GH_TOKEN: ${{ github.token }}
            FROM_COMMIT: ${{ steps.current-commit.outputs.from_commit }}
            TO_COMMIT: ${{ steps.latest-commit.outputs.to_commit }}
          run: |
            # get all commits that contains 'Alerting:' in the message
            ALERTING_COMMITS="$(gh api repos/grafana/alerting/compare/"$FROM_COMMIT"..."$TO_COMMIT" \
              --jq '.commits[].commit.message | split("\n")[0]')" || true
  
            # Use printf instead of echo -e for better multiline handling
            printf "%s\n" "$ALERTING_COMMITS"
  
            # make the list for markdown and replace PR numbers with links
            ALERTING_COMMITS_FORMATTED="$(echo "$ALERTING_COMMITS" | while read -r line; do echo "- $line" | sed -E 's/\(#([0-9]+)\)/[#\1](https:\/\/github.com\/grafana\/alerting\/pull\/\1)/g'; done)"
  
            {
              echo "alerting_commits<<EOF"
              echo "$ALERTING_COMMITS_FORMATTED"
              echo "EOF"
            } >> "$GITHUB_OUTPUT"
  
        - name: Update alerting module
          env:
            GOSUMDB: off
            PINNED_COMMIT: ${{ steps.latest-commit.outputs.to_commit }}
          run: |
            go get github.com/grafana/alerting@"$PINNED_COMMIT"
            make update-workspace
  
        - id: get-secrets
          uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
          with:
            repo_secrets: |
              GITHUB_APP_ID=alerting-team:app-id
              GITHUB_APP_PRIVATE_KEY=alerting-team:private-key
  
        - name: "Generate token"
          id: generate_token
          uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # 1.11.5
          with:
            app-id: ${{ env.GITHUB_APP_ID }}
            private-key: ${{ env.GITHUB_APP_PRIVATE_KEY }}
  
        - name: Create Pull Request
          uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # 7.0.6
          id: create-pr
          with:
            token: '${{ steps.generate_token.outputs.token }}'
            title:  'Alerting: Update alerting module to ${{ steps.latest-commit.outputs.to_commit }}'
            branch: alerting/update-alerting-module
            delete-branch: true
            labels: |
              no-changelog
              no-backport
            body: |
              Updates Grafana Alerting module to latest version.
  
              Compare changes: https://github.com/grafana/alerting/compare/${{ steps.current-commit.outputs.from_commit }}...${{ steps.latest-commit.outputs.to_commit }}
              <details>
              <summary>Commits</summary>
  
              ${{ steps.check-commits.outputs.alerting_commits }}
  
              </details>
  
              Created by: [GitHub Action Job](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
        - name: Add PR URL to Summary
          if: steps.create-pr.outputs.pull-request-url != ''
          env:
            PR_URL: ${{ steps.create-pr.outputs.pull-request-url }}
          run: |
            {
              echo "## Pull Request Created"
              echo "🔗 [View Pull Request]($PR_URL)"
            } >> "$GITHUB_STEP_SUMMARY"
        - name: Send Slack Message
          uses: grafana/shared-workflows/actions/send-slack-message@send-slack-message/v2.0.3
          with:
            method: 'chat.postMessage'
            # send to alerting-reviews channel
            payload-templated: true
            payload:  |
              {
                "channel": "C076RNRRZ2N",
                "text": "Update alerting module in Grafana ${{ steps.create-pr.outputs.pull-request-url }}"
              }
  ```
  
  This GitHub Actions workflow demonstrates production CI/CD practices including automated testing, building, and deployment.