🤖 Update software in images #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🤖 Update software in images | |
| on: | |
| workflow_dispatch: # allow manual runs | |
| schedule: | |
| - cron: "43 6 * * 6" # build every Saturday at 6:43 AM UTC | |
| jobs: | |
| update: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Update container dependencies | |
| run: python3 .github/scripts/update-containers.py | |
| - name: Check for changes | |
| id: changes | |
| run: | | |
| if git diff --quiet; then | |
| echo "has_changes=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_changes=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Set date | |
| run: | | |
| echo "DATE=$(date -u +"%Y-%m-%d")" >> "$GITHUB_ENV" | |
| - name: Federate token from Octo STS | |
| uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1 | |
| id: octo-sts | |
| with: | |
| scope: some-natalie/kubernoodles | |
| identity: update-image-deps | |
| - name: Commit and push branch | |
| if: steps.changes.outputs.has_changes == 'true' | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git checkout -b automation/update-image-deps-${{ env.DATE }} | |
| git add images/ | |
| git commit -m "chore: bump image dependencies" | |
| git push --force-with-lease origin automation/update-image-deps-${{ env.DATE }} | |
| env: | |
| GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }} | |
| - name: Create pull request | |
| if: steps.changes.outputs.has_changes == 'true' | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #v8.0.0 | |
| env: | |
| GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }} | |
| with: | |
| script: | | |
| // Skip if a PR for this branch already exists | |
| const { data: existing } = await github.rest.pulls.list({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| head: `${context.repo.owner}:automation/update-image-deps-${{ env.DATE }}`, | |
| state: "open", | |
| }); | |
| if (existing.length > 0) { | |
| core.info(`PR already open: ${existing[0].html_url}`); | |
| return; | |
| } | |
| const { data: pr } = await github.rest.pulls.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: "Automatic image dependency bumps", | |
| body: "Automated dependency update generated by `update-containers.py`.", | |
| head: "automation/update-image-deps-${{ env.DATE }}", | |
| base: context.payload.repository.default_branch, | |
| }); | |
| await github.rest.pulls.requestReviewers({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: pr.number, | |
| reviewers: ["some-natalie"], | |
| }); | |
| await github.rest.issues.addLabels({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: pr.number, | |
| labels: ["dependencies"], | |
| }); | |
| core.info(`Created PR: ${pr.html_url}`); |