🤖 Update software in images #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🤖 Update software in images | |
| on: | |
| workflow_dispatch: # allow manual runs | |
| schedule: | |
| - cron: "43 6 * * 6" # build every Saturday at 6:43 AM UTC | |
| jobs: | |
| update: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # to create a new branch with updates | |
| id-token: write # to get a new token for opening a PR | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Update container dependencies | |
| run: python3 .github/scripts/update-containers.py | |
| - name: Check for changes | |
| id: changes | |
| run: | | |
| if git diff --quiet; then | |
| echo "has_changes=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_changes=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Set date | |
| run: | | |
| echo "DATE=$(date -u +"%Y-%m-%d")" >> "$GITHUB_ENV" | |
| - name: Commit and push branch | |
| if: steps.changes.outputs.has_changes == 'true' | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git checkout -b automation/update-image-deps-${{ env.DATE }} | |
| git add images/ | |
| git commit -m "chore: bump image dependencies" | |
| git push --force-with-lease origin automation/update-image-deps-${{ env.DATE }} | |
| - name: Federate token from Octo STS | |
| uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1 | |
| id: octo-sts | |
| with: | |
| scope: some-natalie/kubernoodles | |
| identity: update-image-deps | |
| - name: Create pull request | |
| if: steps.changes.outputs.has_changes == 'true' | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0 | |
| with: | |
| github-token: ${{ steps.octo-sts.outputs.token }} | |
| script: | | |
| // Skip if a PR for this branch already exists | |
| const { data: existing } = await github.rest.pulls.list({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| head: `${context.repo.owner}:automation/update-image-deps-${{ env.DATE }}`, | |
| state: "open", | |
| }); | |
| if (existing.length > 0) { | |
| core.info(`PR already open: ${existing[0].html_url}`); | |
| return; | |
| } | |
| const { data: pr } = await github.rest.pulls.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: "Automatic image dependency bumps", | |
| body: "Automated dependency update generated by `update-containers.py`.", | |
| head: "automation/update-image-deps-${{ env.DATE }}", | |
| base: context.payload.repository.default_branch, | |
| }); | |
| await github.rest.pulls.requestReviewers({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: pr.number, | |
| reviewers: ["some-natalie"], | |
| }); | |
| await github.rest.issues.addLabels({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: pr.number, | |
| labels: ["dependencies"], | |
| }); | |
| core.info(`Created PR: ${pr.html_url}`); |