name: Update locked rpms

on:
  workflow_dispatch:
  schedule:
    - cron: "0 8 * * 0" # every sunday at 8am

jobs:
  update-rpms:
    runs-on: "ubuntu-22.04"
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Assume AWS role to upload Bazel dependencies to S3
        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
        with:
          role-to-assume: arn:aws:iam::795746500882:role/GithubConstellationMirrorWrite
          aws-region: eu-central-1

      - name: Setup bazel
        uses: ./.github/actions/setup_bazel_nix
        with:
          useCache: "true"
          buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }}

      - name: Update rpms
        run: bazel run //image/mirror:update_packages

      - name: Check if there are any changes
        id: git-check
        run: |
          if git diff --quiet; then
            echo "commitChanges=false" | tee -a "${GITHUB_OUTPUT}"
          else
            echo "commitChanges=true" | tee -a "${GITHUB_OUTPUT}"
          fi

      - name: Create pull request
        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
        with:
          branch: "image/automated/update-rpms-${{ github.run_number }}"
          base: main
          title: "image: update locked rpms"
          body: |
            :robot: *This is an automated PR.* :robot:

            The PR is triggered as part of the scheduled rpm update workflow.
            It updates the locked rpm packages that form the Constellation OS images.
          commit-message: "image: update locked rpms"
          committer: edgelessci <edgelessci@users.noreply.github.com>
          labels: dependencies
          # We need to push changes using a token, otherwise triggers like on:push and on:pull_request won't work.
          token: ${{ !github.event.pull_request.head.repo.fork && secrets.CI_COMMIT_PUSH_PR || '' }}