constellation/.github/workflows/update-rpms.yml
renovate[bot] dcf1b88a29
deps: update actions/checkout action to v4 (#2752)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-12-20 16:10:35 +01:00

58 lines
2.0 KiB
YAML

name: Update locked rpms
on:
workflow_dispatch:
schedule:
- cron: "0 8 * * 0" # every sunday at 8am
jobs:
update-rpms:
runs-on: "ubuntu-22.04"
permissions:
id-token: write
contents: read
steps:
- name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Assume AWS role to upload Bazel dependencies to S3
uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
with:
role-to-assume: arn:aws:iam::795746500882:role/GithubConstellationMirrorWrite
aws-region: eu-central-1
- name: Setup bazel
uses: ./.github/actions/setup_bazel_nix
with:
useCache: "true"
buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }}
- name: Update rpms
run: bazel run //image/mirror:update_packages
- name: Check if there are any changes
id: git-check
run: |
if git diff --quiet; then
echo "commitChanges=false" | tee -a "${GITHUB_OUTPUT}"
else
echo "commitChanges=true" | tee -a "${GITHUB_OUTPUT}"
fi
- name: Create pull request
uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
with:
branch: "image/automated/update-rpms-${{ github.run_number }}"
base: main
title: "image: update locked rpms"
body: |
:robot: *This is an automated PR.* :robot:
The PR is triggered as part of the scheduled rpm update workflow.
It updates the locked rpm packages that form the Constellation OS images.
commit-message: "image: update locked rpms"
committer: edgelessci <edgelessci@users.noreply.github.com>
labels: dependencies
# We need to push changes using a token, otherwise triggers like on:push and on:pull_request won't work.
token: ${{ !github.event.pull_request.head.repo.fork && secrets.CI_COMMIT_PUSH_PR || '' }}