Regenerate Dependabot Configuration #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Regenerate Dependabot Configuration | |
| "on": | |
| schedule: | |
| - cron: '0 9 * * 1' | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| regenerate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Regenerate dependabot.yml | |
| run: | | |
| echo "Regenerating .github/dependabot.yml..." | |
| ./hack/generate-dependabot.sh | |
| - name: Check for changes | |
| id: check-changes | |
| run: | | |
| if git diff --quiet .github/dependabot.config.yml .github/dependabot.yml; then | |
| echo "changed=false" >> $GITHUB_OUTPUT | |
| echo "No changes detected in dependabot.yml" | |
| else | |
| echo "changed=true" >> $GITHUB_OUTPUT | |
| echo "Changes detected in dependabot.yml" | |
| fi | |
| - name: Create Pull Request | |
| if: steps.check-changes.outputs.changed == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.CHATOPS_TOKEN }} | |
| WORKFLOW_NAME: ${{ github.workflow }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| SERVER_URL: ${{ github.server_url }} | |
| REPOSITORY: ${{ github.repository }} | |
| RUN_ID: ${{ github.run_id }} | |
| run: | | |
| git config user.name "Jawed Khelil" | |
| git config user.email "jkhelil@redhat.com" | |
| # Create a new branch | |
| BRANCH="dependabot-regen-$(date +%Y%m%d-%H%M%S)" | |
| git checkout -b "$BRANCH" | |
| # Commit changes | |
| git add .github/dependabot.config.yml .github/dependabot.yml | |
| git commit -s -m "Regenerate dependabot.yml from config | |
| This automated PR regenerates .github/dependabot.yml from | |
| .github/dependabot.config.yml to ensure the configuration | |
| is up-to-date with the latest release branches. | |
| Generated by: ${WORKFLOW_NAME} | |
| Triggered by: ${EVENT_NAME}" | |
| # Push branch (configure credentials only for this step) | |
| git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPOSITORY}.git" | |
| git push origin "$BRANCH" | |
| # Create PR | |
| gh pr create \ | |
| --title "Regenerate dependabot.yml configuration" \ | |
| --body "## Automated Dependabot Configuration Update | |
| This PR regenerates \`.github/dependabot.yml\` from \`.github/dependabot.config.yml\`. | |
| ### Changes | |
| The dependabot configuration has been regenerated to ensure it's in sync with: | |
| - Release branches listed in \`.github/dependabot.config.yml\` | |
| - Ecosystem configurations | |
| ### Review Checklist | |
| - [ ] Verify that all active LTS release branches are included | |
| - [ ] Check that main branch configurations look correct | |
| - [ ] Ensure patch-only restrictions are applied to release branches | |
| --- | |
| 🤖 This PR was automatically created by the \`${WORKFLOW_NAME}\` workflow. | |
| **Triggered by**: ${EVENT_NAME} | |
| **Run**: ${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID}" \ | |
| --base main \ | |
| --head "$BRANCH" \ | |
| --label "dependencies" \ | |
| --label "kind/misc" \ | |
| --label "release-note-none" | |
| - name: Summary | |
| env: | |
| CHANGED: ${{ steps.check-changes.outputs.changed }} | |
| run: | | |
| if [ "${CHANGED}" = "true" ]; then | |
| echo "✅ Pull request created with updated dependabot.yml" | |
| else | |
| echo "✅ No changes needed - dependabot.yml is up-to-date" | |
| fi |