dagger-update.yaml

---
name: dagger-update
on:
  # using on: pull_request causes a loop
  # run on pushes to renovate branches
  # with path filter
  push:
    paths:
      - "**/dagger.json"
    branches:
      - renovate/*
  workflow_dispatch:
    inputs:
      #checkov:skip=CKV_GHA_7:desired to affect output to affect the build in this case
      go-updates:
        type: boolean
        default: false
        description: enable golang updates
permissions:
  contents: read # required for actions/checkout
jobs:
  dagger-update:
    name: Update Dagger Modules
    runs-on: ubuntu-latest
    permissions:
      contents: write # allow workflow to write to PR
    steps:
      - name: checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          # should be used for PRs only
          # https://github.com/marketplace/actions/add-commit#working-with-prs
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.ref }}
      # yamllint disable-line rule:line-length
      - name: Generate GitHub token
        # https://github.com/actions/create-github-app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: generate-token
        if: "! github.event.pull_request.head.repo.fork"
        with:
          client-id: ${{ vars.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-contents: write # create releases
          permission-pull-requests: write # create release pull requests
      - name: install mise
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
        with:
          install: true
          cache: true
          experimental: true
          github_token: ${{ steps.generate-token.outputs.token }}
      - name: dagger develop
        run: |
          just goUpdates="${{ inputs.go-updates }}" develop
      - name: push changes with ghcp
        if: "! github.event.pull_request.head.repo.fork"
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          set -eu

          if ! ghcp -v; then
            echo "::error ::int128/ghcp not found - needed to push."
            exit 1
          fi

          if [ -z "$(git status --porcelain)" ]; then
            echo "::notice ::No lockfile changes needed"
            exit 0
          fi

          branch=${GITHUB_HEAD_REF:-} # https://github.com/int128/ghcp
          if [ -z "${branch}" ]; then
            branch="${GITHUB_REF_NAME}"
          fi

          GO_UPDATES_STR=""
          if [ "${{ inputs.go-updates }}" = "true" ]; then
            GO_UPDATES_STR=" + related golang updates"
          fi

          # shellcheck disable=SC2046
          # ^- we want it to split!
          ghcp commit -r "$GITHUB_REPOSITORY" -b "${branch}" \
            -m "chore(dagger): develop${GO_UPDATES_STR}" \
            $(git --no-pager diff --name-only)
          echo "::notice ::changes pushed to branch, 'exit 1' to force checks"
          exit 1