dependabot-sync.yml

---
# Dependabot Smart Sync
# Purpose: Automatically regenerates .github/dependabot.yml based on detected ecosystems.
# Trigger: Push to dev/main (manifest file changes), monthly schedule, or manual dispatch.
# Design:
#   - Uses .unirtm.toml to scan for manifest files via git ls-files.
#   - Only commits if the generated config differs from the current one.
#   - Uses native git commands — no third-party commit Actions.

name: "🤖 Dependabot Smart Sync"

"on":
  push:
    branches: ["dev"]
    paths:
      # Trigger when manifest files or the generator script change
      - "package.json"
      - "**/package.json"
      - "go.mod"
      - "**/go.mod"
      - "Cargo.toml"
      - "**/Cargo.toml"
      - "requirements.txt"
      - "**/requirements.txt"
      - "Dockerfile"
      - "**/Dockerfile"
      - "composer.json"
      - "**/composer.json"
      - "Gemfile"
      - "**/Gemfile"
      - "mix.exs"
      - "pubspec.yaml"
      - "Package.swift"
      - "**/*.tf"
      - "**/devcontainer.json"
      - ".pre-commit-config.yaml"
      - "Chart.yaml"
      - ".unirtm.toml"
      # UniRTM toolchain configuration
      - ".unirtm.toml"
      - ".github/workflows/dependabot-sync.yml"
  schedule:
    # Weekly safety net: every Monday at 06:00 UTC
    - cron: "0 6 * * 1"
  workflow_dispatch:

permissions: {}

env:
  UNIRTM_LOCKED: 1
  # Opt into Node.js 24 now ahead of GitHub's June 16, 2026 forced migration.
  # See: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "1"

jobs:
  sync:
    name: "🔄 Sync Dependabot Config"
    runs-on: ubuntu-latest
    permissions:
      contents: write
    environment: maintenance
    timeout-minutes: 30
    steps:
      - name: "🔒 Harden Runner"
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            *.aquasecurity.github.io:443
            *.azurecr.io:443
            *.centos.org:443
            *.debian.org:443
            *.debian.org:80
            *.dkr.ecr.*.amazonaws.com:443
            *.gcr.io:443
            *.githubusercontent.com:443
            *.pkg.dev:443
            *.quay.io:443
            *.redhat.com:443
            *.rockylinux.org:443
            *.sigstore.dev:443
            *.ubuntu.com:443
            *.ubuntu.com:80
            api.github.com:443
            api.osv.dev:443
            api.securityscorecards.dev:443
            auth.docker.io:443
            cdn.deno.land:443
            deno.land:443
            dl-cdn.alpinelinux.org:443
            downloads.gradle-dn.com:443
            downloads.gradle.org:443
            files.pythonhosted.org:443
            formulae.brew.sh:443
            get.trivy.dev:443
            ghcr.io:443
            github.com:443
            index.crates.io:443
            index.docker.io:443
            nodejs.org:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            osv-vulnerabilities.storage.googleapis.com:443
            packages.microsoft.com:443
            packagist.org:443
            pkg-containers.githubusercontent.com:443
            production.cloudflare.docker.com:443
            proxy.golang.org:443
            public.ecr.aws:443
            pypi.org:443
            registry-1.docker.io:443
            registry.npmjs.org:443
            registry.terraform.io:443
            registry.yarnpkg.com:443
            repo.maven.apache.org:443
            repo.yarnpkg.com:443
            rubygems.org:443
            services.gradle.org:443
            static.rust-lang.org:443
            sum.golang.org:443
            www.bestpractices.dev:443
            storage.googleapis.com:443
            go.dev:443
            golang.org:443
            *.actions.githubusercontent.com:443
            *.blob.core.windows.net:443
      - name: "📂 Checkout Repository Code"
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: true
          ref: ${{ github.ref }}

      - name: "⚡ Setup UniRTM"
        uses: snowdreamtech/setup-unirtm@cacfb4d739ee46d4a4b2528b02b508df2f560706 # v0.4.0
        with:
          unirtm-version: "0.4.0"
          install: true
          trust: true
        env:
          GITHUB_TOKEN: ${{ secrets.WORKFLOW_SECRET || secrets.GITHUB_TOKEN }}

      - name: "🤖 Generate Dependabot Config"
        shell: sh
        run: |
          unirtm generate dependabot --output .github/dependabot.yml
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          UNIRTM_YES: 1

      - name: "🔧 Update UniRTM Toolchain & Lockfile"
        shell: sh
        run: |
          unirtm lock --all-platforms
        env:
          GITHUB_TOKEN: ${{ secrets.WORKFLOW_SECRET || secrets.GITHUB_TOKEN }}
          UNIRTM_YES: 1

      - name: "📝 Commit Changes (if any)"
        shell: sh
        env:
          GITHUB_TOKEN: ${{ secrets.WORKFLOW_SECRET || secrets.GITHUB_TOKEN }}
          GITHUB_REF: ${{ github.ref }}
        run: |
          if git diff --quiet .github/dependabot.yml unirtm.lock .unirtm.toml 2>/dev/null; then
            echo "✅ No changes detected. Dependabot config and UniRTM toolchain are up-to-date."
          else
            git config user.name "github-actions[bot]"
            git config user.email "github-actions[bot]@users.noreply.github.com"
            git add .github/dependabot.yml unirtm.lock .unirtm.toml
            git commit --signoff -m "chore(deps): sync dependabot config and unirtm toolchain [skip ci]"
            git push origin HEAD:"$GITHUB_REF"
            echo "✅ Dependabot config and UniRTM toolchain updated and pushed."
          fi