digest-bot.yaml

# Copyright 2022 Chainguard, Inc.
# SPDX-License-Identifier: Apache-2.0

name: Image digest update

on:
  workflow_dispatch:
  schedule:
    # distroles ran on 0 0 * * * lets run this one hour after
    - cron: "0 1 * * *"

jobs:
  image-update:
    name: Image digest update
    runs-on: ubuntu-latest
    if: ${{ github.repository_owner }} == 'chainguard-dev'

    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0

      - uses: chainguard-dev/octo-sts-action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
        id: octo-sts
        with:
          scope: ${{ github.repository }}
          identity: digestabot

      - uses: chainguard-dev/digestabot@02ea60d2aeb26664ace4a9cc2ecdbea96888aaa4 # v1.2.0
        id: digest-bot
        with:
          token: ${{ steps.octo-sts.outputs.token }}

      - run: echo "PR number ${{ steps.digest-bot.outputs.pull_request_number }}"

      - name: Enable auto-merge
        if: ${{ steps.digest-bot.outputs.pull_request_number != '' }}
        run: gh pr merge --auto --squash "https://github.com/${{ github.repository }}/pull/${{ steps.digest-bot.outputs.pull_request_number }}"
        env:
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}