check-upstream-upgrade.yml

name: Check upstream upgrade
on:
  workflow_dispatch: {} #so we can run this manually if necessary.
  schedule:
    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
    - cron: 0 3 * * *

jobs:
  check_upgrade_provider:
    name: Check for upstream provider upgrades
    runs-on: ubuntu-latest
    steps:
      - name: Get token
        id: get_token
        uses: tibdex/github-app-token@v2
        with:
          private_key: ${{ secrets.RELEASE_APP_PEM }}
          app_id: ${{ secrets.RELEASE_APP_ID }}

      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          token: ${{ steps.get_token.outputs.token }}
      - name: Setup tools
        uses: ./.github/actions/setup-tools
        with:
          tools: go
      - name: Install upgrade-provider
        run: go install github.com/pulumi/upgrade-provider@main
        shell: bash
      - name: Run upgrade-provider upstream check
        id: upstream_version
        run: |
          upgrade-provider "$REPO" --kind=check-upstream-version
        env:
          REPO: ${{ github.repository }}
          GH_TOKEN: ${{ steps.get_token.outputs.token }}
        shell: bash