print-rollouts.yml

---
name: Print rollouts
on:
  pull_request:
    branches: [main]
    paths: ["updates/*.json"]
permissions:
  contents: read

# Unprivileged first part; the second is in post-rollouts.yml.  Architecture
# and code from
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

jobs:
  print-rollouts:
    name: Print rollouts
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v3
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install python3-dateutil
      - name: Print rollouts
        run: |
          set -euo pipefail
          make print-rollouts | tee rollouts
      - name: Save state for PR comment
        run: |
          set -euo pipefail
          mkdir validation-results
          echo "${{ github.event.number }}" > validation-results/PR
          mv rollouts validation-results/
      - name: Upload state for PR comment
        uses: actions/upload-artifact@v3
        with:
          name: validation-results
          path: validation-results/