update_dependabot_bundler_pr.yml

# This workflow runs after `Build Dependabot Bundler PR` completes with a
# READ-WRITE GITHUB_TOKEN from the default branch and pushes updated license
# file changes back to the Dependabot PR branch.

# We run this as a separate workflow to isolate potentially unsafe `bundle
# install`s.

name: Update Dependabot Bundler PR
on:
  workflow_run:
    workflows: ["Build Dependabot Bundler PR"]
    types:
      - completed

jobs:
  update:
    runs-on: ubuntu-latest
    if: >
      ${{ github.event.workflow_run.event == 'push' &&
      github.event.workflow_run.conclusion == 'success' }}
    permissions:
      contents: write
    steps:
      - name: Download pr changes
        uses: actions/github-script@v3.1.0
        with:
          script: |
            var artifacts = await github.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id }},
            });
            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "dependabot-pr"
            })[0];
            var download = await github.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            var fs = require('fs');
            fs.writeFileSync('/home/runner/work/dependabot-pr.zip', Buffer.from(download.data));
      - run: mkdir -p /home/runner/work/dependabot-pr
      # NOTE: actions/checkout will delete the contents of the current workspace
      # so we unpack the changes outside the current workspace
      - name: Unpack dependabot pr changes
        run: unzip -o /home/runner/work/dependabot-pr.zip -d /home/runner/work/dependabot-pr
      - name: Set BRANCH_REF env var
        run: printf "BRANCH_REF=%q" "$(head -1 '/home/runner/work/dependabot-pr/BRANCH_REF')" >> $GITHUB_ENV
      - name: Checkout the branch that triggered 'Build Dependabot Bundler PR'
        uses: actions/checkout@v3
        with:
          ref: ${{ env.BRANCH_REF }}
      - name: Configure git
        run: |
          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"
      - name: Commit license changes
        run: |
          CHANGES_PATH=/home/runner/work/dependabot-pr/changes.patch
          if [ -f "$CHANGES_PATH" ]; then
            git am --keep-non-patch $CHANGES_PATH
          else
            echo "No changes where committed"
          fi
      - name: Push changes back to dependabot/bundler branch
        run: |
          if [[ "$BRANCH_REF" =~ ^dependabot/bundler* ]]; then
            git push origin $BRANCH_REF
          else
            echo "Branch ref doesn't look like a dependabot/bundler branch: $BRANCH_REF"
            exit 1
          fi