Update dependencies #87
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update dependencies | |
| on: | |
| schedule: | |
| - cron: '0 11 * * 2' | |
| workflow_dispatch: | |
| permissions: | |
| # This is required for configure-aws-credentials to request an OIDC JWT ID token to access AWS resources later on. | |
| # More info: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| update-deps: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: configure aws credentials | |
| uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 | |
| with: | |
| role-to-assume: ${{ secrets.ROLE }} | |
| role-session-name: dependency-upload-session | |
| aws-region: ${{ secrets.REGION }} | |
| # This step fetches the latest set of released dependencies from s3 and updates the Makefile to use the same. | |
| - name: update dependencies url | |
| run: | | |
| ./bin/update-deps.sh -d ${{ secrets.DEPENDENCY_BUCKET_NAME }} | |
| ./bin/update-rootfs.sh -d ${{ secrets.DEPENDENCY_BUCKET_NAME }} | |
| - name: create PR | |
| uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0 | |
| with: | |
| # A Personal Access Token instead of the default `GITHUB_TOKEN` is required | |
| # to trigger the checks (e.g., e2e tests) on the created pull request. | |
| # More info: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#workarounds-to-trigger-further-workflow-runs | |
| # TODO: Use FINCH_BOT_TOKEN instead of GITHUB_TOKEN. | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| signoff: true | |
| title: 'build(deps): Bump finch dependencies' |