ghasum.yml

name: ghasum
on:
  push:
    branches:
    - dependabot/github_actions/**

permissions: read-all

jobs:
  update:
    name: Update gha.sum
    runs-on: ubuntu-24.04
    if: ${{ github.actor == 'dependabot[bot]' }}
    permissions:
      contents: write # To push a commit
    steps:
    - name: Create automation token
      uses: tibdex/github-app-token@v2.1.0
      id: automation-token
      with:
        app_id: ${{ secrets.AUTOMATION_APP_ID }}
        private_key: ${{ secrets.AUTOMATION_APP_KEY }}
    - name: Checkout repository
      uses: actions/checkout@v4.2.0
      with:
        token: ${{ steps.automation-token.outputs.token }}
    - name: Install Go
      uses: actions/setup-go@v5.1.0
      with:
        go-version-file: go.mod
    # NOTE: skip "Verify action checksums" because they might not be up-to-date
    - name: Update gha.sum
      run: go run ./cmd/ghasum update -force
    - name: Commit gha.sum
      uses: stefanzweifel/git-auto-commit-action@v5.0.0
      with:
        commit_message: Update ghasum checksums
        file_pattern: .github/workflows/gha.sum