name: "Update dependencies"
on:
  schedule:
    # Monday, 10AM UTC
    - cron: "0 10 * * 1"

  workflow_dispatch:
    inputs: {}

permissions:
  contents: read

jobs:
  branches:
    name: get branch data
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      branches: ${{ steps.branches.outputs.branches }}

    steps:
      - uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          ref: ${{ github.event.inputs.ref }}
      - name: set branches output
        id: branches
        run: echo "branches=[\"main\"]" >> $GITHUB_OUTPUT

  update-dependencies:
    permissions:
      contents: write  # for Git to git push
    runs-on: ubuntu-latest
    needs: branches
    strategy:
      matrix:
        branch: ${{ fromJson(needs.branches.outputs.branches) }}
    steps:
    - uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
      with:
        egress-policy: audit

      # we can not use the default GHA token, as it prevents subsequent GHA
      # from running: we can create a PR but the tests won't run :/
    - name: Generate token
      id: generate_token
      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
      with:
        app-id: ${{ secrets.APP_ID }}
        private-key: ${{ secrets.PRIVATE_KEY }}
        owner: ${{ github.repository_owner }}

    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        token: ${{ steps.generate_token.outputs.token }}
        ref: ${{ matrix.branch }}
        fetch-depth: 0

    - name: Setup Go
      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
      with:
        go-version-file: go.mod

    - name: create pull request
      env:
        BASE_BRANCH: ${{ matrix.branch }}
        GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
      run: |
        git config --global user.email "ExternalSecretsOperator@users.noreply.github.com"
        git config --global user.name "External Secrets Operator"
        BRANCH=update-deps-$(date "+%s")
        make update-deps || true
        make check-diff || true
        if git diff-index --quiet HEAD --; then
          echo "nothing changed. skipping."
          exit 0;
        fi

        git checkout -b $BRANCH
        git add -A
        git commit -m "update dependencies" -s
        git push origin $BRANCH
        gh pr create -B $BASE_BRANCH -H ${BRANCH} --title 'chore: update dependencies' --body 'Update dependencies'