name: "Update dependencies"
on:
  schedule:
    # Monday, 10AM UTC
    - cron: "0 10 * * 1"

  workflow_dispatch:
    inputs: {}


permissions:
  contents: read

jobs:
  branches:
    name: get branch data
    runs-on: ubuntu-latest
    outputs:
      branches: ${{ steps.branches.outputs.branches }}

    steps:
      - uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0
          ref: ${{ github.event.inputs.ref }}
      - name: set branches output
        id: branches
        run: echo "branches=[\"main\"]" >> $GITHUB_OUTPUT

  update-dependencies:
    permissions:
      contents: write  # for Git to git push
    runs-on: ubuntu-latest
    needs: branches
    strategy:
      matrix:
        branch: ${{ fromJson(needs.branches.outputs.branches) }}
    steps:
    - uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
      with:
        egress-policy: audit

      # we can not use the default GHA token, as it prevents subsequent GHA
      # from running: we can create a PR but the tests won't run :/
    - name: Generate token
      id: generate_token
      uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
      with:
        app-id: ${{ secrets.APP_ID }}
        private-key: ${{ secrets.PRIVATE_KEY }}
        owner: ${{ github.repository_owner }}

    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        token: ${{ steps.generate_token.outputs.token }}
        ref: ${{ matrix.branch }}
        fetch-depth: 0

    - name: Setup Go
      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
      with:
        go-version-file: go.mod

    - name: create pull request
      env:
        BASE_BRANCH: ${{ matrix.branch }}
        GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
      run: |
        git config --global user.email "ExternalSecretsOperator@users.noreply.github.com"
        git config --global user.name "External Secrets Operator"
        BRANCH=update-deps-$(date "+%s")
        make update-deps || true
        make check-diff || true
        if git diff-index --quiet HEAD --; then
          echo "nothing changed. skipping."
          exit 0;
        fi

        git checkout -b $BRANCH
        git add -A
        git commit -m "update dependencies" -s
        git push origin $BRANCH
        gh pr create -B $BASE_BRANCH -H ${BRANCH} --title 'chore: update dependencies' --body 'Update dependencies'