ci: fix inability to push to protected branches

Signed-off-by: GitHub <[email protected]>

.github/workflows/lint.yml

@@ -5,28 +5,42 @@ on: [pull_request]
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      # Give the default GITHUB_TOKEN write permission to commit and push the changed files back to the repository.
+      contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/[email protected]
+        with:
+          show-progress: false
+          fetch-depth: 0
+
       - name: Lint
         uses: psf/black@stable
         with:
             options: "-t py312"
+
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5.0.0
         with:
-          python-version: 3.12  # ajusta esto según tus necesidades
+          python-version: 3.12
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install autoflake
+
       - name: Remove unused variables
         run: autoflake --recursive --in-place --exclude=settings.py  --remove-all-unused-imports --remove-duplicate-keys --remove-unused-variables .
-      - name: Git config
+
+        # In case other workflows pushed changes before this one
+      - name: Pull new changes
         run: |
-          git config --local user.email "[email protected]"
-          git config --local user.name "GitHub Action"
+          git config pull.rebase true
+          git config rebase.autoStash true
+          git pull
+
       - name: Push formatted code
         uses: stefanzweifel/git-auto-commit-action@v5
         with:
-          commit_message: "style: lint code"
+          commit_message: "style: lint code"

.github/workflows/openapi.yml

@@ -7,12 +7,11 @@ concurrency:
 on:
   push:
     branches:
-      - main
       - develop
   pull_request:
     branches:
-      - main
       - develop
+
 jobs:
   generate:
     runs-on: ubuntu-latest
@@ -24,6 +23,9 @@ jobs:
       DB_PASSWORD: ocialpass123
       DB_HOST: localhost
       DB_PORT: 5432
+
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout ⬇️
@@ -45,18 +47,20 @@ jobs:
         run: python ./manage.py spectacular --file openapi.yaml --validate --fail-on-warn
 
       - name: Check if the schema was modified
+        if: ${{ github.event_name == 'push' }}
         id: diff
         run: echo "count=$(git status -su | grep openapi.yaml | wc -l)" >> $GITHUB_OUTPUT
 
-      # "echo" in commit returns true so the build succeeds, even if no changed files
-      - name: Commit new changes to the repo
-        if: ${{ steps.diff.outputs.count > 0 && github.event_name != 'pull_request' }}
+      # In case other workflows pushed changes before this one
+      - name: Pull new changes
+        if: ${{ steps.diff.outputs.count > 0 && github.event_name == 'push' }}
         run: |
-          git config user.name GitHub Actions
-          git config user.email [email protected]
           git config pull.rebase true
           git config rebase.autoStash true
           git pull
-          git add .
-          git commit -m "ci: update OpenAPI schema" || echo
-          git push
+
+      - name: Push formatted code
+        if: ${{ steps.diff.outputs.count > 0 && github.event_name == 'push' }}
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: "ci: update openapi.yaml"