autoupdate.yml

# SPDX-FileCopyrightText: 2022 WebReady Projects <https://github.com/wr-projects/>
#
# SPDX-License-Identifier: MIT
---
name: Pipeline - Autoupdate
on: push

permissions:
  contents: read
  checks: read
  pull-requests: write

jobs:

  # More info: https://github.com/tibdex/auto-update.
  Auto:
    name: Auto-update
    runs-on: ubuntu-latest
    if: ${{ !startsWith(github.head_ref, 'dependabot/') }}

    steps:
      # More info: https://github.com/step-security/harden-runner.
      - name: Harden Runner
        id: harden_runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443

      # More info: https://github.com/peter-murray/workflow-application-token-action.
      - name: Get token
        id: get_token
        uses: peter-murray/workflow-application-token-action@8e4e6fbf6fcc8a272781d97597969d21b3812974
        with:
          application_id: ${{ secrets.ID_AUTOUPDATEBOT }}
          application_private_key: ${{ secrets.PEM_AUTOUPDATEBOT }}

      # More info: https://github.com/actions/checkout.
      - name: Checkout & Authentication
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          token: ${{ steps.get_token.outputs.token }}
          persist-credentials: false
          fetch-depth: 0

      - name: Autoupdate
        uses: tibdex/auto-update@4081c5bdc34560b58288a010318054e63e6f4a51
        #with:
          #github_token: ${{ steps.get_token.outputs.token }}