Update from template #57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update from template | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| # Every day at 3:30 at night. | |
| - cron: '30 3 * * *' | |
| # Limit token permissions for security | |
| permissions: read-all | |
| jobs: | |
| update-from-template: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: write | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1 | |
| with: | |
| egress-policy: audit | |
| - name: Check out repository | |
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - name: Install Python | |
| uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 | |
| with: | |
| python-version: "3.13" | |
| - name: Install dependencies | |
| run: | | |
| sudo apt install pipx | |
| pipx ensurepath | |
| pipx install uv rust-just copier | |
| - name: Set User | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| - name: Pull request with updates from template | |
| run: | | |
| copier update --trust --defaults --overwrite | |
| any_changes=$(git status --porcelain=v1 2>/dev/null | wc -l) | |
| if [ "$any_changes" -eq 0 ]; then | |
| echo "No updates from the template detected, and no changes found. Stopping and exiting." | |
| exit 0 | |
| fi | |
| git checkout -b chore/update-from-template | |
| git add . | |
| git commit -m "chore(sync): :hammer: update changes from template" | |
| gh pr create \ | |
| --title "chore(sync): :hammer: update changes from template" \ | |
| --body "This PR is automatically generated by the 'update-from-template' workflow. It syncs the latest changes from the template repository with this repository." |