add automatic cacert updater bot (#2677)

.github/workflows/ca-cert-updater.yml

@@ -0,0 +1,27 @@
+name: CA Certs Update
+on:
+  workflow_dispatch:
+  schedule:
+    # https://crontab.guru/every-night-at-midnight
+    - cron: "0 0 * * *"
+
+jobs:
+  update_ca_certs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+
+      - name: Run updater
+        working-directory: ./security
+        run: "./mk-ca-bundle.pl"
+
+      - uses: gr2m/create-or-update-pull-request-action@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          title: "Update CA Certs"
+          path: "security/"
+          commit-message: "cacerts: pull in updated certs from Mozilla"
+          author: "eclipse-temurin-bot <temurin-bot@eclipse.org>"

security/README.md

@@ -37,9 +37,9 @@ The updated list will be picked up during the next build.
 
 The resulting cacerts file is licensed under the terms of the [source file][mozilla-certdata], the Mozilla Public License, v.2.0.
 
-## Future Work
+## Updater
 
-* Create a GitHub bot that checks whether `certdata.txt` needs updating and automatically creates a PR.
+The `certdata.txt` is automatically updated as part of a GitHub actions workflow. See the [workflow file](./github/workflows/ca-cert-updater.yml).
 
  [support-issues]: https://github.com/AdoptOpenJDK/openjdk-support/issues/13
  [jdk-dev-thread]: https://mail.openjdk.java.net/pipermail/jdk-dev/2020-May/004305.html