wolfictl-update-gh.yaml

name: Wolfictl Update From GitHub

on:
  workflow_dispatch:
  # Triggers the workflow every hour
  schedule:
    - cron: "0 * * * *"

permissions:
  contents: read
  id-token: write

env:
  GIT_AUTHOR_NAME: wolfi-bot
  GIT_AUTHOR_EMAIL: 121097084+wolfi-bot@users.noreply.github.com

jobs:
  update:
    name: Wolfictl Update
    if: github.repository == 'wolfi-dev/os'
    runs-on: ubuntu-latest

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
      with:
        egress-policy: audit

    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0

    - uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
      id: octo-sts
      with:
        scope: ${{ github.repository }}
        identity: github-updates

    # this need to point to main to always get the latest action
    - uses: wolfi-dev/actions/wolfictl-update-gh@main # main
      with:
        repository: ${{github.repository}}
        token: ${{ steps.octo-sts.outputs.token }}
        git_author_name: ${{ env.GIT_AUTHOR_NAME }}
        git_author_email: ${{ env.GIT_AUTHOR_EMAIL }}