github-sync-pr-sigstore.yml

name: preview-changes

on:
  pull_request_target:
    branches:
      - main
    paths:
      - 'github-sync/github-data/sigstore/*.yaml'
      - 'github-sync/Pulumi.github-prod.yaml'

env:
 PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
 GITHUB_OWNER: sigstore

jobs:
  preview:
    name: changes-sigstore
    runs-on: ubuntu-latest

    permissions:
      pull-requests: write

    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        ref: ${{ github.event.pull_request.head.sha }}

    - uses: sigstore/github-sync@main
      with:
        work_dir: ./github-sync
        config_directory: ./github-sync/github-data
        stack_name: sigstore/github-prod
        pulumi_access_token: ${{ secrets.PULUMI_ACCESS_TOKEN }}
        pulumi_command: preview
        gh_token: ${{ secrets.GITHUB_TOKEN }}
        comment_on_pr: true