ci: add auto-submit workflow for snapshot/timestamp

.github/workflows/review-snapshot-timestamp.yml

@@ -0,0 +1,41 @@
+#
+# Copyright 2022 The Sigstore Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Review Snapshot and Timestamp
+
+permissions: read-all
+
+# Execute this as a biweekly cron job and on changes to repository/
+# when new published metadata is submitted.
+on:
+  # Enable cron for checking if a snapshot/timestamp PR needs review
+  # every 6 hours and attempts to merge.
+  schedule:
+    - cron: '0 */6 * * *' # every 6 hours
+  workflow_dispatch:
+
+jobs:
+  review:
+    runs-on: ubuntu-20.04
+    permissions:
+      pull-requests: 'write'
+      contents: 'write'
+    env:
+      GITHUB_TOKEN: ${{ secrets.SIGSTORE_ROOT_SIGNING_FINE_GRAINED_PAT }}
+    steps:
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+      - run: |
+          set -euo pipefail
+          ./.github/workflows/scripts/report-failure.sh

.github/workflows/scripts/review-pull-request.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+#
+# Copyright 2022 The Sigstore Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+# Gets the open snapshot/timestamp update pull requests of the repository
+timestamp_update() {
+    gh api -H "Accept: application/vnd.github.v3+json" "/repos/${GITHUB_REPOSITORY}/pulls?head=sigstore:update-snapshot-timestamp" | jq '.[0]' | jq 'select (.!=null)'
+}
+
+UPDATE_PR=$(timestamp_update)
+if [[ -z "${UPDATE_PR}" ]]; then
+    PULL_NUMBER=$(echo "${UPDATE_PR}" | jq -r '.number')
+
+    # Approve PR
+    curl \
+    -o review_output.json \
+    -X POST \
+    -H "Accept: application/vnd.github+json" \
+    -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+    https://api.github.com/repos/"${GITHUB_REPOSITORY}"/pulls/"${PULL_NUMBER}"/reviews
+
+    REVIEW_ID=$(jq -r '.id' review_output.json)
+    GH_TOKEN=$GITHUB_TOKEN gh api \
+    --method POST \
+    -H "Accept: application/vnd.github+json" \
+    /repos/"${GITHUB_REPOSITORY}"/pulls/"${PULL_NUMBER}"/reviews/"${REVIEW_ID}"/events \
+    -f event='APPROVE'
+
+    # Attempt to merge PR
+    GH_TOKEN="${GITHUB_TOKEN}" gh api \
+    --method PUT \
+    -H "Accept: application/vnd.github+json" \
+    /repos/"${GITHUB_REPOSITORY}"/pulls/"${PULL_NUMBER}"/merge \
+    -f commit_title='Update Snapshot and Timestamp' \
+    -f commit_message='update snapshot and timestamp' 
+fi