create-signing-events.yml

name: TUF-on-CI create Signing events

on:
  schedule:
    - cron: '17 1,7,13,19 * * *'
  workflow_dispatch:

permissions: {}

jobs:
  create-signing-events:
    runs-on: ubuntu-latest
    permissions:
      contents: write # for committing to signing event branch
      actions: write # for dispatching signing event workflow
    steps:
      - name: Generate GitHub App Token
        id: app-token
        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
      - name: Create signing events for offline version bumps
        uses: theupdateframework/tuf-on-ci/actions/create-signing-events@95dc66aba6102bbe911ef93c69395ff62ed69bd4 # v0.11.0
        with:
          token: ${{ steps.app-token.outputs.token }}

  update-issue:
    runs-on: ubuntu-latest
    needs: [create-signing-events]
    if: always() && !cancelled()
    permissions:
      issues: write # for modifying Issues
      contents: read # for checking out the repository
    steps:
      - name: Generate GitHub App Token
        id: app-token
        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
      - name: Update the issue for the workflow
        uses: theupdateframework/tuf-on-ci/actions/update-issue@95dc66aba6102bbe911ef93c69395ff62ed69bd4 # v0.11.0
        with:
          token: ${{ steps.app-token.outputs.token }}
          success: ${{ !contains(needs.*.result, 'failure') }}