Switch to x509 auth (#450) #293

	name: Auto-update strict branch

	on:
	push:
	branches:
	- main
	- 'release-[0-9]+.[0-9]+'

	permissions:
	contents: read

	jobs:
	prepare:
	name: Prepare
	runs-on: ubuntu-latest
	outputs:
	strict: ${{ steps.determine.outputs.strict }}
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@v2
	with:
	egress-policy: audit
	- name: Determine Strict branch
	id: determine
	env:
	BRANCH: ${{ github.ref }}
	run: \|
	BRANCH=${BRANCH#refs/heads/} # strip off refs/heads/ if it exists
	if [[ "${BRANCH}" == "main" ]]; then
	echo "strict=autoupdate/strict" >> "$GITHUB_OUTPUT"
	elif [[ "${BRANCH}" =~ ^release-[0-9]+\.[0-9]+$ ]]; then
	echo "strict=autoupdate/${BRANCH}-strict" >> "$GITHUB_OUTPUT"
	else
	echo "Failed to determine matching strict branch for ${BRANCH}"
	echo "strict=" >> $GITHUB_OUTPUT
	fi
	update:
	permissions:
	contents: write # for Git to git push
	runs-on: ubuntu-20.04
	needs: [ prepare ]
	if: ${{ needs.prepare.outputs.strict }}
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@v2
	with:
	egress-policy: audit
	- name: Sync ${{ github.ref }} to ${{ needs.prepare.outputs.strict }}
	uses: actions/checkout@v4
	with:
	ssh-key: ${{ secrets.DEPLOY_KEY_TO_UPDATE_STRICT_BRANCH }}
	- name: Apply strict patch
	run: \|
	git checkout -b ${{ needs.prepare.outputs.strict }}
	git config --global user.email [email protected]
	git config --global user.name k8s-bot
	git am ./build-scripts/patches/strict/*.patch
	- name: Push to ${{ needs.prepare.outputs.strict }}
	run: \|
	git push origin --force ${{ needs.prepare.outputs.strict }}

Provide feedback