strict.yaml

name: Auto-update strict branch

on:
  push:
    branches:
      - main
      - 'release-[0-9]+.[0-9]+'

permissions:
  contents: read

jobs:
  prepare:
    name: Prepare
    runs-on: ubuntu-latest
    outputs:
      strict: ${{ steps.determine.outputs.strict }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit
      - name: Determine Strict branch
        id: determine
        env:
          BRANCH: ${{ github.ref }}
        run: |
          BRANCH=${BRANCH#refs/heads/}  # strip off refs/heads/ if it exists
          if [[ "${BRANCH}" == "main" ]]; then
            echo "strict=autoupdate/strict" >> "$GITHUB_OUTPUT"
          elif [[ "${BRANCH}" =~ ^release-[0-9]+\.[0-9]+$ ]]; then
            echo "strict=autoupdate/${BRANCH}-strict" >> "$GITHUB_OUTPUT"
          else
            echo "Failed to determine matching strict branch for ${BRANCH}"
            echo "strict=" >> $GITHUB_OUTPUT
          fi
  update:
    permissions:
      contents: write  # for Git to git push
    runs-on: ubuntu-20.04
    needs: [ prepare ]
    if: ${{ needs.prepare.outputs.strict }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit
      - name: Sync ${{ github.ref }} to ${{ needs.prepare.outputs.strict }}
        uses: actions/checkout@v4
        with:
          ssh-key: ${{ secrets.DEPLOY_KEY_TO_UPDATE_STRICT_BRANCH }}
      - name: Apply strict patch
        run: |
          git checkout -b ${{ needs.prepare.outputs.strict }}
          git config --global user.email k8s-bot@canonical.com
          git config --global user.name k8s-bot
          git am ./build-scripts/patches/strict/*.patch
      - name: Push to ${{ needs.prepare.outputs.strict }}
        run: |
          git push origin --force ${{ needs.prepare.outputs.strict }}