neiam /gitgud

name: dependency-updates
# Security updates as pull requests: scripts/dependency-update finds the
# dependencies with a known vulnerability (osv-scanner, against OSV) that
# a newer version fixes, bumps them, and keeps one pull request per
# ecosystem — deps/security-hex, deps/security-cargo — refreshed in
# place, closing it once there's nothing left to fix. The pull requests
# are opened by the forge's CI account (gg-security) with this job's own
# token; their CI (audit.yml among it) is what shows the fixes landed.
#
# Weekly, and by hand from the Actions page (`gg ci dispatch
# dependency-updates`).
on:
  schedule:
    - cron: "23 5 * * 1"
  workflow_dispatch:

permissions:
  contents: write # push the deps/security-* branches
  pull-requests: write # open, refresh and close their pull requests

jobs:
  update:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4
        with:
          # The deps/security-* branches too, to tell whether a refresh
          # changed anything before pushing it.
          fetch-depth: 0

      # The same toolchains the Dockerfile builds with: a lockfile is only
      # as good as the resolver that wrote it.
      # setup-beam picks its OTP build by ImageOS, which the runner sets to
      # "selfhosted"; given on the step itself, ours wins.
      - name: Say which Ubuntu this is, for setup-beam
        id: os
        run: echo "image_os=ubuntu$(. /etc/os-release && echo "${VERSION_ID%%.*}")" >> "$GITHUB_OUTPUT"

      - uses: erlef/setup-beam@v1
        env:
          ImageOS: ${{ steps.os.outputs.image_os }}
        with:
          otp-version: "28.5.0.2"
          elixir-version: "1.19.5"
          version-type: strict

      - name: Hex
        run: mix local.hex --force

      - name: Rust
        run: |
          curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.88.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      # Pinned and checked, as in audit.yml; bump both together.
      - name: Fetch osv-scanner
        env:
          OSV_VERSION: v2.6.0
          OSV_SHA256: ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108
        run: |
          curl -sSfL -o /tmp/osv-scanner \
            "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_amd64"
          echo "${OSV_SHA256}  /tmp/osv-scanner" | sha256sum -c -
          chmod +x /tmp/osv-scanner

      - name: Update
        env:
          OSV_SCANNER: /tmp/osv-scanner
          GITHUB_TOKEN: ${{ github.token }}
        run: scripts/dependency-update --base "${{ github.ref_name }}"