sync-kuma-submodule.yml

name: Sync Kuma submodule
# Ensure that we only run 1 workflow per branch at a time (cancel if one is already running).
concurrency:
  cancel-in-progress: true
  group: ${{ github.workflow }}

on:
  workflow_dispatch: 
    inputs: {}
  repository_dispatch:
    types: [UPDATE_SUBMODULE]
  pull_request:
    types: [closed]
  schedule:
    - cron: '0 0 * * *'

jobs:
  get-current-do-not-close-pr:
    name: 'Get current do-not-close PR'
    timeout-minutes: 10
    # Runs for the two dispatch triggers. Also runs for merged pull requests **if** they have the “do-not-close” label.
    if: github.event_name != 'pull_request' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'do-not-close'))
    runs-on: ubuntu-latest
    outputs:
      number: ${{ steps.get-current-pr.outputs.number }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit
      - name: 'Get current do-not-close PR'
        id: get-current-pr
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          number=`gh pr list --repo ${{ github.repository }} -l do-not-close -B main --json number --jq '.[0].number'`
          echo number=$number >> $GITHUB_OUTPUT

  update-submodule:
    name: 'Update submodule'
    timeout-minutes: 10
    needs: get-current-do-not-close-pr
    if: ${{ ! needs.get-current-do-not-close-pr.outputs.number }} # Do not overwrite the PR if there's a do-not-close label
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit

      - name: Create GitHub App Token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
        id: app-token
        with:
          app-id: ${{ vars.GH_APP_KONG_DOCS_ID }}
          private-key: ${{ secrets.GH_APP_KONG_DOCS_SECRET }}
          owner: Kong

      - name: 'Check-out current repo'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: true
          ref: main
          # In order to update the submodule, we need unlimited fetch-depth.
          fetch-depth: 0
      - name: 'Get current repo data'
        working-directory: app/.repos/kuma
        run: |
          echo SUBMODULE_OLD_SHA=`git log -1 --format=format:%h` >> $GITHUB_ENV
      - name: 'Update submodule'
        run: |
          git submodule update --remote app/.repos/kuma
      - name: 'Get submodule repo data'
        working-directory: app/.repos/kuma
        run: |
          echo SUBMODULE_NEW_SHA=`git log -1 --format=format:%h` >> $GITHUB_ENV
          echo "SUBMODULE_PR_LOG<<EOF" >> $GITHUB_ENV
          git log ${{ env.SUBMODULE_OLD_SHA }}..HEAD --format=oneline -- | sed -E 's:(#[0-9]+):kumahq/kuma-website\1:g' >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV
      - name: 'Create pull request'
        # https://github.com/peter-evans/create-pull-request
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
        id: newPR
        with:
          base: main
          commit-message: 'chore(deps): bump kumahq/kuma-website from ${{ env.SUBMODULE_OLD_SHA }} to ${{ env.SUBMODULE_NEW_SHA }}'
          committer: kong-docs[bot] <team-docs@konghq.com>
          author: kong-docs[bot] <team-docs@konghq.com>
          signoff: true
          branch: chore/upgrade-kuma-website
          token: ${{ steps.app-token.outputs.token }}
          delete-branch: true
          labels: |
            skip-changelog
            review:general
          title: 'chore(deps): bump kumahq/kuma-website from ${{ env.SUBMODULE_OLD_SHA }} to ${{ env.SUBMODULE_NEW_SHA }}'
          body: |
            Auto upgrade PR log:

            ${{ env.SUBMODULE_PR_LOG }}

            Triggered by [action](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}).
          draft: false