github-actions-manual-update-rules.yml

name: Manually Trigger Update Rules
on:
  workflow_dispatch:
    inputs:
      type:
        description: 'Type of update (overwrite or normal)'
        required: true
        default: 'normal'

permissions:
  contents: write

jobs:
  update:
    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted-ubuntu-26.04' || 'ubuntu-26.04' }}
    strategy:
      fail-fast: false
    steps:
      - name: Check out repository code recursively
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.12"
      - name: Install Python Packages
        run: |
          python3 -m venv venv
          venv/bin/pip install firebase-admin
      - name: Execute Python Script Update
        env:
          CREDS_FILE: ${{ secrets.CREDS_FILE }}
          API_BASE_URL: ${{ secrets.API_BASE_URL }}
        run: |
          source venv/bin/activate
          if [[ "${{ github.event.inputs.type }}" == "overwrite" ]]; then
            python flow/util/updateRules.py --keyFile "${CREDS_FILE}" --apiURL ${API_BASE_URL} --commitSHA $(git rev-parse HEAD) --overwrite
          else
            python flow/util/updateRules.py --keyFile "${CREDS_FILE}" --apiURL ${API_BASE_URL} --commitSHA $(git rev-parse HEAD)
          fi
      - name: Push updated rules
        id: remote-update
        run: |
          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"
          if [ -n "$(git status --porcelain)" ]; then
            echo "has_update=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_update=false" >> "$GITHUB_OUTPUT"
          fi
          git add .
          git commit --signoff -m "flow: update rules based on new golden reference"
      - if: "steps.remote-update.outputs.has_update == 'true'"
        name: update rules pr
        id: remote-update-pr
        run: |
          git push