github-actions-update-rules.yml

name: Create draft PR for updated rules
on:
  repository_dispatch:
    types:
      - set-new-golden

permissions:
  contents: write
  pull-requests: write

jobs:
  update:
    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted-ubuntu-26.04' || 'ubuntu-26.04' }}
    strategy:
      fail-fast: false
    steps:
      - name: Check out repository code recursively
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0
      - name: Git prep
        run: |
          git config --add remote.origin.fetch "+refs/pull/*/head:refs/remotes/origin/pr/*"
          git fetch
          git checkout "origin/pr/${{ github.event.client_payload.branch }}"
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.10"
      - name: Install Python Packages
        run: |
          python3 -m venv venv
          venv/bin/pip install -r .github/requirements/requirements_lock.txt
      - name: Execute Python Script Update
        env:
          CREDS_FILE: ${{ secrets.CREDS_FILE }}
          API_BASE_URL: ${{ secrets.API_BASE_URL }}
        run: |
          source ./venv/bin/activate
          echo ${{ github.event_name }}
          echo ${{ github.event.client_payload.type }}
          if [[ "${{ github.event_name }}" == "repository_dispatch" && "${{ github.event.client_payload.type }}" == "overwrite" ]]; then
            python flow/util/updateRules.py --keyFile "${CREDS_FILE}" --apiURL ${API_BASE_URL} --commitSHA ${{ github.event.client_payload.commitsha }} --overwrite
          else 
            python flow/util/updateRules.py --keyFile "${CREDS_FILE}" --apiURL ${API_BASE_URL} --commitSHA ${{ github.event.client_payload.commitsha }}
          fi
      - name: Push updated rules
        id: remote-update
        run: |
          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"
          if [ -n "$(git status --porcelain)" ]; then
            echo "has_update=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_update=false" >> "$GITHUB_OUTPUT"
          fi
          git add .
          git commit --signoff -m "flow: update rules based on new golden reference"
      - if: "github.event.client_payload.branch != 'master'"
        name: update rules pr
        id: remote-update-pr
        run: |
          git push origin "HEAD:refs/pull/${{ github.event.client_payload.branch }}/head"
      - if: "steps.remote-update.outputs.has_update == 'true' && github.event.client_payload.branch == 'master'"
        name: Create Draft PR
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
        with:
          token: ${{ github.token }}
          signoff: true
          delete-branch: true
          title: "[BOT] Update rules"
          reviewers: |
            vvbandeira
            maliberty
          draft: true
          branch: bot-update-rules
          commit-message: |
            [BOT] Update rules