update-dependencies.yaml

name: update-dependencies

on:
  schedule:
    - cron: '17 8 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: update-dependencies
  cancel-in-progress: false

jobs:
  update:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Check publishing credential
        env:
          UPDATE_TOKEN: ${{ secrets.PAT }}
        run: |
          if [ -z "$UPDATE_TOKEN" ]; then
            echo "::error::Configure the PAT secret with Contents, Pull requests, and Workflows read/write permissions."
            exit 1
          fi
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
      - uses: docker/setup-buildx-action@v4
      - name: Update Go and dependencies
        env:
          GH_TOKEN: ${{ github.token }}
        run: ./update-go-deps.sh
      - name: Validate updates
        env:
          GOTOOLCHAIN: auto
        run: |
          python3 -B -m unittest discover -s scripts -p 'test_*.py'
          make check
          go vet ./...
          make test
      - name: Create or update dependency PR
        uses: peter-evans/create-pull-request@v8.1.1
        with:
          token: ${{ secrets.PAT }}
          base: ${{ github.event.repository.default_branch }}
          branch: automation/update-dependencies
          title: 'chore(deps): refresh Go and dependencies'
          commit-message: |
            chore(deps): refresh Go and dependencies

            Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
          add-paths: |
            go.mod
            go.sum
            Dockerfile
            Makefile
            .github/workflows
            api
            config
            charts
          body: |
            ### Change log description

            - Update Go and synchronize the Dockerfile fallback.
            - Refresh Go modules, build-tool pins, and CI image tags/digests.
            - Regenerate code, manifests, and the Helm chart CRD.

            ### Purpose of the change

            Keep dependencies current through the weekly dependency updater.

            ### What the code does

            Runs `./update-go-deps.sh` against the default branch. Review the
            generated diff for the exact version changes before merging.

            ### How to verify it

            The following commands passed in this workflow run:

            - `./update-go-deps.sh` (includes `go build ./...` and `make manifests generate`).
            - `python3 -B -m unittest discover -s scripts -p 'test_*.py'`.
            - `make check`.
            - `go vet ./...`.
            - `make test`.

            Validation uses `GOTOOLCHAIN=auto` for the updated Go version.
            Review the PR's remaining CI checks, including image builds and chart validation.