tuf-root.yml

name: GitHub TUF root

on:
  schedule:
    - cron: "0 9 1 * *"
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Sync TUF root
        run: go run ./scripts/synctuf --write

      - name: Open PR if the embed changed
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          root="internal/update/embed/tuf-repo.github.com/root.json"
          if git diff --quiet -- "$root"; then
            echo "No TUF root change"
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          branch="tuf-root-$(date -u +%Y%m%d)"
          git checkout -b "$branch"
          git add "$root"
          git commit -m "Update GitHub TUF root"
          gh auth setup-git
          git push -u origin "$branch"
          gh pr create --title "Update GitHub TUF root" --body "$(cat <<'EOF'
          Verified bump of the embedded GitHub TUF root (bootstrap for in-app updater attestations).

          Not auto-merged. GITHUB_TOKEN pull requests may not run CI; `make verify` still fails if the embed is expired or inside 60 days.
          EOF
          )"