go-work-sync.yaml

# Sync go.work on PRs
# If not running upstream (where it uses the vault action), requires the
# RUN_WORKFLOW_FROM_WORKFLOW secret to be set.

name: Sync go.work
on:
  pull_request_target:
    types: [ opened, reopened, synchronize ]
    paths:
    - '**/go.mod'
    - '**/go.sum'
    - 'go.work'
permissions:
  contents: write
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true
jobs:
  update-sum:
    # We only run this for pull requests from the same repository.  This is
    # important for security reasons, as we use pull_request_target.
    if: github.event.pull_request.head.repo.full_name == github.repository
    permissions:
      contents: read
      id-token: write # Required for ./.github/actions/get-token
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        ref: ${{ github.base_ref }}
    - id: get-token
      uses: ./.github/actions/get-token
      with:
        token-secret: ${{ secrets.RUN_WORKFLOW_FROM_WORKFLOW }}
    - name: Checkout
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        persist-credentials: true
        ref: ${{ github.head_ref }}
        fetch-depth: 3
        token: ${{ steps.get-token.outputs.token }}
    - uses: ./.github/actions/yarn-install
    - name: Determine go.mod files
      id: go-files
      run: >-
        printf "go-files=%s go.work\n"
        "$(git ls-files '**/go.mod' '**/go.sum' | tr '\r\n' '  ')"
        >> "$GITHUB_OUTPUT"
    - run: yarn lint:go:fix
    - name: Check for changes
      id: changed
      run: |
        if [ -n "$(git status --porcelain -- $GO_FILES)" ]; then
          echo changed=true >> "$GITHUB_OUTPUT"
        else
          echo changed= >> "$GITHUB_OUTPUT"
        fi
      env:
        GO_FILES: ${{ steps.go-files.outputs.go-files }}
    - name: Commit changes
      if: steps.changed.outputs.changed
      run: >-
        git
        -c user.name="$GIT_AUTHOR_NAME"
        -c user.email="$GIT_AUTHOR_EMAIL"
        commit
        --message='Update go modules'
        --message="Signed-off-by: $GIT_AUTHOR_NAME <$GIT_AUTHOR_EMAIL>"
        --
        $GO_FILES
      env:
        GIT_AUTHOR_NAME: Rancher Desktop Dependency Manager
        GIT_AUTHOR_EMAIL: donotuse@rancherdesktop.io
        GO_FILES: ${{ steps.go-files.outputs.go-files }}
    - name: Push changes
      if: steps.changed.outputs.changed
      run: |
        git show
        git push origin ${{ github.head_ref }}