dependabot-post-update.yaml

name: Dependabot Post-Update
permissions:
  contents: write  # so the commit can be pushed
  actions: write   # so createWorkflowDispatch can be invoked
on:
  pull_request:
    types: [opened, synchronize]
    branches:
      - main

jobs:
  post-update:
    if: ${{ github.actor == 'dependabot[bot]' }}
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout code
        uses: actions/checkout@v4.2.2
        with:
          persist-credentials: true   # (default) makes GITHUB_TOKEN available for git push
          fetch-depth: 1 # Fetch tip commit so we can push back
          ref: ${{ github.event.pull_request.head.ref }} # Check out the head ref of the PR instead of detached HEAD

      - name: Configure Git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Update devcontainer hash
        run: python3 .github/workflows/hash_git_files.py . --for-devcontainer-config-update --exit-zero

      - name: Commit & push changes
        id: commit
        run: |
          if ! git diff --quiet; then
            git add .
            git commit -m "chore: apply post-Dependabot script changes [dependabot skip]"
            git push origin HEAD:${{ github.event.pull_request.head.ref }}
            echo "pushed=true" >> $GITHUB_OUTPUT
          else
            echo "pushed=false" >> $GITHUB_OUTPUT
          fi

      - name: Dispatch CI on PR branch # pushes done by GITHUB_TOKEN don't trigger workflows, so we have to restart the CI job manually, see https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow
        if: steps.commit.outputs.pushed == 'true'
        uses: actions/github-script@v7.0.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const pr = context.payload.pull_request;
            if (!pr) {
              throw new Error("No pull_request found in payload; aborting dispatch.");
            }
            await github.actions.createWorkflowDispatch({
              owner:       context.repo.owner,
              repo:        context.repo.repo,
              workflow_id: "ci.yaml",
              ref:         pr.head.ref,
            });