feat(only test): ar rover file sftp #888
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2025 Deutsche Telekom IT GmbH | |
| # | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Dependabot Tidy | |
| # pull_request_target runs in the context of the BASE branch, which gives the | |
| # workflow a privileged GITHUB_TOKEN (contents: write) even for Dependabot PRs. | |
| # We guard the job strictly to dependabot[bot] and always check out the PR | |
| # head by its immutable SHA (not a mutable branch ref) to prevent privilege | |
| # escalation from arbitrary PRs. | |
| # | |
| # A commit pushed with a plain GITHUB_TOKEN does NOT re-trigger other workflow | |
| # runs (GitHub blocks it to prevent recursion). To make CI re-run after the | |
| # tidy commit, this workflow uses a GitHub App token (APP_ID + APP_PRIVATE_KEY | |
| # variable & secret) when configured. Without them the push is still made but CI | |
| # must be re-triggered manually (or via "Re-run workflows"). | |
| on: | |
| pull_request_target: | |
| paths: | |
| - '**/go.mod' | |
| - '**/go.sum' | |
| workflow_dispatch: | |
| inputs: | |
| pr_number: | |
| description: 'PR number to run go mod tidy on (required for workflow_dispatch)' | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| jobs: | |
| tidy: | |
| name: Run go mod tidy | |
| if: github.actor == 'dependabot[bot]' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| # Generate a GitHub App token when the App secrets are configured. | |
| # The App token, unlike GITHUB_TOKEN, triggers downstream CI workflows | |
| # when new commits are pushed to the PR branch. | |
| - name: Generate GitHub App token | |
| id: app_token | |
| if: ${{ vars.APP_ID != '' }} | |
| continue-on-error: true | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ vars.APP_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| - name: Resolve PR head SHA | |
| id: pr_info | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| let pr; | |
| if (context.eventName === 'workflow_dispatch') { | |
| const prNumber = parseInt('${{ inputs.pr_number }}'); | |
| const { data } = await github.rest.pulls.get({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: prNumber, | |
| }); | |
| pr = data; | |
| } else { | |
| pr = context.payload.pull_request; | |
| } | |
| core.setOutput('head_sha', pr.head.sha); | |
| core.setOutput('head_ref', pr.head.ref); | |
| core.setOutput('pr_number', pr.number); | |
| - name: Checkout PR branch at exact head SHA | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Use the App token for checkout so the subsequent push is | |
| # attributed to the App and triggers downstream CI. Fall back to | |
| # GITHUB_TOKEN when the App is not configured. | |
| token: ${{ steps.app_token.outputs.token || secrets.GITHUB_TOKEN }} | |
| ref: ${{ steps.pr_info.outputs.head_sha }} | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: 'stable' | |
| check-latest: true | |
| - name: Run go mod tidy on all modules | |
| run: | | |
| echo "Identified modules:" | |
| MODULES=$(find . -name 'go.mod' -exec dirname {} \; | sort) | |
| echo "$MODULES" | |
| echo "" | |
| echo "Running go mod tidy on all modules..." | |
| echo "$MODULES" | while read -r module_dir; do | |
| if [ -n "$module_dir" ]; then | |
| echo "Processing: $module_dir" | |
| (cd "$module_dir" && go mod tidy) | |
| fi | |
| done | |
| - name: Check for changes | |
| id: check_changes | |
| run: | | |
| if [[ -n "$(git status --porcelain)" ]]; then | |
| echo "changes=true" >> $GITHUB_OUTPUT | |
| echo "Changes detected after running go mod tidy:" | |
| git diff --name-only | |
| else | |
| echo "changes=false" >> $GITHUB_OUTPUT | |
| echo "No changes detected after running go mod tidy" | |
| fi | |
| - name: Commit and push changes | |
| if: steps.check_changes.outputs.changes == 'true' | |
| env: | |
| HEAD_REF: ${{ steps.pr_info.outputs.head_ref }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add . | |
| git commit -m "chore: run go mod tidy for modules updated by dependabot" | |
| # The detached HEAD after checking out by SHA needs an explicit push target. | |
| git push origin HEAD:"$HEAD_REF" | |
| - name: Add comment to PR | |
| if: steps.check_changes.outputs.changes == 'true' | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| github.rest.issues.createComment({ | |
| issue_number: ${{ steps.pr_info.outputs.pr_number }}, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: 'go mod tidy has been run for all Go modules and changes have been committed to this PR.' | |
| }) |