infrastructure.yml

# Repository Infrastructure Management
#
# Update repository infrastructure on `push` or `workflow_dispatch` when the infrastructure config
# file (or this workflow) is updated. The user triggering the workflow run (`github.actor`) must be
# a repository admin.
#
# Note: The permissions of `github.actor` is checked because workflow re-runs will reuse the
# privileges of `github.actor` even if the actor initiating the re-run (`github.triggering_actor`)
# has different privileges.
#
# References:
#
# - https://docs.github.com/actions/learn-github-actions/contexts
# - https://docs.github.com/actions/learn-github-actions/expressions
# - https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#push
# - https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch
# - https://docs.github.com/webhooks-and-events/webhooks/webhook-events-and-payloads#push
# - https://docs.github.com/webhooks-and-events/webhooks/webhook-events-and-payloads#workflow_dispatch
# - https://github.com/actions/checkout
# - https://github.com/actions/create-github-app-token
# - https://github.com/flex-development/repostructure-action
# - https://github.com/hmarr/debug-action

---
name: infrastructure
on:
  push:
    branches:
      - main
      - release/**
    paths:
      - .github/infrastructure.yml
      - .github/workflows/infrastructure.yml
  workflow_dispatch:
concurrency:
  cancel-in-progress: true
  group: ${{ github.workflow }}-${{ github.ref }}
jobs:
  infrastructure:
    if: contains(vars.MAINTAINERS, github.actor)
    runs-on: ubuntu-latest
    steps:
      - id: debug
        name: Print environment variables and event payload
        uses: hmarr/debug-action@v3.0.0
      - id: bot-token
        name: Get bot token
        uses: actions/create-github-app-token@v1.10.1
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
      - id: checkout
        name: Checkout ${{ github.ref_name }}@${{ github.sha }}
        uses: actions/checkout@v4.1.6
        with:
          persist-credentials: false
          ref: ${{ github.sha }}
          token: ${{ steps.bot-token.outputs.token }}
      - id: update
        name: Update repository infrastructure
        uses: flex-development/rice-action@1.0.0
        with:
          token: ${{ steps.bot-token.outputs.token }}