sync-sourcebot.yml

name: Sync Sourcebot Zoekt Dependency

# This workflow needs base-repository secrets for the cross-repository dispatch.
# It never checks out or executes pull request code.
on:
  pull_request_target:
    types: [closed]

permissions:
  contents: read

jobs:
  dispatch:
    if: >-
      github.event.pull_request.merged == true &&
      github.event.pull_request.base.ref == github.event.repository.default_branch
    runs-on: ubuntu-latest
    steps:
      - name: Generate Sourcebot GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner: sourcebot-dev
          repositories: sourcebot
          permission-contents: write

      - name: Request Sourcebot dependency update
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          ZOEKT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
          ZOEKT_PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail

          jq -n \
            --arg zoekt_sha "$ZOEKT_SHA" \
            --arg zoekt_pr_number "$ZOEKT_PR_NUMBER" \
            '{
              event_type: "zoekt-pr-merged",
              client_payload: {
                zoekt_sha: $zoekt_sha,
                zoekt_pr_number: $zoekt_pr_number
              }
            }' \
            | gh api \
                --method POST \
                --header "Accept: application/vnd.github+json" \
                --header "X-GitHub-Api-Version: 2022-11-28" \
                --input - \
                repos/sourcebot-dev/sourcebot/dispatches

          {
            echo "## Sourcebot sync requested"
            echo
            echo "Dispatched Zoekt PR #$ZOEKT_PR_NUMBER at \`$ZOEKT_SHA\`."
          } >> "$GITHUB_STEP_SUMMARY"