post-dependabot.yml

name: Dependabot post-update
on:
  pull_request_target:
    action: [opened, synchronize, reopened]
    branches:
      - 'master'
      - '[0-9].[0-9]+'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions: {}
jobs:
  post-update:
    permissions:
      pull-requests: read # for gh pr checkout
      contents: write # to push code in repo (stefanzweifel/git-auto-commit-action)

    if: ${{ github.actor == 'dependabot[bot]' }}
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v3
    - name: Login
      run: |
        echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
    - name: Checkout
      run: |
        gh pr checkout ${{ github.event.pull_request.number }}
    - name: Setup Python
      uses: actions/setup-python@v4
    - name: Cache PyPI
      uses: actions/cache@v3.0.4
      with:
        key: post-update
        path: ~/.cache/pip
        restore-keys: |
            post-update-
    - name: Update pip-tools
      run: |
        python -m pip install -U pip-tools
    - name: Run pip-compile
      run: |
        make compile-deps
    - name: Commit and push if needed
      uses: stefanzweifel/git-auto-commit-action@v4
      with:
        commit_message: Recompile requirements/constraints.txt