dependabot_serverless_gomod.yml

name: Dependabot
on: pull_request
permissions:
  contents: write

# NOTE: For this job, we are unable to use the GITHUB_TOKEN from the action
# itself.  The reason for this is that the tokens handed out for actions dont'
# contain the necessary permissions to kick off workflows in the case a new
# commit is added, as is the case here.  For this job, we use the GH_BOT token
# secret in the repo, which has the necessary permissions.  This allows the
# final commit+push on this job to execute the rest of the workflow required by
# the PR build configuration.

jobs:
  dependabot:
    name: Serverless gomod update
    runs-on: ubuntu-latest
    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
    steps:
      - name: Set up Go 1.21
        uses: actions/setup-go@v5
        with:
          go-version: 1.21.x

      - name: Check out code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}
          token: ${{ secrets.GH_BOT_ACCESS_TOKEN }}

      - name: Update serverless gomod
        run: make -C cmd/tempo-serverless update-mod

      - name: Commit serverless gomod changes
        env:
          USER: grafanabot
          TOKEN: ${{ secrets.GH_BOT_ACCESS_TOKEN }}
        run: |
          git config --global url."https://${USER}:${TOKEN}@github.com/grafana/tempo".insteadOf "https://github.com/grafana/tempo"
          git config user.name grafanabot
          git config user.email bot@grafana.com
          git add cmd/tempo-serverless/lambda/go.mod
          git add cmd/tempo-serverless/lambda/go.sum
          git add cmd/tempo-serverless/cloud-run/go.mod
          git add cmd/tempo-serverless/cloud-run/go.sum
          git diff --quiet --staged || git commit -m 'Update serverless gomod'

      - name: Push changes
        run: |
          git push origin ${{ github.head_ref }}