bump-deps.yml

# adapted based on
# https://github.com/google/go-containerregistry/blob/main/.github/workflows/bump-deps.yaml
name: Bump Deps

on:
  schedule:
  - cron: '0 10 * * 2' # weekly at 10AM Tuesday
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  bump-deps:
    name: Bump Deps

    # Don't bother bumping deps on forks.
    if: ${{ github.repository == 'awslabs/soci-snapshotter' }}
    runs-on: ubuntu-20.04

    steps:
    - uses: actions/checkout@v3
    - uses: actions/setup-go@v4
      with:
        go-version: '1.20.6'

    - run: ./scripts/bump-deps.sh
    - name: Create Pull Request
      uses: peter-evans/create-pull-request@v5
      with:
        title: "Bump dependencies using scripts/bump-deps.sh"
        commit-message: "Bump dependencies using scripts/bump-deps.sh"
        body: "This PR created by [create-pull-request](https://github.com/peter-evans/create-pull-request) must be closed and reopened manually to trigger automated checks."
        labels: dependencies
        delete-branch: true
        author: "GitHub <no-reply@github.com>"
        signoff: true