dependabot-tasks.yml

name: Dependabot Tasks

on:
  pull_request:
    branches:
      - 'main' # dependabot will create PRs only against main

jobs:
  # Dependabot job that runs only for dependabot PRs
  # This job is writing locks, updates checksums, and commits the changes on the dependabot PRs.
  lock-and-verify:
    name: Lock and verify

    runs-on: ubuntu-latest

    env:
      DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}

    # Run only on PRs created by dependabot, this prevents users from misusing branch names
    # prefixed with dependabot/**
    if: github.actor == 'dependabot[bot]'

    # Give the default GITHUB_TOKEN write permission to commit
    # and push the changed files back to the repository.
    permissions:
      contents: write

    steps:
      - name: Checkout project
        uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: 21
          java-package: jdk

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Use Gradle cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
          key: ${{ runner.os }}-gradle-precommit-${{ hashFiles('versions.lock') }}
          restore-keys: |
            ${{ runner.os }}-gradle-precommit-
            ${{ runner.os }}-gradle-

      - name: Write locks
        run: ./gradlew writeLocks

      - name: Update licenses / checksums
        run: ./gradlew updateLicenses

      - name: Commit and push changes
        run: |
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add .
          git commit -m "Write locks and update checksums"
          git push origin ${{ github.head_ref }}