Bump BoringSSL, OpenSSL, AWS-LC #471
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Bump BoringSSL, OpenSSL, AWS-LC | |
| permissions: | |
| contents: read | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| # Run daily | |
| - cron: "0 10 * * *" | |
| jobs: | |
| bump: | |
| if: github.repository_owner == 'pyca' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Needed so we can push back to the repo | |
| persist-credentials: true | |
| - id: bump-boringssl | |
| run: | | |
| python3 .github/bin/bump_dependency.py \ | |
| --name "BoringSSL" \ | |
| --repo-url "https://boringssl.googlesource.com/boringssl" \ | |
| --branch "main" \ | |
| --file-path ".github/workflows/ci.yml" \ | |
| --current-version-pattern 'TYPE: "boringssl", VERSION: "([a-f0-9]{40})"' \ | |
| --update-pattern 'TYPE: "boringssl", VERSION: "{new_version}"' \ | |
| --comment-pattern 'Latest commit on the BoringSSL main branch.*?\.' \ | |
| --commit-url-template "{repo_url}/+/{version}" \ | |
| --diff-url-template "{repo_url}/+/{old_version}..{new_version}" | |
| - id: bump-openssl | |
| run: | | |
| python3 .github/bin/bump_dependency.py \ | |
| --name "OpenSSL" \ | |
| --repo-url "https://github.com/openssl/openssl" \ | |
| --branch "master" \ | |
| --file-path ".github/workflows/ci.yml" \ | |
| --current-version-pattern 'TYPE: "openssl", VERSION: "([a-f0-9]{40})"' \ | |
| --update-pattern 'TYPE: "openssl", VERSION: "{new_version}"' \ | |
| --comment-pattern 'Latest commit on the OpenSSL master branch.*?\.' | |
| - id: bump-awslc | |
| run: | | |
| python3 .github/bin/bump_dependency.py \ | |
| --name "AWS-LC" \ | |
| --repo-url "https://github.com/aws/aws-lc" \ | |
| --branch "main" \ | |
| --file-path ".github/workflows/ci.yml" \ | |
| --current-version-pattern 'TYPE: "aws-lc", VERSION: "(v[0-9\.]*)"' \ | |
| --update-pattern 'TYPE: "aws-lc", VERSION: "{new_version}"' \ | |
| --comment-pattern 'Latest tag of AWS-LC main branch, as of .*?\.' \ | |
| --tag \ | |
| --tag-pattern 'v[0-9\.]*' | |
| - name: Check for updates | |
| run: git status | |
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: generate-token | |
| with: | |
| app-id: ${{ secrets.BORINGBOT_APP_ID }} | |
| private-key: ${{ secrets.BORINGBOT_PRIVATE_KEY }} | |
| permission-contents: write | |
| permission-pull-requests: write | |
| permission-workflows: write | |
| if: steps.bump-boringssl.outputs.HAS_UPDATES == 'true' || steps.bump-openssl.outputs.HAS_UPDATES == 'true' || steps.bump-awslc.outputs.HAS_UPDATES == 'true' | |
| - name: Create Pull Request | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| branch: "bump-openssl-boringssl" | |
| commit-message: "Bump BoringSSL, OpenSSL, AWS-LC in CI" | |
| title: "Bump BoringSSL, OpenSSL, AWS-LC in CI" | |
| author: "pyca-boringbot[bot] <pyca-boringbot[bot]+106132319@users.noreply.github.com>" | |
| body: | | |
| ${{ steps.bump-boringssl.outputs.COMMIT_MSG }} | |
| ${{ steps.bump-openssl.outputs.COMMIT_MSG }} | |
| ${{ steps.bump-awslc.outputs.COMMIT_MSG }} | |
| token: ${{ steps.generate-token.outputs.token }} | |
| if: steps.bump-boringssl.outputs.HAS_UPDATES == 'true' || steps.bump-openssl.outputs.HAS_UPDATES == 'true' || steps.bump-awslc.outputs.HAS_UPDATES == 'true' |