auto-review-merge.yaml

name: automated-pr-review
on:
  workflow_dispatch:
  schedule:
    - cron: '42 * * * *'

permissions:
  contents: read

jobs:
  enable-auto-merge:
    runs-on: ubuntu-latest
    if: github.repository == 'wolfi-dev/advisories'

    permissions:
      contents: read
      id-token: write # needed for Octo STS federation

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Check out repository code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
        id: octo-sts
        with:
          scope: wolfi-dev/advisories
          identity: enable-auto-merge

      - run: |
          ./scripts/enable-auto-merge.sh ${{ github.repository }}
        env:
          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}

  review-pr:
    runs-on: ubuntu-latest
    if: github.repository == 'wolfi-dev/advisories'

    needs: enable-auto-merge

    permissions:
      contents: read
      pull-requests: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Check out repository code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - run: |
          ./scripts/review-prs.sh ${{ github.repository }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}