digestabot.yaml

name: Image digest update

on:
  workflow_dispatch:
  schedule:
    - cron: "0 1 * * *"

permissions:
  contents: read

jobs:
  image-update:
    name: Image digest update
    runs-on: ubuntu-latest
    if: github.repository == 'chainguard-images/images'

    permissions:
      contents: read # To clone the repo
      id-token: write # To gitsign and federate

    steps:
    - uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
      with:
        egress-policy: audit

    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
      id: octo-sts
      with:
        scope: ${{ github.repository }}
        identity: digestabot

    - uses: chainguard-dev/digestabot@7dc10a1f7fb063b5130b1116f26a5a0880c2a00f # v1.1.0
      with:
        token: ${{ steps.octo-sts.outputs.token }}
        working-dir: .github
        signoff: true
        author: octo-sts[bot] <157150467+octo-sts[bot]@users.noreply.github.com>
        committer: octo-sts[bot] <157150467+octo-sts[bot]@users.noreply.github.com>