wolfi-update-check.yml

name: Check for a new zizmor version in Wolfi OS

on:
  schedule:
    - cron: "0 */6 * * *" # every 6 hours
  workflow_dispatch:

permissions: {}

jobs:
  check-for-new-version:
    name: Check for new zizmor version in Wolfi OS
    runs-on: ubuntu-slim
    # this job does not make sense on forks
    if: ${{ github.repository_owner == 'zizmorcore' }}

    permissions:
      packages: read # to read the current Docker image version
      issues: write # to create an issue if a new version is found

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: support/

      - name: Check for new zizmor version in Wolfi OS
        run: |
          ./support/wolfi-update-check.sh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}