-
Notifications
You must be signed in to change notification settings - Fork 269
39 lines (31 loc) · 1.07 KB
/
digestabot.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
name: Image digest update
on:
workflow_dispatch:
schedule:
- cron: "0 1 * * *"
permissions:
contents: read
jobs:
image-update:
name: Image digest update
runs-on: ubuntu-latest
if: github.repository == 'wolfi-dev/os'
permissions:
contents: read # To clone the repo
id-token: write # To gitsign and federate
steps:
- name: Harden Runner
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
with:
egress-policy: audit
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
id: octo-sts
with:
scope: ${{ github.repository }}
identity: digestabot
- uses: chainguard-dev/digestabot@cee67ce333549107c469dbe7656afda5a1e1f287 # v1.2.1
with:
token: ${{ steps.octo-sts.outputs.token }}
author: "octo-sts[bot] <157150467+octo-sts[bot]@users.noreply.github.com>"
committer: "octo-sts[bot] <157150467+octo-sts[bot]@users.noreply.github.com>"