update_submodule.yml

# This is a workflow for updating the external repositories contained in this repository as git submodules.
#
# It is configured to be triggered by repository dispatch events which come from outside of this repository.
# It requires write access to the repository by providing a personal access token (PAT) with `repo` scope.
#
# The `event_type` parameter is expected to be `trigger-update-submodule`.
# The `client_payload` parameter is expected to contain the following data:
#   * `repo_name`: a string containing the `phylum-dev` repository name to update
#   * `tag_name`: a string containing the release tag to use for updating the git submodule
#
# Here is an example repository dispatch event, triggered with `curl` from the command line:
#
# curl \
#   -X POST \
#   --fail-with-body \
#   -H "Accept: application/vnd.github+json" \
#   -H "X-GitHub-Api-Version: 2022-11-28" \
#   -H "Authorization: token <PAT>" \
#   -d '{"event_type":"trigger-update-submodule","client_payload":{"repo_name":"cli","tag_name":"v6.0.1"}}' \
#   https://api.github.com/repos/phylum-dev/documentation/dispatches
#
# References:
# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#repository_dispatch
# https://docs.github.com/en/rest/repos/repos#create-a-repository-dispatch-event
---
name: Update Submodules

on:
  repository_dispatch:
    types: [trigger-update-submodule]

jobs:
  bump:
    name: Update submodules and create PR
    runs-on: ubuntu-latest
    env:
      REPO_NAME: ${{ github.event.client_payload.repo_name }}
      TAG_NAME: ${{ github.event.client_payload.tag_name }}
    steps:
      - name: Checkout the repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: true

      - name: Update submodule
        run: |
          git -C "ext/${REPO_NAME}" fetch --all --tags
          git -C "ext/${REPO_NAME}" checkout "${TAG_NAME}"

      - name: Commit changes
        run: |
          git config user.name 'phylum-bot'
          git config user.email '69485888+phylum-bot@users.noreply.github.com'
          git add "ext/${REPO_NAME}"
          git commit -m "build: update \`${REPO_NAME}\` submodule to \`${TAG_NAME}\`"
          git push --force origin "HEAD:update-${REPO_NAME}-submodule"

      - name: Create Pull Request
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          github-token: ${{ secrets.GH_RELEASE_PAT }}
          script: |
            const repo = process.env.REPO_NAME;
            const tag = process.env.TAG_NAME;
            const response = await github.rest.pulls.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              head: "update-" + repo + "-submodule",
              base: context.ref,
              title: "build: update `" + repo + "` submodule to `" + tag + "`",
              body: "This submodule update was triggered by a " + repo + " release "
                  + "and ensures the documentation stays current.",
            });
            console.log(response);