update-vcpkg-baseline.yml

name: Update vcpkg baseline

on:
  push:
    paths:
      - 'vcpkg'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  update-baseline:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
        with:
          egress-policy: audit

      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true

      - name: Get latest vcpkg baseline
        id: vcpkg-baseline
        run: |
          BASELINE="$(git submodule status vcpkg | awk '{print $1}')"
          echo "baseline=${BASELINE}" >> ${GITHUB_OUTPUT}

      - name: Update vcpkg-configuration.json
        run: |
          jq --arg baseline "${{ steps.vcpkg-baseline.outputs.baseline }}" '.["default-registry"].baseline = $baseline' vcpkg-configuration.json > tmp.$$.json && mv tmp.$$.json vcpkg-configuration.json
          if ! git diff --quiet vcpkg-configuration.json; then
            echo "KEEP_GOING=yes" >> "${GITHUB_ENV}"
          fi

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          commit-message: "chore(deps): update default registry's baseline to `${{ steps.vcpkg-baseline.outputs.baseline }}`"
          title: "chore(deps): update default registry's baseline to `${{ steps.vcpkg-baseline.outputs.baseline }}`"
          body: |
            This PR updates default registry's baseline to `${{ steps.vcpkg-baseline.outputs.baseline }}`.
          branch: "update-vcpkg-baseline-${{ steps.vcpkg-baseline.outputs.baseline }}"
          labels: dependencies
          token: ${{ secrets.REPOSITORY_ACCESS_TOKEN }}
        if: env.KEEP_GOING == 'yes'