dependabot-sync-bazel.yml

name: dependabot-sync-bazel

on:
  pull_request_target:
    types: [opened, synchronize, reopened]
    branches: ["master"]
    paths:
      - "pom.xml"

jobs:
  sync-bazel-dependencies:
    if: >-
      github.event.pull_request.user.login == 'dependabot[bot]' &&
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
    env:
      BAZELISK_SKIP_VERSION_CHECK: "1"

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up Java 17
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: temurin
          java-version: 17

      - name: Install Bazelisk
        run: |
          mkdir -p "$HOME/.local/bin"
          curl -fsSL \
            https://github.com/bazelbuild/bazelisk/releases/download/v1.24.1/bazelisk-linux-amd64 \
            -o "$HOME/.local/bin/bazel"
          chmod +x "$HOME/.local/bin/bazel"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Sync Bazel dependency files
        run: |
          python3 scripts/sync_bazel_dependencies.py
          REPIN=1 bazel run @maven//:pin

      - name: Commit regenerated Bazel files
        shell: bash
        run: |
          if git diff --quiet -- MODULE.bazel maven_install.json; then
            echo "No Bazel dependency file changes detected."
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add MODULE.bazel maven_install.json
          git commit -m "Sync Bazel dependencies for Dependabot update"
          git push origin "HEAD:${{ github.event.pull_request.head.ref }}"