github-sync-main-sigstore.yml

name: sync-changes-sigstore

on:
  workflow_dispatch:
    inputs:
      preview:
        description: "Dry run of the Pulumi changes"
        required: false
        default: false
        type: boolean
  push:
    branches:
      - main
    paths:
      - 'github-sync/github-data/sigstore/*.yaml'
      - 'github-sync/Pulumi.github-prod.yaml'

env:
 PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
 GITHUB_OWNER: sigstore

jobs:
  Update:
    name: sync-changes-sigstore
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
    - uses: sigstore/github-sync@main
      if: ${{ inputs.preview }}
      with:
        work_dir: ./github-sync
        config_directory: ./github-sync/github-data
        stack_name: sigstore/github-prod
        pulumi_access_token: ${{ secrets.PULUMI_ACCESS_TOKEN }}
        pulumi_command: preview
        gh_token: ${{ secrets.GITHUB_TOKEN }}
    - uses: sigstore/github-sync@main
      if: ${{ !inputs.preview }}
      with:
        work_dir: ./github-sync
        config_directory: ./github-sync/github-data
        stack_name: sigstore/github-prod
        pulumi_access_token: ${{ secrets.PULUMI_ACCESS_TOKEN }}
        pulumi_command: up
        gh_token: ${{ secrets.GITHUB_TOKEN }}