export-dependabot-go-sync.yaml

# This workflow can be used as-is on a pull_request_target trigger to listen for dependabot PRs
# for Go. Because dependabot does not support Go workspaces, it syncs the workspace with
# the PR by running `go work sync` and `go mod tidy` in each module.
name: Go Dependabot PR Workspace Sync

on:
  workflow_call:
    inputs:
      github_app_id:
        type: string
        description: ID of GitHub app with contents write permission
        required: true
    secrets:
      github_app_key:
        description: Private key of GitHub app with contents write permission
        required: true

jobs:
  sync:
    runs-on: ubuntu-24.04
    if: github.actor == 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'go')

    steps:
      - uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # v1
        id: app-token
        with:
          app-id: ${{ inputs.github_app_id }}
          private-key: ${{ secrets.github_app_key }}

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          ref: ${{ github.head_ref }}
          token: ${{ steps.app-token.outputs.token }}

      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5
        with:
          go-version-file: go.work
          cache: false

      - name: Sync Workspace
        run: go work sync

      - name: Tidy Modules
        run: go list -m -json | jq '.Dir' | xargs -L1 -I'{}' sh -c 'cd {} && go mod tidy'

      - run: git diff --exit-code
        id: check-diff
        continue-on-error: true

      - name: Commit Changes
        if: steps.check-diff.outcome == 'failure'
        run: |
          git config --global user.name '${{steps.app-token.outputs.app-slug}}[bot]'
          git config --global user.email "$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>"
          git add .
          git commit -m "Sync Workspace"
          git push
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}