update-from-submodule.yml

name: Update From Submodule

on:
  pull_request_target:
    types: [opened, synchronize]
    branches:
      - main

permissions:
  contents: write

jobs:
  update-files:
    if: github.actor == 'dependabot[bot]' && startsWith(github.event.pull_request.head.ref, 'dependabot/submodules/')
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          # Checkout the repository at the merge commit
          ref: ${{ github.event.pull_request.head.sha }}
          submodules: true

      - name: Validate PR source branch
        run: |
          if [[ ${{ github.event.pull_request.head.repo.full_name }} != '${{ github.repository }}' ]]; then
            echo "Untrusted repository detected! Exiting.";
            exit 1;
          fi

      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
          git_user_signingkey: true
          git_commit_gpgsign: true
          fingerprint: "F768450FB05B817D0B4BC26FB9B6A9B428C8676A"
          trust_level: 5

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Run update script
        run: python update_repo.py

      - name: Commit and push changes
        run: |
          git add .
          git commit -m "Update files based on submodule changes"
          git pull --rebase origin ${{ github.event.pull_request.head.ref }}
          git push origin HEAD:${{ github.event.pull_request.head.ref }}