4-add-branch-protections.yaml

name: Step 4, Add branch protections

# This step triggers after we turn on or edit a branch protection rule
# This step sets STEP to 5
# This step closes <details id=4> and opens <details id=5>

# This will run every time we turn on or edit a branch protection rule
# Reference https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
on:
  workflow_dispatch:
  branch_protection_rule:
    types:
      - created
      - edited
    branches:
      - main

# Reference https://docs.github.com/en/actions/security-guides/automatic-token-authentication
permissions:
  # Need `contents: read` to checkout the repository
  # Need `contents: write` to update the step metadata
  contents: write

jobs:
  on_update_branch_protection:
    name: On update branch protection

    # We will only run this action when:
    # 1. This repository isn't the template repository
    # Reference https://docs.github.com/en/actions/learn-github-actions/contexts
    # Reference https://docs.github.com/en/actions/learn-github-actions/expressions
    if: ${{ !github.event.repository.is_template }}

    # We'll run Ubuntu for performance instead of Mac or Windows
    runs-on: ubuntu-latest

    steps:
      # We'll need to check out the repository so that we can edit the README
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0 # Let's get all the branches
          ref: ci # Important, as normally `branch_protection_rule` event won't grab other branches

      # TODO: figure out a better way to deal with the lock on `main`, merge conflict this creates
      # Update README to close <details id=4> and open <details id=5>
      # and set STEP to '5'
      # - name: Update to step 5
      #   uses: skills/action-update-step@v1
      #   with:
      #     token: ${{ secrets.GITHUB_TOKEN }}
      #     from_step: 4
      #     to_step: 5
      #     branch_name: ci