terraform-aws-github-runner/.github/workflows/update-docs.yml at 9a410ceed5be90d37a7096476a117473de5a171c · github-aws-runners/terraform-aws-github-runner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: Update docs
on:
  push:
    paths:
      - "**/*.tf"
      - "**/*.md"
      - ".github/workflows/update-docs.yml"

permissions:
  contents: read

jobs:
  docs:
    name: Auto update terraform docs
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
        with:
          egress-policy: audit

      - name: Checkout with GITHUB Action token
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          persist-credentials: true

      # use an app to ensure CI is triggered
      - name: Generate TF docs
        if: github.repository_owner == 'github-aws-runners'
        uses: terraform-docs/gh-actions@6de6da0cefcc6b4b7a5cbea4d79d97060733093c # v1.4.1
        with:
          find-dir: .
          git-commit-message: "docs: auto update terraform docs"
          git-push: ${{ github.ref != 'refs/heads/main' || github.repository_owner != 'github-aws-runners' }}
          git-push-user-name: github-aws-runners-pr|bot
          git-push-user-email: "github-aws-runners-pr[bot]@users.noreply.github.com"

      - name: Generate TF docs (forks)
        if: github.repository_owner != 'github-aws-runners'
        uses: terraform-docs/gh-actions@6de6da0cefcc6b4b7a5cbea4d79d97060733093c # v1.4.1
        with:
          find-dir: .
          git-commit-message: "docs: auto update terraform docs"
          git-push: ${{ github.ref != 'refs/heads/main' || github.repository_owner != 'github-aws-runners' }}

      # change docs via PR in case of locked main branch
      - name: Create Pull Request (main branch only)
        if: github.ref == 'refs/heads/main' && github.repository_owner == 'github-aws-runners'
        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: "docs: auto update terraform docs"
          title: "docs: Update Terraform docs"
          branch: update-docs
          branch-suffix: random
          base: ${{ github.event.pull_request.base.ref }}
          delete-branch: true

  deploy-pages:
    needs: [docs]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Configure Git Credentials
        run: |
          git config user.name github-actions[bot]
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: 3.x
      - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          key: mkdocs-material-${{ env.cache_id }}
          path: .cache
          restore-keys: |
            mkdocs-material-
      - run: pip install mkdocs-material
      - run: pip install mkdocs-material-extensions
      - run: mkdocs gh-deploy --force -c -b gh-pages