Update cacert.pem #1530
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Update cacert.pem" | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 0 * * *' # Midnight - every night | |
| permissions: | |
| contents: read | |
| jobs: | |
| update: | |
| name: "Update cacert.pem" | |
| if: ${{ github.repository_owner == 'composer' }} | |
| permissions: | |
| contents: write # pushes the cacert-update branch | |
| pull-requests: write # opens the update PR via gh | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ matrix.branch }} | |
| cancel-in-progress: true | |
| strategy: | |
| matrix: | |
| branch: [1.4, main] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ matrix.branch }} | |
| persist-credentials: true # needed so the job can push the update branch and open the PR | |
| - name: Download cacert.pem | |
| working-directory: res | |
| run: curl -O https://curl.se/ca/cacert.pem | |
| - name: Check SHA256SUM | |
| working-directory: res | |
| run: | | |
| curl -O https://curl.se/ca/cacert.pem.sha256 | |
| sha256sum -c cacert.pem.sha256 | |
| rm -f cacert.pem.sha256 | |
| - name: Create Pull Request | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| BASE: ${{ matrix.branch }} | |
| BRANCH: cacert-update/${{ matrix.branch }} | |
| run: | | |
| if git diff --quiet -- res/cacert.pem; then | |
| echo "cacert.pem is already up to date" | |
| exit 0 | |
| fi | |
| DATE=$(grep -m1 'Certificate data from Mozilla as of:' res/cacert.pem | sed 's/.*as of: *//') | |
| ISO_DATE=$(date -u -d "$DATE" +%Y-%m-%d) | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git switch -C "$BRANCH" | |
| git add res/cacert.pem | |
| git commit -m "Update cacert.pem" | |
| git push --force origin "$BRANCH" | |
| if [ -z "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number')" ]; then | |
| gh pr create --base "$BASE" --head "$BRANCH" \ | |
| --title "Update cacert.pem to $ISO_DATE" \ | |
| --body "Update cacert.pem using latest from https://curl.se/docs/caextract.html" | |
| fi |