Update GitHub Actions workflow for version checks (#32)

Updated permissions for GitHub Actions workflow and added functionality to apply action updates, configure SSH signing, and create a branch for commits. Enhanced issue and PR management based on action updates.

Signed-off-by: nerdalytics <97166791+nerdalytics@users.noreply.github.com>

Author: nerdalytics

.github/workflows/check-action-versions.yml

@@ -1,7 +1,8 @@
 name: Check Action Versions
 permissions:
-  contents: read
+  contents: write
   issues: write
+  pull-requests: write
 
 on:
   schedule:
@@ -13,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          token: ${{ secrets.ACTION_UPDATER_PAT }}
 
       - name: Check for outdated actions
         id: check
@@ -150,6 +153,11 @@ jobs:
 
             echo "Report generated:"
             cat outdated-actions-report.md
+
+            # Export action data for file modification step
+            for action in "${!ACTIONS_SHA[@]}"; do
+              echo "${action}|${ACTIONS_CURRENT[$action]}|${ACTIONS_LATEST[$action]}|${ACTIONS_SHA[$action]}"
+            done > outdated-actions-data.txt
           else
             echo "All actions are up to date!"
           fi
@@ -179,18 +187,149 @@ jobs:
             echo "Created new issue"
           fi
 
-      - name: Close issue if all actions up to date
+      - name: Apply action updates
+        if: steps.check.outputs.has_outdated == 'true'
+        id: apply
+        run: |
+          set -euo pipefail
+
+          CHANGES_MADE=0
+
+          while IFS='|' read -r action current latest sha; do
+            echo "Updating $action: $current -> $sha # $latest"
+
+            for workflow in .github/workflows/*.yml; do
+              # Escape special characters for sed
+              action_escaped=$(echo "$action" | sed 's/[\/&]/\\&/g')
+              sha_escaped=$(echo "$sha" | sed 's/[\/&]/\\&/g')
+              latest_escaped=$(echo "$latest" | sed 's/[\/&]/\\&/g')
+
+              # Replace: uses: owner/repo@anything -> uses: owner/repo@sha # version
+              if grep -q "uses:[[:space:]]*${action}@" "$workflow"; then
+                sed -i "s|\(uses:[[:space:]]*${action_escaped}@\)[^[:space:]#]*\(.*\)|\1${sha_escaped} # ${latest_escaped}|" "$workflow"
+                CHANGES_MADE=1
+              fi
+            done
+          done < outdated-actions-data.txt
+
+          echo "changes_made=$CHANGES_MADE" >> "$GITHUB_OUTPUT"
+
+      - name: Configure SSH signing
+        if: steps.apply.outputs.changes_made == '1'
+        env:
+          SSH_SIGNING_KEY: ${{ secrets.SSH_SIGNING_KEY }}
+          SSH_PASSPHRASE: ${{ secrets.SSH_SIGNING_KEY_PASSPHRASE }}
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "$SSH_SIGNING_KEY" > ~/.ssh/signing_key
+          chmod 600 ~/.ssh/signing_key
+          ssh-keygen -p -P "$SSH_PASSPHRASE" -N "" -f ~/.ssh/signing_key
+          git config user.name "nerdalytics"
+          git config user.email "97166791+nerdalytics@users.noreply.github.com"
+          git config gpg.format ssh
+          git config user.signingkey ~/.ssh/signing_key
+          git config commit.gpgsign true
+
+      - name: Create branch and commit
+        if: steps.apply.outputs.changes_made == '1'
+        id: commit
+        run: |
+          set -euo pipefail
+
+          BRANCH_NAME="automation/update-github-actions"
+
+          git checkout -B "$BRANCH_NAME"
+          git add .github/workflows/*.yml
+
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          OUTDATED_COUNT=$(wc -l < outdated-actions-data.txt)
+          git commit -m "chore(deps): update $OUTDATED_COUNT GitHub Action(s) to latest versions
+
+          Updates actions to SHA-pinned versions for security.
+          See workflow file changes for details."
+
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          echo "branch_name=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
+
+      - name: Push and create PR
+        if: steps.commit.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          BRANCH_NAME="${{ steps.commit.outputs.branch_name }}"
+          ISSUE_TITLE="Security: Outdated GitHub Actions detected"
+          PR_TITLE="chore(deps): Update GitHub Actions to latest versions"
+
+          # Find issue number for linking
+          ISSUE_NUMBER=$(gh issue list --state open --search "in:title $ISSUE_TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
+
+          # Generate PR body
+          PR_BODY="## Summary
+
+          Automatically updates GitHub Actions to their latest SHA-pinned versions.
+
+          $(cat outdated-actions-report.md)
+
+          ---
+          ${ISSUE_NUMBER:+Fixes #$ISSUE_NUMBER}
+
+          *This PR was automatically generated by the [Check Action Versions](.github/workflows/check-action-versions.yml) workflow.*"
+
+          # Close existing PR and delete branch if they exist (avoids force-push)
+          EXISTING_PR=$(gh pr list --head "$BRANCH_NAME" --state open --json number --jq '.[0].number' 2>/dev/null || echo "")
+          if [[ -n "$EXISTING_PR" ]]; then
+            echo "Closing existing PR #$EXISTING_PR to replace with updated version"
+            gh pr close "$EXISTING_PR" --comment "Superseded by a new PR with updated changes." --delete-branch || true
+          fi
+
+          # Delete remote branch if it still exists (e.g., PR was already closed/merged)
+          if git ls-remote --exit-code --heads origin "$BRANCH_NAME" > /dev/null 2>&1; then
+            echo "Deleting existing remote branch"
+            git push origin --delete "$BRANCH_NAME" || true
+          fi
+
+          # Push branch and create new PR
+          git push -u origin "$BRANCH_NAME"
+
+          echo "Creating new PR"
+          gh pr create \
+            --title "$PR_TITLE" \
+            --body "$PR_BODY" \
+            --label "security,dependencies" \
+            --base main \
+            --head "$BRANCH_NAME"
+
+      - name: Close issue and PR if all actions up to date
         if: steps.check.outputs.has_outdated == 'false'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
         run: |
           ISSUE_TITLE="Security: Outdated GitHub Actions detected"
-          EXISTING_ISSUE=$(gh issue list --state open --search "in:title $ISSUE_TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          BRANCH_NAME="automation/update-github-actions"
 
+          # Close existing issue
+          EXISTING_ISSUE=$(gh issue list --state open --search "in:title $ISSUE_TITLE" --json number --jq '.[0].number' 2>/dev/null || echo "")
           if [[ -n "$EXISTING_ISSUE" ]]; then
             gh issue close "$EXISTING_ISSUE" --comment "All GitHub Actions are now up to date."
             echo "Closed issue #$EXISTING_ISSUE"
           else
             echo "No existing issue to close"
           fi
+
+          # Close existing PR
+          EXISTING_PR=$(gh pr list --head "$BRANCH_NAME" --state open --json number --jq '.[0].number' 2>/dev/null || echo "")
+          if [[ -n "$EXISTING_PR" ]]; then
+            gh pr close "$EXISTING_PR" --comment "All GitHub Actions are now up to date. Closing this automated PR."
+            echo "Closed PR #$EXISTING_PR"
+          else
+            echo "No existing PR to close"
+          fi