dependabot.yml

name: "Dependabot: Rebase"
on:
  push:
    branches:
      - main
  release:
    types: [published]

concurrency:
  group: ${{github.workflow}}-${{github.ref}}
  cancel-in-progress: true

jobs:
  auto-rebase:
    runs-on: [self-hosted, linux]

    if: github.ref == 'refs/heads/main' || github.event == 'release'
    timeout-minutes: 5
    steps:
      - name: "Initialise Workspace"
        if: startsWith(runner.name, 'buildagent-')
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Harden Security"
        uses: step-security/harden-runner@v2.8.1
        with:
          egress-policy: audit
          disable-sudo: true
          allowed-endpoints: >
            api.github.com:443
            api.osv.dev:443
            api.securityscorecards.dev:443
            codeload.github.com:443
            fulcio.sigstore.dev:443
            github.com:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            www.bestpractices.dev:443

      - name: "Rebase"
        uses: bbeesley/gha-auto-dependabot-rebase@v1.3.345
        env:
          GITHUB_TOKEN: ${{secrets.SOURCE_PUSH_TOKEN}}