.github/workflows/automation-update-requirements.yml

name: Update requirements lockfiles
on:
  pull_request:
    paths:
      - "mypy/private/requirements.in"
jobs:
  update-requirements:
    name: Update requirements lockfiles
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Get Token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.THM_AUTOMATION_APP_ID }}
          private-key: ${{ secrets.THM_AUTOMATION_PRIVATE_KEY }}
      - uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Update requirements lockfiles
        run: bazel run //mypy/private:generate_requirements_lock
      - name: Commit
        run: |
          if [[ -n "$(git diff "mypy/private/requirements.txt")" ]]
          then
            git config --local user.name 'Theorem Automation'
            git config --local user.email 'thm-automation[bot]@users.noreply.github.com'
            git checkout -b thm-automation/tmp
            git add "mypy/private/requirements.txt"
            git commit -m "Update requirements lockfiles"
            git push origin "HEAD:$GITHUB_HEAD_REF"
          fi