Skip to content

Update Deployment Metadata #1260

Update Deployment Metadata

Update Deployment Metadata #1260

name: Update Deployment Metadata
on:
schedule:
- cron: '0 6 * * *'
workflow_dispatch:
jobs:
update-metadata:
runs-on: ubuntu-latest
# security/M-010: contents:write + pull-requests:write are scoped
# to this single hourly job so peter-evans/create-pull-request can
# open (or update) a PR. The job no longer pushes commits directly
# to the default branch — every change goes through code review.
permissions:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup environment
uses: ./.github/actions/setup
- name: Run governance metadata update
env:
MAINNET_URL: ${{ secrets.MAINNET_URL }}
run: forge build && forge script script/automation/UpdateGovernanceMetadata.s.sol --fork-url $MAINNET_URL -vvvv
# Open or refresh a PR with the diff instead of pushing direct to
# the default branch (security/M-010). The action creates branch
# `bot/update-deployments`, commits the staged files there, and
# opens a PR. If the PR already exists it updates it in-place.
- name: Open PR if changed
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
add-paths: build/deployments-*.json
branch: bot/update-deployments
commit-message: "chore: update governance metadata"
title: "chore: update governance metadata (auto)"
body: |
Automated hourly update of governance deployment metadata
from `forge script script/automation/UpdateGovernanceMetadata.s.sol`.
Review the diff and merge — these are derived files; if the
content looks unexpected, check what landed in the script
recently before merging.
delete-branch: true