Update Deployment Metadata #1260
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update Deployment Metadata | |
| on: | |
| schedule: | |
| - cron: '0 6 * * *' | |
| workflow_dispatch: | |
| jobs: | |
| update-metadata: | |
| runs-on: ubuntu-latest | |
| # security/M-010: contents:write + pull-requests:write are scoped | |
| # to this single hourly job so peter-evans/create-pull-request can | |
| # open (or update) a PR. The job no longer pushes commits directly | |
| # to the default branch — every change goes through code review. | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup environment | |
| uses: ./.github/actions/setup | |
| - name: Run governance metadata update | |
| env: | |
| MAINNET_URL: ${{ secrets.MAINNET_URL }} | |
| run: forge build && forge script script/automation/UpdateGovernanceMetadata.s.sol --fork-url $MAINNET_URL -vvvv | |
| # Open or refresh a PR with the diff instead of pushing direct to | |
| # the default branch (security/M-010). The action creates branch | |
| # `bot/update-deployments`, commits the staged files there, and | |
| # opens a PR. If the PR already exists it updates it in-place. | |
| - name: Open PR if changed | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| add-paths: build/deployments-*.json | |
| branch: bot/update-deployments | |
| commit-message: "chore: update governance metadata" | |
| title: "chore: update governance metadata (auto)" | |
| body: | | |
| Automated hourly update of governance deployment metadata | |
| from `forge script script/automation/UpdateGovernanceMetadata.s.sol`. | |
| Review the diff and merge — these are derived files; if the | |
| content looks unexpected, check what landed in the script | |
| recently before merging. | |
| delete-branch: true |