valkey/.github/workflows/provenance-refresh.yml

name: Refresh Provenance Data

on:
  schedule:
    - cron: "0 2 * * *"
  workflow_dispatch:

permissions:
  contents: write

jobs:
  refresh:
    if: github.repository == 'valkey-io/valkey'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Refresh Fingerprints
        uses: valkey-io/verify-provenance@05ee217ecf96b948ce996dbc965f285cbe73752a
        with:
          mode: "refresh"
          source_repo: "redis/redis"
          target_repo: "${{ github.repository }}"
          branding_pairs: "Redis:Valkey,KeyDB:Valkey"
          prefix_pairs: "RM_:VM_,REDISMODULE_:VALKEYMODULE_"
          github_token: "${{ secrets.GITHUB_TOKEN }}"
          db_branch: "verify-provenance-db"

      - name: Commit Updated PR DB
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          DB_BRANCH="verify-provenance-db"

          # Create the DB branch on first run, otherwise reuse it.
          if git ls-remote --exit-code --heads origin "$DB_BRANCH" >/dev/null 2>&1; then
            git fetch origin "+$DB_BRANCH:$DB_BRANCH"
            git checkout "$DB_BRANCH"
          else
            git checkout --orphan "$DB_BRANCH"
            git rm -rf . >/dev/null 2>&1 || true
          fi

          # Overwrite with refreshed file (the action places it at .refreshed_pr_db.json.gz)
          if [ -f .refreshed_pr_db.json.gz ]; then
            mv .refreshed_pr_db.json.gz pr_fingerprints.json.gz
            git add pr_fingerprints.json.gz
            if ! git diff --cached --quiet; then
              git commit -m "Automated PR fingerprint refresh [skip ci]"
              git push origin "$DB_BRANCH"
            else
              echo "No changes to PR database."
            fi
          else
            echo "Error: Refreshed DB file not found."
            exit 1
          fi