on:
schedule:
- cron: "15 20 5 6 *"
workflow_dispatch:
name: Update test CA
permissions:
contents: write
pull-requests: write
jobs:
renew-minica:
runs-on: ubuntu-latest
steps:
- name: Setup Go
uses: actions/setup-go@v6
with:
go-version: "1.22"
token: ${{ github.token }}
- name: Check out repository code
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: "Install MiniCA"
run: go install github.com/jsha/minica@latest
- name: "Remove old certificates"
run: rm -f tests/minica/example.com/*.pem
- name: "Generate new certificates"
run: minica -domains example.com
working-directory: tests/minica/
- name: Check for an existing update branch
id: branch
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
branch="chore/ca-update-$(date +'%Y-%m-%d')"
echo "branch=$branch" >> "$GITHUB_OUTPUT"
if git ls-remote --exit-code --heads origin "$branch" >/dev/null 2>&1; then
echo "A branch for this update already exists; skipping."
echo "exists=true" >> "$GITHUB_OUTPUT"
else
echo "exists=false" >> "$GITHUB_OUTPUT"
fi
- name: Commit and open pull request
if: steps.branch.outputs.exists == 'false'
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
git config --global user.name "github-actions[bot]"
git config --global user.email "github-actions[bot]@users.noreply.github.com"
branch="${{ steps.branch.outputs.branch }}"
git switch -c "$branch"
git add tests/minica/example.com/*.pem
if git diff --cached --quiet; then
echo "No changes to commit; skipping PR."
exit 0
fi
git commit -m "Update MiniCA certificates"
git push origin "$branch"
gh pr create \
--base main \
--head "$branch" \
--title "Update MiniCA certificates" \
--body "Automated certificate renewal"