bump.yml

name: Bump cacert.pem

on:
  workflow_dispatch:
  schedule:
    # Run daily
    - cron: "0 0 * * *"

permissions:
  contents: read

jobs:
  bump:
    if: github.repository_owner == 'certifi'
    runs-on: ubuntu-latest
    permissions:
      contents: write  # for peter-evans/create-pull-request to create branch
      pull-requests: write  # for peter-evans/create-pull-request to create a PR
    steps:
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
      - run: make update
      - name: Update date
        id: update-date
        run: |
          if ! git diff --quiet certifi/cacert.pem ; then
            DATE=$(date +"%Y.%m.%d")
            sed -E -i "s/__version__ = .*/__version__ = \"${DATE}\"/" certifi/__init__.py
            echo "DATE=${DATE}" >> $GITHUB_OUTPUT
          fi

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
        with:
          commit-message: "${{ steps.update-date.outputs.DATE }}"
          title: "${{ steps.update-date.outputs.DATE }}"
          token: ${{ secrets.GITHUB_TOKEN }}
        if: steps.update-date.outputs.DATE