update-dependency-checksums.yml

name: UpdateChecksums
on:
  push:
    branches: [ renovate/** ]
    paths:
      - 'gradle/libs.versions.toml'

permissions: read-all

jobs:
  build:
    name: Dependency checksum pin action
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
        with:
          fetch-depth: 0
          token: ${{ secrets.PUBLISH_KEY }}
      - name: Set up JDK 17
        uses: actions/setup-java@cd89f46ac9d01407894225f350157564c9c7cee2 # v3.12.0
        with:
          distribution: temurin
          java-version: 17
      - name: "Remove previous version"
        run: cp gradle/verification-metadata-clean.xml gradle/verification-metadata.xml
      - name: "Update checksums"
        uses: gradle/gradle-build-action@ef76a971e2fa3f867b617efd72f2fbd72cf6f8bc # v2.8.0
        with:
          cache-disabled: true
          arguments: --write-verification-metadata sha256
      - name: "Git commit"
        run: |
          git config --global user.name 'Esta Nagy'
          git config --global user.email 'nagyesta@gmail.com'
          git add gradle/verification-metadata.xml
          git commit -asm "Pinning dependency checksums {patch}"
          git push -f --set-upstream origin ${{ github.ref_name }}