pre-commit-cache.yaml

---
name: pre-commit cache

on: # yamllint disable-line rule:truthy
  push:
    branches: ["dev", "develop", "main", "master"]
  schedule:
    # GitHub Actions does not support the non-standard syntax @monthly, @weekly, @daily, etc.
    # - cron: "15 0 * * *" # daily at 00:15 UTC
    - cron: "15 0 1 * *" # low activity repos can do just the first day of the month at 00:15 UTC

permissions:
  contents: write # required for trivy to upload artifacts
  security-events: write # required for trivy to upload SARIF to GitHub Security tab (master only)
  actions: write # required for trivy to upload SBOM artifact (master only)

jobs:
  pre-commit:
    name: pre-commit-cache
    runs-on: ubuntu-latest
    steps:
      - name: Mint ik-code-reader installation token
        id: code_reader_token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.IK_CODE_READER_CLIENT_ID }}
          private-key: ${{ secrets.IK_CODE_READER_PEM }}
          owner: indykite
          repositories: ops-common
      - name: pre-commit
        uses: indykite/.github/.github/actions/pre-commit@master
        with:
          github_token: ${{ steps.code_reader_token.outputs.token }}
          pre_commit_skip: >-
            commitlint,trivy,trivy-conf,trivy-filesystem,trivy-licenses
            ${{ vars.PRE_COMMIT_SKIP != null && ',' || '' }}${{ vars.PRE_COMMIT_SKIP }}
            ${{ format('{0}', github.event_name != 'pull_request' && ',pre-commit-autoupdate,no-commit-to-branch' || '' ) }}
  trivy:
    name: trivy
    runs-on: ubuntu-latest
    steps:
      - name: trivy
        uses: indykite/.github/.github/actions/trivy@master