build.yml

name: build
on:
  repository_dispatch:
  workflow_dispatch:

jobs:
  update-checkov:
    runs-on: [self-hosted, public, linux, x64]
    steps:
      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8  # v3
        with:
          fetch-depth: '0'

      - name: update-checkov-version
        id: checkov_version
        run: |
          version=$(curl -s curl -s https://api.github.com/repos/bridgecrewio/checkov/tags | jq -r '.[0].name')
          sed -i'.bkp' -e 's/docker:\/\/ghcr.io\/bridgecrewio\/checkov.*'\''/docker:\/\/ghcr.io\/bridgecrewio\/checkov:'"${version}"''\''/g' action.yml
          rm action.yml.bkp
          echo "version=$version" >> $GITHUB_OUTPUT

      - uses: stefanzweifel/git-auto-commit-action@2fde6fc18d3b24c2561ba4b73a8e015e863cef85  # v4
        id: git_auto_commit
        with:
          commit_message: Bump checkov container version to ${{ steps.checkov_version.outputs.version }}

      - name: version-tag
        uses: anothrNick/github-tag-action@1ffbb2e04bd950cffea99066469cb16d69a7887e  # v1
        if: steps.git_auto_commit.outputs.changes_detected == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          WITH_V: true

      - name: version-tag-major
        if: steps.git_auto_commit.outputs.changes_detected == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git fetch --tags
          tagFmt="^v?[0-9]+\.[0-9]+\.[0-9]+$"
          tag="$(git for-each-ref --sort=-v:refname --format '%(refname:lstrip=2)' | grep -E "$tagFmt" | head -n 1)"

          [[ "$tag" =~ ^(v[0-9]+) ]]
          major=${BASH_REMATCH[1]}

          # update major tag
          git tag -f "$major"
          git push -f origin "$major"