Add a GitHub Workflow to automate the update of lockfiles whenever a release PR is closed when needed.
PiperOrigin-RevId: 650650464
Change-Id: I02598ee89c756d58c010fdb5b2522b493439f2b2
diff --git a/.github/workflows/update-lockfiles.yml b/.github/workflows/update-lockfiles.yml
new file mode 100644
index 0000000..3a61fbf
--- /dev/null
+++ b/.github/workflows/update-lockfiles.yml
@@ -0,0 +1,29 @@
+name: update-lockfiles
+
+on:
+ pull_request_target:
+ branches:
+ - "release-**"
+ types:
+ - closed
+
+permissions:
+ contents: read
+
+env:
+ GH_TOKEN: ${{ secrets.BAZEL_IO_TOKEN }}
+
+jobs:
+ update-lockfiles:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
+ with:
+ egress-policy: audit
+ - name: Update lockfile(s) on closed PR
+ uses: bazelbuild/continuous-integration/actions/update-lockfile@122ce87694d0dd505a019321a04f8e64378bddbd
+ with:
+ release-branch: ${{ github.base_ref }}
+ is-prod: True
+ pr-number: ${{ github.event.number }}
\ No newline at end of file
