release-hash-check.yml

name: release-hash-check

on:
  pull_request:
    branches:
      - master
    paths:
      - .in-toto/*.link

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'

    - id: files
      run: |
        git fetch origin master
        LAST_COMMON_COMMIT=$(git merge-base HEAD origin/master)
        FILES=$(git --no-pager diff --name-only $LAST_COMMON_COMMIT -- .in-toto | xargs echo)
        echo "all=$FILES" >> "$GITHUB_OUTPUT"

    - id: merge
      name: Merge branch into latest master
      env:
        HEAD_BRANCH: ${{ github.head_ref }}
      run: |
        git fetch origin $HEAD_BRANCH
        git checkout origin/master
        git config user.name "release-hash-check"
        git config user.email "<>"
        git merge --no-commit --no-edit origin/$HEAD_BRANCH

    - run: python .github/workflows/release-hash-check.py ${{ steps.files.outputs.all }}