Check Github IP Ranges #265

	name: Check Github IP Ranges

	on:
	workflow_dispatch:
	schedule:
	- cron: "0 0 * * 0" # once a week

	jobs:
	check:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	ref: ${{ github.event.pull_request.head.ref }}
	repository: ${{ github.event.pull_request.head.repo.full_name }}
	token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}

	- name: Generate GitHub IP Ranges
	run: \|
	HOOKS=$(curl https://api.github.com/meta \| jq -c .hooks)
	if [[ "$HOOKS" != 'null' ]]; then
	echo "locals {github_hooks_ip_ranges = $HOOKS}" > github-hooks-ip-ranges.tf
	fi

	- name: Setup
	uses: hashicorp/setup-terraform@v3

	- name: Format
	id: fmt
	run: terraform fmt

	- name: Check if IP Ranges Have Changed
	id: ip-check
	run: \|
	if [[ $(git status --porcelain) ]]; then
	echo "New GitHub IP ranges detected."
	git status
	git fetch origin
	git config user.name "${{ github.actor }}"
	git config user.email "${{ github.actor }}@users.noreply.github.com"
	git checkout -b github-ip-range-update
	git add .
	git commit -m "fix: update github ip ranges"
	git push -u origin github-ip-range-update
	echo "::set-output name=NEW_IP_RANGES::true"
	fi

	- if: steps.ip-check.outputs.NEW_IP_RANGES == 'true'
	name: Open Pull Request if IP Ranges Have Changed
	uses: ExpediaGroup/github-helpers@v1
	with:
	helper: create-pr
	title: "fix: update Github IP ranges"
	body: The GitHub IP ranges for hooks have changed on the [meta endpoint](https://api.github.com/meta).
	head: github-ip-range-update
	github_token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}

Provide feedback