assign-ids.yml

name: Assign IDs

on:
  push:
    branches: main

permissions: {}

jobs:
  assign-ids:
    name: Assign IDs
    runs-on: ubuntu-latest
    permissions:
      contents: write # for create-pull-request
      pull-requests: write # for create-pull-request
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Cache cargo bin
        id: admin-cache
        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
        with:
          path: ~/.cargo/bin
          key: rustsec-admin-7ed6bee1571768e528a6631400d3b51f37463b29

      - name: Install rustsec-admin
        if: steps.admin-cache.outputs.cache-hit != 'true'
        run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev 7ed6bee1571768e528a6631400d3b51f37463b29

      - name: Assign IDs
        id: assign
        run: |
          message=$(rustsec-admin assign-id --github-actions-output)
          echo "commit_message=${message}" >> $GITHUB_OUTPUT

      - name: Create duplicate ID assignment guard
        run: |
          echo "This file causes merge conflicts if two ID assignment jobs run concurrently." > .duplicate-id-guard
          echo "This prevents duplicate ID assignment due to a race between those jobs." >> .duplicate-id-guard
          ls -R ./crates/ ./rust/ | sha256sum >> .duplicate-id-guard

      - name: Create pull request
        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: ${{ steps.assign.outputs.commit_message }}
          title: ${{ steps.assign.outputs.commit_message }}
          branch: assign-ids