update-required-checks.yml

# This job updates the required checks on the codeql-action repository based on the
# checks performed on the most recent commit.

name: Update required checks
on:
  schedule:
    # 23:01 on Saturdays
    - cron: "1 23 * * 6"
  workflow_dispatch:

jobs:
  update-required-checks:
    runs-on: ubuntu-latest
    steps:
    - name: Dump environment
      run: env

    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: '${{ toJson(github) }}'
      run: echo "$GITHUB_CONTEXT"

    - name: Update checks
      run: |
        # Update the required checks based on the current branch.
        # Typically, this will be main.
        echo "Getting checks for $GITHUB_SHA"

        # Ignore any checks with "https://", CodeQL, LGTM, and Update checks.
        CHECKS="$(gh api repos/github/codeql-action/commits/${GITHUB_SHA}/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") | not)] | sort')"

        echo "::group::New Checks"
        echo "$CHECKS" | jq
        echo "::endgroup::"

        echo "{\"contexts\": ${CHECKS}}" > checks.json
        echo "Updating main"
        gh api -X "PATCH" repos/github/codeql-action/branches/main/protection/required_status_checks --input checks.json
        echo "Updating v2"
        gh api -X "PATCH" repos/github/codeql-action/branches/releases/v2/protection/required_status_checks --input checks.json
        echo "Updating v1"
        gh api -X "PATCH" repos/github/codeql-action/branches/releases/v1/protection/required_status_checks --input checks.json