name: "Update terraform-providers"

on:
  #schedule:
  #  - cron: "0 3 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  tf-providers:
    permissions:
      contents: write # for peter-evans/create-pull-request to create branch
      pull-requests: write # for peter-evans/create-pull-request to create a PR
    if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
        with:
          nix_path: nixpkgs=channel:nixpkgs-unstable
      - name: setup
        id: setup
        run: |
          echo "title=terraform-providers: update $(date -u +"%Y-%m-%d")" >> $GITHUB_OUTPUT
      - name: update terraform-providers
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config user.name "github-actions[bot]"
          echo | nix-shell \
            maintainers/scripts/update.nix \
            --argstr commit true \
            --argstr keep-going true \
            --argstr max-workers 2 \
            --argstr path terraform-providers
      - name: get failed updates
        run: |
          echo 'FAILED<<EOF' >> $GITHUB_ENV
          git ls-files --others >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV
      # cleanup logs of failed updates so they aren't included in the PR
      - name: clean repo
        run: |
          git clean -f
      - name: create PR
        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
        with:
          body: |
            Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.

            https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}

            These providers failed to update:
            ```
            ${{ env.FAILED }}
            ```

            Check that all providers build with:
            ```
            @ofborg build opentofu.full
            ```
            If there is more than ten commits in the PR `ofborg` won't build it automatically and you will need to use the above command.
          branch: terraform-providers-update
          delete-branch: false
          title: ${{ steps.setup.outputs.title }}
          token: ${{ secrets.GITHUB_TOKEN }}