signing-event.yml

name: TUF-on-CI signing event

permissions: {}

on:
  workflow_dispatch:
  push:
    branches: ['sign/**']
    paths: ['metadata/**', 'targets/**']

jobs:
  handle-signing-event:
    name: TUF-on-CI signing event
    runs-on: ubuntu-latest
    permissions:
      contents: write # for making commits in signing event and for modifying draft state
      pull-requests: write # for modifying signing event pull requests
      actions: write # for dispatching another signing-event workflow

    steps:
      - name: Signing event
        uses: theupdateframework/tuf-on-ci/actions/signing-event@3a44844ab0dc6883849df4039f8494b6f7b5386c # v0.7.0
        with:
          token: ${{ secrets.TUF_ON_CI_TOKEN || secrets.GITHUB_TOKEN }}