specification-version-check.yml

on:
  schedule:
    - cron: "0 13 * * *"
  workflow_dispatch:

name: Specification version check

permissions: {}

jobs:
  # Get the version of the TUF specification the project states it supports
  get-supported-tuf-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.get-version.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
         persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.x"
      - id: get-version
        run: |
          python3 -m pip install -r requirements/pinned.txt
          script="from tuf.api.metadata import SPECIFICATION_VERSION; \
                  print(f\"v{'.'.join(SPECIFICATION_VERSION)}\")"
          ver=$(python3 -c "$script")
          echo "version=$ver" >> $GITHUB_OUTPUT
  # Get the latest TUF specification release and open an issue (if needed)
  specification-bump-check:
    permissions:
      contents: read
      issues: write
    needs: get-supported-tuf-version
    uses: theupdateframework/specification/.github/workflows/check-latest-spec-version.yml@master # zizmor: ignore[unpinned-uses]
    with:
      tuf-version: ${{needs.get-supported-tuf-version.outputs.version}}