label-sync.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Label Sync"

on:
  workflow_dispatch:
  push:
    branches: ["main"]
    paths:
      - .github/labels.yaml
      - .github/workflows/label-sync.yaml
      - apps/**
  schedule:
    - cron: "0 0 * * *" # Every day at midnight

jobs:
  label-sync:
    name: Label Sync
    runs-on: ubuntu-latest
    steps:
      - name: Configure 1password
        uses: 1password/load-secrets-action/configure@v2
        with:
          service-account-token: ${{ secrets.ONEPASS_SA_TOKEN }}

      - name: Get Secrets
        uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          BOT_APP_ID: op://Kubernetes/github-bot/BOT_APP_ID
          BOT_APP_PRIVATE_KEY: op://Kubernetes/github-bot/BOT_APP_PRIVATE_KEY

      - name: Generate Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ env.BOT_APP_ID }}
          private-key: ${{ env.BOT_APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Setup Homebrew
        uses: Homebrew/actions/setup-homebrew@master

      - name: Setup Workflow Tools
        shell: bash
        run: brew install go-task

      - name: Append app labels to the labels config file
        shell: bash
        run: task append-app-labels --force

      - name: Sync Labels
        uses: EndBug/label-sync@v2
        with:
          token: ${{ steps.app-token.outputs.token }}
          config-file: .github/labels.yaml
          delete-other-labels: true