update-aws-cdk.yaml

name: Update AWS CDK libraries
on:
  schedule:
    # At 10:00 on day-of-month 10.
    # See https://crontab.guru/#0_10_10_*_*
    - cron: '0 10 10 * *'

  # Allows one to update the version of AWS CDK by simply starting the workflow, as opposed to manually running the update-aws-cdk script.
  workflow_dispatch:
jobs:
  update-aws-cdk:
    # See https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
    permissions:
      contents: write # Allow pushing of a branch
      pull-requests: write # Allow raising of a PR

    runs-on: ubuntu-latest
    name: Bump CDK versions
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: npm
      - name: "AWS CDK update"
        env:
          # This action will raise a PR to edit package.json and package-lock.json.
          # PRs raised by the default `secrets.GITHUB_TOKEN` will not trigger CI, so we need to provide a different token.
          # This is a PAT for the guardian-ci user.
          # See https://docs.github.com/en/actions/reference/events-that-trigger-workflows#triggering-new-workflows-using-a-personal-access-token
          GITHUB_TOKEN: ${{ secrets.GU_GUARDIAN_CI_TOKEN }}
        run: ./script/update-aws-cdk