name: Bump cacert.pem

on:
  workflow_dispatch:
  schedule:
    # Run daily
    - cron: "0 0 * * *"

permissions:
  contents: read

jobs:
  bump:
    if: github.repository_owner == 'certifi'
    runs-on: ubuntu-latest
    permissions:
      contents: write  # for peter-evans/create-pull-request to create branch
      pull-requests: write  # for peter-evans/create-pull-request to create a PR
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: make update
      - name: Update date
        id: update-date
        run: |
          if ! git diff --quiet certifi/cacert.pem ; then
            DATE=$(date +"%Y.%m.%d")
            sed -E -i "s/__version__ = .*/__version__ = \"${DATE}\"/" certifi/__init__.py
            echo "DATE=${DATE}" >> $GITHUB_OUTPUT
          fi

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
        with:
          commit-message: "${{ steps.update-date.outputs.DATE }}"
          title: "${{ steps.update-date.outputs.DATE }}"
          token: ${{ secrets.GITHUB_TOKEN }}
        if: steps.update-date.outputs.DATE