LockfilePR.yml

name: LockfilePR
on:
  pull_request:

permissions:
  contents: read
jobs:
  check-lockfile:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            objects.githubusercontent.com:443
            raw.githubusercontent.com:443
            repo.maven.apache.org:443
            repo1.maven.org:443
            sh.jbang.dev:443

      - name: run maven-lockfile
        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
        uses: chains-project/maven-lockfile@bdabb56b82feb242cd543af007b333bd8276e44e # v5.3.5
        with:
          github-token: ${{ secrets.JRELEASER_GITHUB_TOKEN }}
          include-maven-plugins: true
    
      - name: run maven-lockfile (fork/external)
        if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
        uses: chains-project/maven-lockfile@bdabb56b82feb242cd543af007b333bd8276e44e # v5.3.5
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          include-maven-plugins: true
          commit-lockfile: false # verify lockfile is up-to-date (not possible to update lockfile in forks)