postsubmits.yml

name: Postsubmits

on:
  push:
    branches: [ main ]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  reconcile:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: set token
        run: echo ${{ secrets.AUGGIE_BOT_TOKEN }} > token
      - name: peribolos dry-run
        uses: docker://ghcr.io/uwu-tools/peribolos:v0.0.7@sha256:b9711218b498f72518eaf21029785202862e8c87ab0082c8e0177b86e8df2467
        with:
          github-token-path: ./token
          config-path: config
          fix-org: true
          fix-org-members: true
          fix-teams: true
          fix-team-members: true
          fix-team-repos: true
          min-admins: 3
          #required-admins: # TODO(action): Required admins needs to be configured