splunk-security_content/.github/workflows/datasource-dependabot.yml

name: Splunk TA Update

on:
  workflow_dispatch:  # Manually trigger the workflow
  schedule:
    - cron: '55 06 * * *'  # Runs daily at midnight

jobs:
  data-source-validation-and-update:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: 'develop'
          token: ${{ secrets.DATA_SOURCES_DEPENDABOT }}
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          architecture: 'x64'  # or the version your script requires

      - name: Install Python Dependencies and ContentCTL and Atomic Red Team
        run: |
          pip install "contentctl>=4.0.0"
    
      - name: Run ContentCTL Data source TA validation
        id: validate
        run: |
          pwd
          contentctl validate --data-source-TA-validation 2>&1 | tee data_source_validation.log
        continue-on-error: true 
      
      - name: Print Validation Log
        run: |
          cat data_source_validation.log
          rm -f =4.0.0

      - name: Update Data Sources if Validation Fails
        run: |
          python .github/workflows/update_data_sources_ta.py
          git status

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.DATA_SOURCES_DEPENDABOT }}
          commit-message: Updated TAs
          branch: auto-ta-update-${{ github.run_number }}
          base: develop
          title: Automated Splunk TA Update ${{ github.run_number }}
          body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow."
          paths: |
            security_content/data_sources/**