# Scheduled stackalarm watch for GitHub.
# Copy this file to .github/workflows/stackalarm.yml, next to the
# .stackalarm.yaml profile the stackalarm skill wrote at the root of the project.
#
# Every 4 hours, the CLI reads the news of the stack in the profile. Quiet runs
# cost nothing and open nothing. When a heads-up, an alert or a security release
# is new:
# - with the secret ANTHROPIC_API_KEY, Claude runs the stackalarm skill on the
#   project, and an issue is opened only when the project is concerned, with
#   the verdict first. It changes no file and cannot write to the repository.
# - without it, every new item opens an issue with the raw news.
name: stackalarm

on:
  schedule:
    - cron: "17 */4 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  watch:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: yoanbernabeu/stackalarm@v0.8.0
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          nvd-api-key: ${{ secrets.NVD_API_KEY }}