From de8de3b64412dcd2b65d05ed254aa16d3f205096 Mon Sep 17 00:00:00 2001
From: Krukon <michal.krukowski@fresha.com>
Date: Fri, 11 Sep 2026 00:10:43 +0200
Subject: [PATCH] CI: onboard onto actions-manifest via actions-maintenance
 wrapper

Adds the thin reusable-workflow wrapper so this repo participates in
the org-wide actions-manifest rollout (internal Source/Target flow and
external-action pin sync).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/actions-maintenance.yaml | 40 ++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/actions-maintenance.yaml

diff --git a/.github/workflows/actions-maintenance.yaml b/.github/workflows/actions-maintenance.yaml
new file mode 100644
index 0000000..f54b5c1
--- /dev/null
+++ b/.github/workflows/actions-maintenance.yaml
@@ -0,0 +1,40 @@
+# Thin wrapper into the org-wide actions-manifest system (see that repo's README).
+name: actions-maintenance
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: Shared join-key branch name for an in-flight actions-manifest change.
+        required: true
+        type: string
+      pr:
+        description: Optional owner/repo#number of the related PR, if already known.
+        required: false
+        type: string
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - ".github/**"
+  push:
+    branches: [main]
+    paths:
+      - ".github/**"
+
+permissions:
+  contents: read
+
+jobs:
+  actions-maintenance:
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+      actions: write
+      statuses: write
+    # Must stay @main (not pinned) — hallpass/octo-sts trust matches on the literal job_workflow_ref.
+    uses: freshaengineering/actions-manifest/.github/workflows/actions-maintenance.yaml@main
+    with:
+      branch: ${{ inputs.branch }}
+      pr: ${{ inputs.pr }}
+    secrets: inherit