|
| 1 | +# CI job to periodically (once a week) update flake.lock |
| 2 | +name: Update flake dependencies |
| 3 | +on: |
| 4 | + schedule: |
| 5 | + - cron: "0 16 * * 5" |
| 6 | + workflow_dispatch: # for allowing manual triggers of the workflow |
| 7 | +jobs: |
| 8 | + update-dependencies: |
| 9 | + runs-on: ubuntu-latest |
| 10 | + steps: |
| 11 | + - uses: actions/checkout@v6 |
| 12 | + - uses: DeterminateSystems/nix-installer-action@v22 |
| 13 | + - uses: DeterminateSystems/magic-nix-cache-action@v13 |
| 14 | + with: |
| 15 | + use-flakehub: false |
| 16 | + - name: Update flake.lock and create signed commit with flake.lock changes |
| 17 | + env: |
| 18 | + GITHUB_TOKEN: ${{ secrets.OP_BOT_TOKEN }} |
| 19 | + FILE_TO_COMMIT: flake.lock |
| 20 | + COMMIT_BRANCH: automation/update-flake-dependencies |
| 21 | + COMMIT_MESSAGE: "chore(nix): Update Flake dependencies" |
| 22 | + run: | |
| 23 | + # fetch remote state |
| 24 | + git fetch |
| 25 | + # if branch exists on remote already |
| 26 | + BRANCH_EXISTS=false |
| 27 | + if git checkout "$COMMIT_BRANCH" > /dev/null 2>&1; then |
| 28 | + # pull changeshttps://github.com/1Password/shell-plugins/pull/595 |
| 29 | + git pull |
| 30 | + BRANCH_EXISTS=true |
| 31 | + else |
| 32 | + # otherwise, create the branch and push it to remote |
| 33 | + git checkout -b "$COMMIT_BRANCH" |
| 34 | + git push -u origin "$COMMIT_BRANCH" |
| 35 | + fi |
| 36 | + # update flake.lock |
| 37 | + nix flake update |
| 38 | + # make sure something actually changed first, if not, no updates required |
| 39 | + if [[ `git status --porcelain` ]]; then |
| 40 | + # commit via the GitHub API so we get automatic commit signing |
| 41 | + gh api --method PUT /repos/1Password/shell-plugins/contents/$FILE_TO_COMMIT \ |
| 42 | + --field message="$COMMIT_MESSAGE" \ |
| 43 | + --field content="$(base64 -w 0 $FILE_TO_COMMIT)" \ |
| 44 | + --field branch="$COMMIT_BRANCH" \ |
| 45 | + --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" |
| 46 | + if [ "$BRANCH_EXISTS" = "false" ]; then |
| 47 | + gh pr create --title "[automation]: Update Flake dependencies" \ |
| 48 | + --body "This is an automated PR to update \`flake.lock\`" \ |
| 49 | + --label "flake.lock automation" \ |
| 50 | + --reviewer mrjones2014 \ |
| 51 | + --base main --head $COMMIT_BRANCH |
| 52 | + fi |
| 53 | + fi |
0 commit comments