ayamir
diff --git a/‎.github/dependabot.yml‎
Lines changed: 20 additions & 0 deletions b/‎.github/dependabot.yml‎
Lines changed: 20 additions & 0 deletions
diff --git a/‎.github/workflows/lint_code.yml‎
Lines changed: 2 additions & 2 deletions b/‎.github/workflows/lint_code.yml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.github/workflows/style_check.yml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/style_check.yml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.github/workflows/update_flake.yml‎
Lines changed: 89 additions & 15 deletions b/‎.github/workflows/update_flake.yml‎
Lines changed: 89 additions & 15 deletions
diff --git a/‎.github/workflows/update_lockfile.yml‎
Lines changed: 94 additions & 18 deletions b/‎.github/workflows/update_lockfile.yml‎
Lines changed: 94 additions & 18 deletions
diff --git a/‎README.md‎
Lines changed: 1 addition & 1 deletion b/‎README.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎flake.lock‎
Lines changed: 18 additions & 18 deletions b/‎flake.lock‎
Lines changed: 18 additions & 18 deletions
@@ -0,0 +1,20 @@
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    #NOTE: no need to specify `/.github/workflows` for `directory`. use `directory: "/"`
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      time: "07:00"
+    target-branch: "main"
+    commit-message:
+      prefix: "chore(ci.deps)"
+    groups:
+      actions-dependencies:
+        patterns:
+          - "*"
+    labels:
+      - "ci"
@@ -5,7 +5,7 @@ jobs:
   luacheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: lunarmodules/luacheck@v1
         with:
-          args: . --std luajit --max-line-length 150 --no-config --globals vim _debugging _command_panel _flash_esc_or_noh _telescope_collections _toggle_inlayhint _toggle_virtuallines _toggle_lazygit _select_chat_model
+          args: . --std luajit --max-line-length 150 --no-config --globals vim _debugging
@@ -5,7 +5,7 @@ jobs:
   stylua:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: JohnnyMorganz/stylua-action@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -1,26 +1,100 @@
-name: update flake.lock
+---
+name: "Flake.lock: update Nix dependencies (Verified)"
 on:
-  # Scheduled update (1st of every month)
-  schedule: [{ cron: "30 02 1 * *" }]
+  schedule: 
+    - cron: 00 00 1,15 * * # At 00:00 on day-of-month 1 and 15
+
+env:
+  BRANCH: "main"
+  COMMIT_MESSAGE: "chore(lockfile): auto update flake.lock"
 
 jobs:
-  update-lockfile:
+  nix-flake-update:
     if: github.repository_owner == 'ayamir'
-    runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+    runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v26
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@v3
+
+      - name: Check Nix flake inputs
+        uses: DeterminateSystems/flake-checker-action@v12
         with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - name: Run flake-update
+          ignore-missing-flake-lock: false
+          fail-mode: true
+
+      - name: Update flake.lock
         run: |
           nix flake update
-      - uses: stefanzweifel/git-auto-commit-action@v5
+
+      - name: Detect modified files
+        id: diff
+        shell: bash
+        run: |
+          set -euo pipefail
+          # List modified (tracked) files relative to HEAD.
+          # If you only want specific patterns, add a grep here (e.g., grep -E '(^|/)flake\.lock$').
+          mapfile -t changed < <(git ls-files -m --full-name)
+
+          if [ "${#changed[@]}" -eq 0 ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "changed_files=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Join into a comma-separated string for downstream steps.
+          IFS=',' read -r -a _ <<< ""
+          changed_csv="$(printf "%s," "${changed[@]}")"
+          changed_csv="${changed_csv%,}"
+
+          echo "Changed files:"
+          printf ' - %s\n' "${changed[@]}"
+
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          echo "changed_files=${changed_csv}" >> "$GITHUB_OUTPUT"
+
+      - name: Commit via REST Contents API (server-signed ??Verified)
+        if: steps.diff.outputs.changed == 'true'
+        uses: actions/github-script@v8
+        env:
+          CHANGED_FILES: ${{ steps.diff.outputs.changed_files }}
         with:
-          commit_message: "chore(lockfile): auto update flake.lock"
-          commit_user_name: "github-actions[bot]"
-          commit_user_email: "41898282+github-actions[bot]@users.noreply.github.com"
-          commit_author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-          file_pattern: "flake.lock"
+          script: |
+            const fs = require('fs');
+            const owner   = context.repo.owner;
+            const repo    = context.repo.repo;
+            const branch  = process.env.BRANCH;
+            const message = process.env.COMMIT_MESSAGE;
+
+            const files = (process.env.CHANGED_FILES || '')
+              .split(',')
+              .map(s => s.trim())
+              .filter(Boolean);
+
+            for (const path of files) {
+              const content = fs.readFileSync(path, { encoding: 'base64' });
+
+              // Get existing sha if the file already exists
+              let sha;
+              try {
+                const res = await github.rest.repos.getContent({ owner, repo, path, ref: branch });
+                if (!Array.isArray(res.data)) sha = res.data.sha;
+              } catch (e) {
+                if (e.status !== 404) throw e;
+              }
+
+              // NOTE: author/committer intentionally omitted to allow platform signing
+              const r = await github.rest.repos.createOrUpdateFileContents({
+                owner, repo, path, branch,
+                message,
+                content,
+                sha
+              });
+              core.info(`Committed ${path}: ${r.data.commit.sha}`);
+            }
@@ -1,41 +1,117 @@
-name: update lockfile
+---
+name: "lazy-lock: update lazy.nvim dependencies (Verified)"
 on:
-  # Scheduled update (each day)
-  schedule: [{ cron: "30 01 * * *" }]
+  workflow_dispatch: # allows manual triggering
+  schedule:
+    # Scheduled update (each day)
+    - cron: 30 01 * * *
+
+env:
+  BRANCH: "main"
+  COMMIT_MESSAGE: "chore(lockfile): auto update lazy-lock.json"
 
 jobs:
   update-lockfile:
     if: github.repository_owner == 'ayamir'
-    runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+    runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Required to count the commits
-      - uses: andstor/file-existence-action@v3
+
+      - name: Check if lockfile existed
+        uses: andstor/file-existence-action@v3
         id: check_lockfile
         with:
           files: "lazy-lock.json"
+
       - name: Run count-new-commits
+        id: new-commits
         run: |
-          echo "NEW_COMMIT_COUNT=$(git log --oneline --since '24 hours ago' --perl-regexp --author='^((?!github-actions).*)$' | wc -l)" >> "$GITHUB_ENV"
-      - uses: rhysd/action-setup-vim@v1
-        if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && env.NEW_COMMIT_COUNT > 0 }}
+          echo "new_commit_count=$(git log --oneline --since '24 hours ago' --perl-regexp --author='^((?!github-actions).*)$' | wc -l)" >> "$GITHUB_OUTPUT"
+
+      - name: Setup neovim
+        uses: rhysd/action-setup-vim@v1
+        if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && steps.new-commits.outputs.new_commit_count > 0 }}
         with:
           neovim: true
-      - name: Run lockfile-autoupdate
-        if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && env.NEW_COMMIT_COUNT > 0 }}
+
+      - name: Run lazy update
+        if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && steps.new-commits.outputs.new_commit_count > 0 }}
         timeout-minutes: 5
         run: |
           ./scripts/install.sh
           nvim --headless "+Lazy! update" +qa
           cp -pv "${HOME}/.config/nvim/lazy-lock.json" .
-      - uses: stefanzweifel/git-auto-commit-action@v5
-        if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && env.NEW_COMMIT_COUNT > 0 }}
+
+      - name: Detect modified files
+        if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && steps.new-commits.outputs.new_commit_count > 0 }}
+        id: diff
+        shell: bash
+        run: |
+          set -euo pipefail
+          # List modified (tracked) files relative to HEAD.
+          # If you only want specific patterns, add a grep here (e.g., grep -E '(^|/)lazy-lock\.json$').
+          mapfile -t changed < <(git ls-files -m --full-name)
+
+          if [ "${#changed[@]}" -eq 0 ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "changed_files=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Join into a comma-separated string for downstream steps.
+          IFS=',' read -r -a _ <<< ""
+          changed_csv="$(printf "%s," "${changed[@]}")"
+          changed_csv="${changed_csv%,}"
+
+          echo "Changed files:"
+          printf ' - %s\n' "${changed[@]}"
+
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          echo "changed_files=${changed_csv}" >> "$GITHUB_OUTPUT"
+
+      - name: Commit via REST Contents API (server-signed ??Verified)
+        if: ${{ steps.diff.outputs.changed == 'true' && steps.new-commits.outputs.new_commit_count > 0 }}
+        uses: actions/github-script@v8
+        env:
+          CHANGED_FILES: ${{ steps.diff.outputs.changed_files }}
         with:
-          commit_message: "chore(lockfile): auto update lazy-lock.json"
-          commit_user_name: "github-actions[bot]"
-          commit_user_email: "41898282+github-actions[bot]@users.noreply.github.com"
-          commit_author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-          file_pattern: "lazy-lock.json"
+          script: |
+            const fs = require('fs');
+            const owner   = context.repo.owner;
+            const repo    = context.repo.repo;
+            const branch  = process.env.BRANCH;
+            const message = process.env.COMMIT_MESSAGE;
+
+            const files = (process.env.CHANGED_FILES || '')
+              .split(',')
+              .map(s => s.trim())
+              .filter(Boolean);
+
+            for (const path of files) {
+              const content = fs.readFileSync(path, { encoding: 'base64' });
+
+              // Get existing sha if the file already exists
+              let sha;
+              try {
+                const res = await github.rest.repos.getContent({ owner, repo, path, ref: branch });
+                if (!Array.isArray(res.data)) sha = res.data.sha;
+              } catch (e) {
+                if (e.status !== 404) throw e;
+              }
+
+              // NOTE: author/committer intentionally omitted to allow platform signing
+              const r = await github.rest.repos.createOrUpdateFileContents({
+                owner, repo, path, branch,
+                message,
+                content,
+                sha
+              });
+              core.info(`Committed ${path}: ${r.data.commit.sha}`);
+            }
@@ -206,7 +206,7 @@ It's strongly recommended to read [Wiki: Prerequisites](https://github.com/ayami
 
 - [ayamir](https://github.com/ayamir)
 - [Jint-lzxy](https://github.com/Jint-lzxy)
-- [CharlesChiuGit](https://github.com/CharlesChiuGit)
+- [charliie-dev](https://github.com/charliie-dev)
 - [aarnphm](https://github.com/aarnphm)
 - [misumisumi](https://github.com/misumisumi)