Cron: update lockfiles #86
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | |
| --- | |
| name: "Cron: update lockfiles" | |
| on: | |
| workflow_dispatch: # allows manual triggering | |
| schedule: | |
| # Runs daily at UTC 23:30 (= next-day 07:30 UTC+8) | |
| - cron: "30 23 * * *" | |
| # id-token: write omitted — not using FlakeHub cache | |
| permissions: {} | |
| concurrency: | |
| group: cron-lockfile-update | |
| cancel-in-progress: false # avoid aborting mid-commit | |
| env: | |
| BRANCH: "main" | |
| jobs: | |
| update-lazy-lock: | |
| if: github.repository_owner == 'charliie-dev' | |
| permissions: | |
| contents: write | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 1 | |
| - name: Check if lockfile existed | |
| uses: andstor/file-existence-action@v3 | |
| id: check_lockfile | |
| with: | |
| files: "lazy-lock.json" | |
| - name: Setup neovim | |
| uses: rhysd/action-setup-vim@v1 | |
| if: ${{ steps.check_lockfile.outputs.files_exists == 'true' }} | |
| with: | |
| neovim: true | |
| - name: Run lazy update | |
| if: ${{ steps.check_lockfile.outputs.files_exists == 'true' }} | |
| timeout-minutes: 5 | |
| run: | | |
| set -euo pipefail | |
| ./scripts/update_lockfile.sh | |
| cp lazy-lock.json lazy-lock.json.before | |
| nvim --headless "+Lazy! update" +qa | |
| - name: Log lockfile changes | |
| if: ${{ steps.check_lockfile.outputs.files_exists == 'true' }} | |
| run: | | |
| set -euo pipefail | |
| if ! diff -q lazy-lock.json.before lazy-lock.json >/dev/null 2>&1; then | |
| updated=$(jq -n --slurpfile before lazy-lock.json.before --slurpfile after lazy-lock.json \ | |
| '[($after[0] | to_entries[]) as $e | select($before[0][$e.key] != $e.value)] | length') | |
| echo "::notice::lazy-lock.json updated — ${updated} plugin(s) changed" | |
| diff --unified=0 lazy-lock.json.before lazy-lock.json || true | |
| else | |
| echo "::notice::lazy-lock.json unchanged — all plugins up to date" | |
| fi | |
| rm -f lazy-lock.json.before | |
| - name: Commit lazy-lock.json (server-signed Verified) | |
| if: ${{ steps.check_lockfile.outputs.files_exists == 'true' }} | |
| uses: ./.github/actions/commit-file | |
| with: | |
| path: lazy-lock.json | |
| message: "chore(lockfile): auto update lazy-lock.json" | |
| branch: ${{ env.BRANCH }} | |
| update-flake-lock: | |
| needs: update-lazy-lock | |
| if: ${{ !failure() && !cancelled() && github.repository_owner == 'charliie-dev' }} | |
| permissions: | |
| contents: write | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - name: Check if should run (bi-monthly on 1st/15th, or manual dispatch) | |
| id: gate | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then | |
| echo "run=true" >> "$GITHUB_OUTPUT" | |
| else | |
| day=$(TZ=Asia/Taipei date +%d) | |
| if [[ "$day" == "01" || "$day" == "15" ]]; then | |
| echo "run=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "run=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice::Skipping flake.lock update — only runs on 1st and 15th" | |
| fi | |
| fi | |
| - name: Checkout repository | |
| if: steps.gate.outputs.run == 'true' | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ env.BRANCH }} | |
| fetch-depth: 1 | |
| # Ensure we have the latest commit (e.g. lazy-lock.json update from previous job) | |
| - name: Pull latest changes | |
| if: steps.gate.outputs.run == 'true' | |
| run: git pull --ff-only origin "$BRANCH" | |
| - name: Install Nix | |
| if: steps.gate.outputs.run == 'true' | |
| uses: DeterminateSystems/determinate-nix-action@v3 | |
| - name: Update flake.lock | |
| if: steps.gate.outputs.run == 'true' | |
| run: nix flake update | |
| - name: Check Nix flake inputs | |
| if: steps.gate.outputs.run == 'true' | |
| uses: DeterminateSystems/flake-checker-action@v12 | |
| with: | |
| ignore-missing-flake-lock: false | |
| fail-mode: true | |
| - name: Validate updated flake | |
| if: steps.gate.outputs.run == 'true' | |
| run: nix flake check | |
| - name: Commit flake.lock (server-signed Verified) | |
| if: steps.gate.outputs.run == 'true' | |
| uses: ./.github/actions/commit-file | |
| with: | |
| path: flake.lock | |
| message: "chore(lockfile): auto update flake.lock" | |
| branch: ${{ env.BRANCH }} |