Update flake dependencies #156
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI job to periodically (once a week) update flake.lock | |
| name: Update flake dependencies | |
| on: | |
| schedule: | |
| - cron: "0 16 * * 5" | |
| workflow_dispatch: # for allowing manual triggers of the workflow | |
| jobs: | |
| update-dependencies: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - name: Generate GitHub App installation token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.FLAKE_BOT_APP_ID }} | |
| private-key: ${{ secrets.FLAKE_BOT_APP_PRIVATE_KEY }} | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 | |
| with: | |
| use-flakehub: false | |
| - name: Update flake.lock and create signed commit with flake.lock changes | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| FILE_TO_COMMIT: flake.lock | |
| COMMIT_BRANCH: automation/update-flake-dependencies | |
| COMMIT_MESSAGE: "chore(nix): Update Flake dependencies" | |
| run: | | |
| # fetch remote state | |
| git fetch | |
| # if branch exists on remote already | |
| if git checkout "$COMMIT_BRANCH" > /dev/null 2>&1; then | |
| # pull changes | |
| git pull | |
| else | |
| # otherwise, create the branch and push it to remote | |
| git checkout -b "$COMMIT_BRANCH" | |
| git push -u origin "$COMMIT_BRANCH" | |
| fi | |
| # update flake.lock | |
| nix flake update | |
| # make sure something actually changed first, if not, no updates required | |
| if [[ `git status --porcelain` ]]; then | |
| # commit via the GitHub API so we get automatic commit signing | |
| gh api --method PUT /repos/1Password/shell-plugins/contents/$FILE_TO_COMMIT \ | |
| --field message="$COMMIT_MESSAGE" \ | |
| --field content="$(base64 -w 0 $FILE_TO_COMMIT)" \ | |
| --field branch="$COMMIT_BRANCH" \ | |
| --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" | |
| OPEN_PR_COUNT=$(gh pr list --head "$COMMIT_BRANCH" --state open --json number --jq 'length') | |
| if [ "$OPEN_PR_COUNT" -eq 0 ]; then | |
| gh pr create --title "[automation]: Update Flake dependencies" \ | |
| --body "This is an automated PR to update \`flake.lock\`" \ | |
| --label "flake.lock automation" \ | |
| --reviewer 1Password/open-source \ | |
| --base main --head $COMMIT_BRANCH | |
| fi | |
| fi |