Flake.nix vendorHash updater #10
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Flake.nix vendorHash updater" | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - go.mod | |
| - go.sum | |
| workflow_dispatch: | |
| workflow_call: | |
| jobs: | |
| updateVendorHash: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: write | |
| steps: | |
| - name: Generate token | |
| id: generate_token | |
| uses: tibdex/github-app-token@v2 | |
| with: # OCMBot | |
| app_id: ${{ secrets.OCMBOT_APP_ID }} | |
| private_key: ${{ secrets.OCMBOT_PRIV_KEY }} | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ steps.generate_token.outputs.token }} | |
| persist-credentials: false | |
| - name: Enable GPG signing | |
| run: | | |
| echo '#!/bin/bash' > gpg-wrapper | |
| echo 'gpg --passphrase "'${{ secrets.OCMBOT_SIGNING_KEY_PASS }}'" --yes --batch --pinentry-mode loopback $@ <&0' >> gpg-wrapper | |
| echo 'exit $?' >> gpg-wrapper | |
| chmod +x gpg-wrapper | |
| echo -n "${{ secrets.OCMBOT_SIGNING_KEY }}" | base64 -d | ./gpg-wrapper --import | |
| git config --global gpg.program "$(realpath gpg-wrapper)" | |
| git config --global user.name ocmbot[bot] | |
| git config --global user.email 125909804+ocmbot[bot]@users.noreply.github.com | |
| git config --global user.signingkey ${{ secrets.OCMBOT_SIGNING_KEY_ID }} | |
| git config --global commit.gpgsign true | |
| git config --global tag.gpgsign true | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@v12 | |
| - name: Update ocm vendor hash | |
| run: nix run .#nixpkgs.nix-update -- --flake --version=skip ocm | |
| - name: Check diff and create action summary | |
| id: check-diff | |
| run: | | |
| diff=$(git diff) | |
| if [[ -z "$diff" ]]; then | |
| echo "Everything is tidy." | |
| exit 0 | |
| fi | |
| cat << EOF >> "${GITHUB_STEP_SUMMARY}" | |
| \`\`\`diff | |
| ${diff} | |
| \`\`\` | |
| EOF | |
| cat << EOF >> body | |
| This PR updates the vendorHash in flake.nix. | |
| \`\`\`bash | |
| nix run .#nixpkgs.nix-update -- --flake --version=skip ocm | |
| \`\`\` | |
| \`\`\`diff | |
| ${diff} | |
| \`\`\` | |
| EOF | |
| echo "body=$(realpath body)" >> "$GITHUB_OUTPUT" | |
| - name: Commit | |
| run: | | |
| diff=$(git diff) | |
| if [[ ! -z "$diff" ]]; then | |
| git add flake.* | |
| git commit -S -m "update vendorHash" | |
| fi | |
| - name: Create pull request | |
| id: create_pull_request | |
| uses: peter-evans/create-pull-request@v6 | |
| with: | |
| token: ${{ steps.generate_token.outputs.token }} | |
| title: Update vendorHash in flake.nix | |
| body-path: ${{ steps.check-diff.outputs.body }} | |
| branch: nix/flake | |
| committer: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com> | |
| author: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com> | |
| team-reviewers: ocm-dev | |
| add-paths: | | |
| flake.nix | |
| flake.lock | |
| - name: Enable pull request auto merge | |
| if: ${{ steps.create_pull_request.outputs.pull-request-number }} | |
| uses: peter-evans/enable-pull-request-automerge@v3 | |
| with: | |
| token: ${{ steps.generate_token.outputs.token }} | |
| pull-request-number: ${{ steps.create_pull_request.outputs.pull-request-number }} | |
| merge-method: squash | |
| - name: Cleanup | |
| if: always() | |
| run: | | |
| rm -rf gpg-wrapper |