flake_vendorhash.yaml

name: "Flake.nix vendorHash updater"
on:
  push:
    branches: 
    - main
    paths:
    - go.mod
    - go.sum
  workflow_dispatch:
  workflow_call:

jobs:
  updateVendorHash:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@v2
        with: # OCMBot
          app_id: ${{ secrets.OCMBOT_APP_ID }}
          private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          token: ${{ steps.generate_token.outputs.token }}
      - name: Enable gh-CLI
        uses: actions4gh/setup-gh@v1.0.2
        id: setup-gh
        with:
          token: ${{ steps.generate_token.outputs.token }}
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v12
      - name: Update ocm vendor hash
        run: nix run .#nixpkgs.nix-update -- --flake --version=skip ocm
      - name: Check diff and create action summary
        id: check-diff
        run: |
          diff=$(git diff)
          if [[ -z "$diff" ]]; then
            echo "Everything is tidy."
            exit 0
          fi
          cat << EOF >> "${GITHUB_STEP_SUMMARY}"
          Updates the vendorHash in \`flake.nix\`
          \`\`\`bash
          nix run .#nixpkgs.nix-update -- --flake --version=skip ocm
          \`\`\`
          produced:
          \`\`\`diff
          ${diff}
          \`\`\`
          EOF
      - name: Create Commit
        # https://docs.github.com/de/rest/repos/contents?apiVersion=2022-11-28#create-or-update-file-contents
        run: |
          FILE=flake.nix
          echo "{\"message\":\"auto update vendor hash\",\"content\":\"$(base64 -w0 ${FILE})\",\"sha\":\"$(git rev-parse :${FILE})\"}" > input.json
          gh api -X PUT https://api.github.com/repos/open-component-model/ocm/contents/${FILE} --input input.json