flake_vendorhash.yaml

name: "Flake.nix vendorHash updater"
on:
  push:
    branches: 
    - main
    paths:
    - go.mod
    - go.sum
  workflow_dispatch:
  workflow_call:
    
jobs:
  updateVendorHash:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@v2
        with: # OCMBot
          app_id: ${{ secrets.OCMBOT_APP_ID }}
          private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ steps.generate_token.outputs.token }}
          persist-credentials: false
      - name: Enable GPG signing
        run: |         
          echo '#!/bin/bash' > gpg-wrapper
          echo 'gpg --passphrase "'${{ secrets.OCMBOT_SIGNING_KEY_PASS }}'" --yes --batch --pinentry-mode loopback $@ <&0' >> gpg-wrapper
          echo 'exit $?' >> gpg-wrapper
          chmod +x gpg-wrapper
          echo -n "${{ secrets.OCMBOT_SIGNING_KEY }}" | base64 -d | ./gpg-wrapper --import
          git config --global gpg.program "$(realpath gpg-wrapper)"
          git config --global user.name ocmbot[bot]
          git config --global user.email 125909804+ocmbot[bot]@users.noreply.github.com
          git config --global user.signingkey ${{ secrets.OCMBOT_SIGNING_KEY_ID }}
          git config --global commit.gpgsign true
          git config --global tag.gpgsign true
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v12
      - name: Update ocm vendor hash
        run: nix run .#nixpkgs.nix-update -- --flake --version=skip ocm
      - name: Check diff and create action summary
        id: check-diff
        run: |
          diff=$(git diff)
          if [[ -z "$diff" ]]; then
            echo "Everything is tidy."
            exit 0
          fi
          cat << EOF >> "${GITHUB_STEP_SUMMARY}"
          \`\`\`diff
          ${diff}
          \`\`\`
          EOF
          cat << EOF >> body
          This PR updates the vendorHash in flake.nix.
          \`\`\`bash
          nix run .#nixpkgs.nix-update -- --flake --version=skip ocm
          \`\`\`
          \`\`\`diff
          ${diff}
          \`\`\`
          EOF
          echo "body=$(realpath body)" >> "$GITHUB_OUTPUT"
      - name: Commit
        run: |
          diff=$(git diff)
          if [[ ! -z "$diff" ]]; then
            git add flake.*
            git commit -S -m "update vendorHash"
          fi
      - name: Create pull request
        id: create_pull_request
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ steps.generate_token.outputs.token }}
          title: Update vendorHash in flake.nix
          body-path: ${{ steps.check-diff.outputs.body }}
          branch: nix/flake
          committer: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
          author: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
          team-reviewers: ocm-dev
          add-paths: |
            flake.nix
            flake.lock
      - name: Enable pull request auto merge
        if: ${{ steps.create_pull_request.outputs.pull-request-number }}
        uses: peter-evans/enable-pull-request-automerge@v3
        with:
          token: ${{ steps.generate_token.outputs.token }}
          pull-request-number: ${{ steps.create_pull_request.outputs.pull-request-number }}
          merge-method: squash
      - name: Cleanup
        if: always()
        run: |
          rm -rf gpg-wrapper