blob: 59af40d2536d7470b2f1899a0085d6c6965cb468 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
name: Weekly Dependency Updates
on:
workflow_dispatch:
schedule:
# 8 PM UTC every Friday
- cron: '0 20 * * 5'
jobs:
update-dependencies:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v7
- name: "Install Nix"
uses: cachix/install-nix-action@v31.11.1
- name: Set up Git
run: |
git config user.name "GitHub Actions Bot"
git config user.email "actions@github.com"
- name: Create branch for updates
run: |
DATE=$(date +%Y-%m-%d)
BRANCH_NAME="update/dependencies-$DATE"
git checkout -b $BRANCH_NAME
echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
- name: Update npins
run: nix run nixpkgs#npins update
# Only update Nixpkgs. mnw might break on update, better to track it manually to avoid
# unexpected breakage.
- name: Update nixpkgs
run: nix flake update nixpkgs
- name: Check for changes
id: check_changes
run: |
if git diff --quiet; then
echo "No changes detected"
echo "changes_detected=false" >> "$GITHUB_OUTPUT"
exit 0
else
echo "Changes detected"
echo "changes_detected=true" >> "$GITHUB_OUTPUT"
fi
# FIXME: Worth adding additional checks for, e.g., fragile plugins
# or modules
# nix build .#checks.<system>.<check-name>
# We'll probably want to handle this with machine tests
- name: Verify changes
if: steps.check_changes.outputs.changes_detected == 'true'
run: |
# Run verification tests to ensure updates don't break anything
nix flake check
- name: Set date variable
run: echo "DATE=$(date +%Y-%m-%d)" >> "$GITHUB_ENV"
- name: Commit and push changes
if: steps.check_changes.outputs.changes_detected == 'true'
run: |
git add .
git commit -m "pins: bump all plugins (${{ env.DATE }})"
git push -u origin $BRANCH_NAME
- name: Create Pull Request
if: steps.check_changes.outputs.changes_detected == 'true'
uses: peter-evans/create-pull-request@v8
with:
branch: ${{ env.BRANCH_NAME }}
base: main
labels: dependencies,automated pr
token: ${{ secrets.GITHUB_TOKEN }}
commit-message: "npins: bump all plugins (${{ env.DATE }})"
title: "Weekly Dependency Updates: ${{ env.DATE }}"
body: |
> [!NOTE]
> This PR was automatically generated by the Weekly Dependency Updates workflow. Please wait
> for all CI steps to complete, and test any major changes personally.
Updates Performed:
- Updated dependencies using `npins update`
- Updated nixpkgs using `nix flake update nixpkgs`
If the verification steps have passed, updates should be safe to merge. For failing CI steps
submit a Pull Request targetting ${{ env.BRANCH_NAME }}
|
