update.yml

name: update
on:
  # Runs every Saturday at noon
  schedule:
    - cron: "0 12 * * SAT"
  # Allow manual triggering
  workflow_dispatch:
    inputs:

# Allow one concurrent update per branch
concurrency:
  group: "update-${{ github.ref_name }}"
  cancel-in-progress: true

# Allow running workflows, pushing and creating PRs
permissions:
  actions: write
  contents: write
  pull-requests: write

jobs:
  update:
    name: Update the flake inputs
    runs-on: ubuntu-latest
    timeout-minutes: 40

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ssh-key: ${{ secrets.CI_UPDATE_SSH_KEY }}

      - name: Install Nix
        uses: cachix/install-nix-action@v26
        with:
          nix_path: nixpkgs=channel:nixos-unstable
          github_access_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure git
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'

      - name: Update flake.lock
        id: flake_lock
        run: |
          old=$(git show --no-patch --format=%h)
          nix flake update --commit-lock-file
          new=$(git show --no-patch --format=%h)
          if [ "$old" != "$new" ]; then
            echo "body<<EOF" >> "$GITHUB_OUTPUT"
            git show --no-patch --format=%b >> "$GITHUB_OUTPUT"
            echo "EOF" >> "$GITHUB_OUTPUT"
          fi

      - name: Create Pull Request
        id: pr
        uses: peter-evans/create-pull-request@v6
        with:
          add-paths: "!**"
          branch: update/${{ github.ref_name }}
          delete-branch: true
          title: |
            [${{ github.ref_name }}] Update flake.lock
          body: |
            ## Flake lockfile
            ```
            ${{ steps.flake_lock.outputs.body || 'No changes' }}
            ```

      - name: Print summary
        if: ${{ steps.pr.outputs.pull-request-number }}
        run: |
          num="${{ steps.pr.outputs.pull-request-number }}"
          pr_url="${{ steps.pr.outputs.pull-request-url }}"
          pr_branch="${{ steps.pr.outputs.pull-request-branch }}"
          head="${{ steps.pr.outputs.pull-request-head-sha }}"
          operation="${{ steps.pr.outputs.pull-request-operation }}"

          # stdout
          echo "${head:0:6} pushed to ${pr_branch}"
          echo "${pr} was ${operation}."

          # markdown summary
          echo "## ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
          echo >> $GITHUB_STEP_SUMMARY
          echo "\`${head:0:6}\` pushed to \`${pr_branch}\`" >> $GITHUB_STEP_SUMMARY
          echo >> $GITHUB_STEP_SUMMARY
          echo "[#${num}](${pr_url}) was ${operation}." >> $GITHUB_STEP_SUMMARY
          echo >> $GITHUB_STEP_SUMMARY