flake.yml

name: nix flake update
permissions:
  contents: write
  pull-requests: write
on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 1,15 * *" # Every two weeks 1st, and 15th
jobs:
  flake-update:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          # This is a workaround the limitations of GITHUB_TOKEN
          # https://github.com/peter-evans/create-pull-request/blob/eebb6ccce1e609378f84426acf60c49144cf2d3a/docs/concepts-guidelines.md#push-using-ssh-deploy-keys
          ssh-key: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: Install nix
        uses: cachix/install-nix-action@v23
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}

      - name: Update lock file
        run: |
          git config user.name github-actions[bot]
          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
          nix flake update --commit-lock-file

      - name: Test nix build
        run: nix build

      - name: Get commit message
        id: commit
        run: |
          delimiter="$(openssl rand -hex 16)"
          echo "message<<${delimiter}" >> "${GITHUB_OUTPUT}"
          git log -1 --pretty=%B | tail +3 | awk -f ./.github/misc/flake-to-markdown.awk >> "${GITHUB_OUTPUT}"
          echo "${delimiter}" >> "${GITHUB_OUTPUT}"

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v5
        with:
          token: ${{ secrets.PAT }} # needed so that this triggers further flows. not ideal.
          title: "chore(flake): update flake.lock"
          body: "${{ steps.commit.outputs.message }}"
          branch: automated/flake-update
          delete-branch: true
          labels: |
            automated pr
            nix