Auto update packages #723
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Auto update packages" | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "10 3 * * *" | |
| jobs: | |
| build: | |
| name: update | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Prepare Nix Environment | |
| uses: ./.github/prepare-nix | |
| with: | |
| GH_PAT: ${{ secrets.GITHUB_TOKEN }} | |
| ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }} | |
| ATTIC_SERVER: ${{ vars.ATTIC_SERVER }} | |
| ATTIC_CACHE: ${{ vars.ATTIC_CACHE }} | |
| ONLY_NIX: true | |
| - name: Cache Nvfetcher Database | |
| id: cache-nvfetcher | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.local/share/nvfetcher | |
| key: nvfetcher | |
| - name: Flake update | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| nix flake update --commit-lock-file | |
| pushd flake-modules/dev | |
| nix flake update --commit-lock-file | |
| popd | |
| - name: Fetch new versions | |
| run: | | |
| cat > secrets.toml <<EOF | |
| [keys] | |
| github = "${{ secrets.GITHUB_TOKEN }}" | |
| EOF | |
| nix develop -c update-packages | |
| rm -f secrets.toml | |
| - name: copy nixpkgs scripts | |
| run: | | |
| NIXPKGS=$(nix-instantiate --eval -E '<nixpkgs>') | |
| cp -r $NIXPKGS/{ci,shell.nix,maintainers} . | |
| chmod -R +w . | |
| sed -i "s|./../../default.nix|$NIXPKGS|g" maintainers/scripts/update.nix | |
| - name: Update vendor hashes (nix-update) | |
| run: | | |
| export NIXPKGS_ALLOW_UNFREE=1 | |
| old_json=$(git show HEAD:_sources/generated.json 2>/dev/null || echo '{}') | |
| new_json=$(<_sources/generated.json) | |
| changed_sources=$(jq -rn \ | |
| --argjson old "$old_json" \ | |
| --argjson new "$new_json" \ | |
| '$new | keys[] | . as $k | select($old[$k].version != $new[$k].version)') | |
| if [ -z "$changed_sources" ]; then | |
| echo "No nvfetcher source changes detected, skipping nix-update" | |
| exit 0 | |
| fi | |
| echo "Changed sources: $changed_sources" | |
| grep -rl "# nix-update auto" pkgs/by-name | while read -r file; do | |
| pkg_name=$(basename $(dirname "$file")) | |
| if ! echo "$changed_sources" | grep -qx "$pkg_name"; then | |
| echo "Skipping $pkg_name: source not changed by nvfetcher" | |
| continue | |
| fi | |
| extra_args=$(sed -n 's/.*# nix-update auto//p' "$file" | xargs) | |
| echo "Detected auto-update marker for: $pkg_name" | |
| nix shell nixpkgs#nix-update --inputs-from . \ | |
| -c nix-update "$pkg_name" --version=skip $extra_args \ | |
| --update-script-args "--arg include-overlays '[(self: super: (import ./default.nix {}))]'" | |
| done | |
| - name: Commit changes | |
| run: | | |
| git add _sources pkgs/by-name | |
| git diff --staged --quiet || git commit -m "chore: update nvfetcher & vendor hashes" | |
| git push | |
| curl -XPOST https://nur-update.nix-community.org/update?repo=moraxyc |