update reasonix pin #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: update reasonix pin | |
| # Keeps the reasonix version/hash pins in flake.nix on the latest GitHub CLI | |
| # release. Reasonix ships the CLI (vX.Y.Z) and a separate desktop app | |
| # (desktop-vX.Y.Z) frequently, so we check every 2 hours. | |
| # | |
| # Flow: scripts/update-reasonix.sh bumps the pins and validates with | |
| # `nix build .#reasonix`; if something changed we flake-check, smoke-test the | |
| # sandbox, refresh the version badges, then auto-merge a PR (same pattern as | |
| # update-flake.yml). | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 */2 * * *" | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| concurrency: | |
| group: reasonix-update | |
| cancel-in-progress: true | |
| jobs: | |
| update: | |
| runs-on: ubuntu-26.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: DeterminateSystems/nix-installer-action@v22 | |
| with: | |
| extra-conf: | | |
| extra-substituters = https://grigio.github.io/jcode | |
| extra-trusted-public-keys = grigio-jcode:WdqguwKdwOilH+ITvLO98qZy9x5HQ8Cl0xltHtSsUvQ= | |
| - name: configure git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| # Reads the latest vX.Y.Z (CLI) release, rewrites the version and hash | |
| # pins in flake.nix, then verifies with `nix build .#reasonix`. Sets | |
| # outputs.changed so the remaining steps skip when nothing to do. | |
| - name: bump reasonix pin | |
| id: reasonix | |
| run: bash scripts/update-reasonix.sh | |
| - name: validate flake | |
| if: steps.reasonix.outputs.changed == 'true' | |
| run: nix flake check --all-systems | |
| - name: regenerate version badges from the new pin | |
| if: steps.reasonix.outputs.changed == 'true' | |
| run: bash scripts/update-badges.sh | |
| - name: commit flake.nix and badges | |
| if: steps.reasonix.outputs.changed == 'true' | |
| run: | | |
| git add flake.nix badges/ | |
| git diff --cached --quiet || \ | |
| git commit -m "chore: bump reasonix to latest release" | |
| - name: fix Nix daemon and database permissions | |
| if: steps.reasonix.outputs.changed == 'true' | |
| run: | | |
| sudo mkdir -p /nix/var/nix/db | |
| sudo mkdir -p /nix/var/nix/builds | |
| sudo chown -R root:root /nix | |
| sudo chmod 755 /nix | |
| sudo chmod 755 /nix/var | |
| sudo chmod 755 /nix/var/nix | |
| sudo chmod 755 /nix/var/nix/db | |
| sudo systemctl restart nix-daemon || true | |
| - name: install bubblewrap and configure subuids | |
| if: steps.reasonix.outputs.changed == 'true' | |
| run: | | |
| sudo apt-get update && sudo apt-get install -y bubblewrap uidmap | |
| sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 runner | |
| sudo chmod u+s /usr/bin/newuidmap /usr/bin/newgidmap | |
| - name: run sandbox smoke test (reasonix) | |
| if: steps.reasonix.outputs.changed == 'true' | |
| run: ./start-sandbox.sh reasonix --version | |
| - name: push branch | |
| if: steps.reasonix.outputs.changed == 'true' | |
| env: | |
| GIT_TERMINAL_PROMPT: "0" | |
| run: | | |
| git remote set-url origin https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.git | |
| git branch -f auto/update-reasonix | |
| git push origin auto/update-reasonix --force | |
| - name: create PR | |
| id: create-pr | |
| if: steps.reasonix.outputs.changed == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| PR_BODY='Automated reasonix pin update from scripts/update-reasonix.sh. | |
| - Validated with nix build .#reasonix and nix flake check --all-systems. | |
| - Sandbox smoke-tested with start-sandbox.sh reasonix --version. | |
| - Version badges regenerated.' | |
| # Reuse an existing open PR from a previous run instead of stacking | |
| # a second one for the same auto/update-reasonix branch. | |
| PR_URL=$(gh pr list --head auto/update-reasonix --base master --json url --jq '.[0].url' 2>/dev/null || true) | |
| if [ -z "$PR_URL" ]; then | |
| PR_URL=$(gh pr create \ | |
| --base master \ | |
| --head auto/update-reasonix \ | |
| --title "chore: bump reasonix to latest release" \ | |
| --body "$PR_BODY") || true | |
| fi | |
| echo "pr-url=$PR_URL" >> "$GITHUB_OUTPUT" | |
| - name: merge PR | |
| if: steps.create-pr.outputs.pr-url != '' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh pr merge --squash --delete-branch "${{ steps.create-pr.outputs.pr-url }}" \ | |
| --subject "chore: bump reasonix to latest release" || \ | |
| echo "PR not auto-merged (checks pending or conflict); merge manually" |