nix-security-tracker/.github/workflows/bump.yaml at main · NixOS/nix-security-tracker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
name: Weekly npins update

on:
  schedule:
    # run at 00:00 UTC every Monday
    - cron: "0 0 * * 1"
  # allow manual trigger
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write
  actions: write

jobs:
  update-npins:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
      - run: |
          nix-build -A ci
          result/bin/npins update
      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        id: generate-token
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
      - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
        with:
          token: ${{ steps.generate-token.outputs.token }}
          commit-message: "chore: npins update"
          title: "chore: weekly npins update"
          body: |
            Automatic npins update performed by GitHub Actions
          branch: npins-auto-update
          delete-branch: true
          base: main