Skip to content

Commit 8684dd8

Browse files
authored
Merge pull request #603 from onekey-sec/nix-dependency-updater
Nix dependency updater
2 parents 2dcd83b + 4f34636 commit 8684dd8

File tree

18 files changed

+1218
-109
lines changed

18 files changed

+1218
-109
lines changed

.github/workflows/update-nix.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,26 @@ jobs:
2020
- name: Update flake.lock
2121
uses: DeterminateSystems/update-flake-lock@v19
2222
with:
23+
token: ${{ secrets.CREATE_PR_TOKEN }}
2324
pr-title: "Update flake.lock" # Title of PR to be created
2425
pr-labels: | # Labels to be set on the PR
2526
dependencies
2627
automated
28+
29+
update-vendored:
30+
runs-on: ubuntu-latest
31+
steps:
32+
- uses: actions/checkout@v3
33+
- uses: cachix/install-nix-action@v20
34+
with:
35+
nix_path: nixpkgs=channel:nixos-unstable
36+
extra_nix_config: |
37+
access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
38+
- uses: cachix/cachix-action@v12
39+
with:
40+
name: unblob
41+
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
42+
- name: Update vendored package versions
43+
env:
44+
GITHUB_TOKEN: ${{ secrets.CREATE_PR_TOKEN }}
45+
run: .github/workflows/update-vendored-nix-dependencies.py
Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/usr/bin/env nix-shell
2+
#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ PyGithub ])" nvfetcher
3+
# pyright: reportMissingImports=false
4+
import subprocess
5+
from os import environ as env
6+
from pathlib import Path
7+
from tempfile import NamedTemporaryFile
8+
9+
from github import Github
10+
from github.GithubException import GithubException
11+
from github.Repository import Repository
12+
13+
API_TOKEN = env["GITHUB_TOKEN"]
14+
REPOSITORY = env["GITHUB_REPOSITORY"]
15+
BASE_BRANCH = env.get("GITHUB_BASE_BRANCH", "main")
16+
DRY_RUN = bool(env.get("GITHUB_DRY_RUN", False))
17+
18+
USER_NAME = "github-actions[bot]"
19+
USER_EMAIL = "github-actions[bot]@users.noreply.github.com"
20+
21+
22+
def create_pr(
23+
repo: Repository,
24+
pr_branch_name: str,
25+
pr_title: str,
26+
pr_body: str,
27+
):
28+
try:
29+
repo.get_branch(pr_branch_name)
30+
print(f"Branch '{pr_branch_name}' already exist. Skipping update.")
31+
except GithubException as ex:
32+
if ex.status != 404:
33+
raise
34+
else:
35+
return
36+
37+
subprocess.run(["git", "add", "."], check=True)
38+
subprocess.run(
39+
["git", "commit", "-m", f"{pr_title}\n\n{pr_body}"],
40+
check=True,
41+
env={
42+
"GIT_AUTHOR_NAME": USER_NAME,
43+
"GIT_COMMITTER_NAME": USER_NAME,
44+
"GIT_AUTHOR_EMAIL": USER_EMAIL,
45+
"GIT_COMMITTER_EMAIL": USER_EMAIL,
46+
},
47+
)
48+
subprocess.run(["git", "push", "origin", f"+HEAD:{pr_branch_name}"], check=True)
49+
pr = repo.create_pull(
50+
title=pr_title, body=pr_body, head=pr_branch_name, base=BASE_BRANCH
51+
)
52+
pr.add_to_labels("automated", "dependencies")
53+
54+
55+
def update_dependencies():
56+
with NamedTemporaryFile() as log:
57+
subprocess.run(
58+
["nvfetcher", "--build-dir", "nix/_sources", "--changelog", log.name]
59+
)
60+
return Path(log.name).read_text()
61+
62+
63+
def main():
64+
github = Github(API_TOKEN)
65+
66+
repo = github.get_repo(REPOSITORY)
67+
68+
changes = update_dependencies()
69+
if not changes:
70+
print("-- Everything is up-to date")
71+
return
72+
73+
title = "chore(deps): Updating vendored nix dependencies"
74+
75+
body = f"""\
76+
### Changes in dependencies:
77+
78+
{changes}
79+
"""
80+
81+
print(f"-- Creating PR\nTitle: {title}\nBody:\n{body}")
82+
if DRY_RUN:
83+
print("DRY-RUN: NOT creating PR...")
84+
return
85+
86+
pr_branch_name = "refs/heads/update/nix-vendored-dependencies"
87+
create_pr(
88+
repo,
89+
pr_branch_name,
90+
title,
91+
body,
92+
)
93+
94+
95+
if __name__ == "__main__":
96+
main()

.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# See https://pre-commit.com for more information
22
# See https://pre-commit.com/hooks.html for more hooks
3-
exclude: ^tests/integration|\.patch$
3+
exclude: ^tests/integration|\.patch|nix/_sources$
44
repos:
55
- repo: https://github.com/pre-commit/pre-commit-hooks
66
rev: v4.4.0

default.nix

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
let
2+
lock = builtins.fromJSON (builtins.readFile ./flake.lock);
3+
flake-compat = fetchTarball {
4+
url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
5+
sha256 = lock.nodes.flake-compat.locked.narHash;
6+
};
7+
8+
src = ./.;
9+
in
10+
(import flake-compat { inherit src; }).defaultNix.legacyPackages.${builtins.currentSystem}

flake.lock

Lines changed: 19 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

flake.nix

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,12 @@
1515
url = "github:onekey-sec/sasquatch";
1616
inputs.nixpkgs.follows = "nixpkgs";
1717
};
18+
inputs.flake-compat = {
19+
url = "github:edolstra/flake-compat";
20+
flake = false;
21+
};
1822

19-
outputs = { self, nixpkgs, filter, unblob-native, pyperscan, sasquatch }:
23+
outputs = { self, nixpkgs, filter, unblob-native, pyperscan, sasquatch, ... }:
2024
let
2125
# System types to support.
2226
supportedSystems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
@@ -48,9 +52,23 @@
4852
checks = forAllSystems (system: nixpkgsFor.${system}.unblob.tests);
4953

5054
devShells = forAllSystems
51-
(system: {
52-
default = import ./shell.nix { pkgs = nixpkgsFor.${system}; };
53-
});
55+
(system:
56+
with nixpkgsFor.${system}; {
57+
default = mkShell {
58+
packages = [
59+
unblob.runtimeDeps
60+
ruff
61+
pyright
62+
python3Packages.pytest
63+
python3Packages.pytest-cov
64+
poetry
65+
66+
nvfetcher
67+
];
68+
69+
env.LD_LIBRARY_PATH = lib.makeLibraryPath [ file ];
70+
};
71+
});
5472

5573
legacyPackages = forAllSystems (system: nixpkgsFor.${system});
5674
};

nix/_sources/generated.json

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"jefferson": {
3+
"cargoLocks": null,
4+
"date": null,
5+
"extract": null,
6+
"name": "jefferson",
7+
"passthru": null,
8+
"pinned": false,
9+
"src": {
10+
"name": null,
11+
"sha256": "sha256-RHEXbKRQWTyPWIzSRLwW82u/TsDgiL7L5o+cUWgLLk0=",
12+
"type": "url",
13+
"url": "https://pypi.org/packages/source/j/jefferson/jefferson-0.4.4.tar.gz"
14+
},
15+
"version": "0.4.4"
16+
},
17+
"lzallright": {
18+
"cargoLocks": {
19+
"Cargo.lock": [
20+
"./lzallright-v0.2.2/Cargo.lock",
21+
{}
22+
]
23+
},
24+
"date": null,
25+
"extract": null,
26+
"name": "lzallright",
27+
"passthru": null,
28+
"pinned": false,
29+
"src": {
30+
"deepClone": false,
31+
"fetchSubmodules": false,
32+
"leaveDotGit": false,
33+
"name": null,
34+
"owner": "vlaci",
35+
"repo": "lzallright",
36+
"rev": "v0.2.2",
37+
"sha256": "sha256-MOTIUC/G92tB2ZOp3OzgKq3d9zGN6bfv83vXOK3deFI=",
38+
"type": "github"
39+
},
40+
"version": "v0.2.2"
41+
},
42+
"treelib": {
43+
"cargoLocks": null,
44+
"date": null,
45+
"extract": null,
46+
"name": "treelib",
47+
"passthru": null,
48+
"pinned": false,
49+
"src": {
50+
"name": null,
51+
"sha256": "sha256-HL//stK3XMrCfQIAzuBQe2+7Bybgr7n64Bet5dLOh4g=",
52+
"type": "url",
53+
"url": "https://pypi.org/packages/source/t/treelib/treelib-1.6.1.tar.gz"
54+
},
55+
"version": "1.6.1"
56+
},
57+
"ubi_reader": {
58+
"cargoLocks": null,
59+
"date": null,
60+
"extract": null,
61+
"name": "ubi_reader",
62+
"passthru": null,
63+
"pinned": false,
64+
"src": {
65+
"name": null,
66+
"sha256": "sha256-b6Jp8xB6jie35F/oLEea1RF+F8J64AiiQE3/ufwu1mE=",
67+
"type": "url",
68+
"url": "https://pypi.org/packages/source/u/ubi_reader/ubi_reader-0.8.9.tar.gz"
69+
},
70+
"version": "0.8.9"
71+
}
72+
}

nix/_sources/generated.nix

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# This file was generated by nvfetcher, please do not modify it manually.
2+
{ fetchgit, fetchurl, fetchFromGitHub, dockerTools }:
3+
{
4+
jefferson = {
5+
pname = "jefferson";
6+
version = "0.4.4";
7+
src = fetchurl {
8+
url = "https://pypi.org/packages/source/j/jefferson/jefferson-0.4.4.tar.gz";
9+
sha256 = "sha256-RHEXbKRQWTyPWIzSRLwW82u/TsDgiL7L5o+cUWgLLk0=";
10+
};
11+
};
12+
lzallright = {
13+
pname = "lzallright";
14+
version = "v0.2.2";
15+
src = fetchFromGitHub {
16+
owner = "vlaci";
17+
repo = "lzallright";
18+
rev = "v0.2.3";
19+
fetchSubmodules = false;
20+
sha256 = "sha256-MOTIUC/G92tB2ZOp3OzgKq3d9zGN6bfv83vXOK3deFI=";
21+
};
22+
cargoLock."Cargo.lock" = {
23+
lockFile = ./lzallright-v0.2.2/Cargo.lock;
24+
outputHashes = { };
25+
};
26+
};
27+
treelib = {
28+
pname = "treelib";
29+
version = "1.6.1";
30+
src = fetchurl {
31+
url = "https://pypi.org/packages/source/t/treelib/treelib-1.6.1.tar.gz";
32+
sha256 = "sha256-HL//stK3XMrCfQIAzuBQe2+7Bybgr7n64Bet5dLOh4g=";
33+
};
34+
};
35+
ubi_reader = {
36+
pname = "ubi_reader";
37+
version = "0.8.9";
38+
src = fetchurl {
39+
url = "https://pypi.org/packages/source/u/ubi_reader/ubi_reader-0.8.9.tar.gz";
40+
sha256 = "sha256-b6Jp8xB6jie35F/oLEea1RF+F8J64AiiQE3/ufwu1mE=";
41+
};
42+
};
43+
}

0 commit comments

Comments
 (0)