ocm/.github/workflows/flake_vendorhash.yaml at main · open-component-model/ocm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: "Flake.nix vendorHash updater"
on:
  workflow_dispatch:
  push:
    branches:
    - main
    paths:
    - go.mod
    - go.sum

jobs:
  updateVendorHash:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Generate token
        id: generate_token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v2
        with: # OCMBot
          app-id: ${{ secrets.OCMBOT_APP_ID }}
          private-key: ${{ secrets.OCMBOT_PRIV_KEY }}
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ steps.generate_token.outputs.token }}
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@c5a866b6ab867e88becbed4467b93592bce69f8a # v21
        with:
          nix-package-url: https://releases.nixos.org/nix/nix-2.31.0/nix-2.31.0-x86_64-linux.tar.xz
      - name: Update flake.lock
        run: nix flake update
      - name: Update ocm vendor hash
        run: nix run .#nixpkgs.nix-update -- --flake --version=skip ocm
      - name: Check diff and create action summary
        id: diff
        run: |
          diff=$(git diff)
          if [[ -z "$diff" ]]; then
            echo "Everything is tidy."
            exit 0
          else
            echo "exists=true" >> "$GITHUB_OUTPUT"
          fi
          cat << EOF >> "${GITHUB_STEP_SUMMARY}"
          Updates the vendorHash in \`flake.nix\`
          \`\`\`bash
          nix run .#nixpkgs.nix-update -- --flake --version=skip ocm
          \`\`\`
          produced:
          \`\`\`diff
          ${diff}
          \`\`\`
          EOF
      - name: Create Pull Request
        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          token: ${{ steps.generate_token.outputs.token }}
          title: "chore: update 'flake.nix'"
          commit-message: "[github-actions] auto update vendor hash"
          branch: nix/flake
          delete-branch: true
          sign-commits: true
          labels: |
            kind/skip-release-notes
            kind/chore
          body: |
            Update OCM CLI vendor hash (see: .github/workflows/flake_vendorhash.yaml)