fixup! ci: custom update-flake with sign commits

Author: kid

.github/api/createCommitOnBranch.gql

@@ -0,0 +1,23 @@
+mutation (
+  $githubRepository: String!
+  $branchName: String!
+  $expectedHeadOid: GitObjectID!
+  $commitMessage: String!
+  $files: [FileAddition!]!
+) {
+  createCommitOnBranch(
+    input: {
+      branch: {
+        repositoryNameWithOwner: $githubRepository
+        branchName: $branchName
+      }
+      message: { headline: $commitMessage }
+      fileChanges: { additions: $files }
+      expectedHeadOid: $expectedHeadOid
+    }
+  ) {
+    commit {
+      url
+    }
+  }
+}

.github/workflows/update-flake-lock.yaml

@@ -23,24 +23,38 @@ jobs:
         run: nix flake update
 
       - name: Commit changes
+        run: |
+          CHANGED=($(git diff --name-only | xargs))
+          gh api graphql \
+            -F $githubRepository=$GITHUB_REPOSITORY \
+            -F branchName=$BRANCH \
+            -F expectedHeadOid=$(git rev-parse HEAD) \
+            -F commitMessage="chore: update flake.lock" \
+            -F 'query=@.github/api/createCommitOnBranch.gql'
+            $FILES
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          FILE_TO_COMMIT: flake.lock
-          DESTINATION_BRANCH: chore/update-flake-lock
-        run: |
-          export TODAY=$(date -u '+%Y-%m-%d')
-          export MESSAGE="chore: update $FILE_TO_COMMIT for $TODAY"
-          export SHA=$(git rev-parse $DESTINATION_BRANCH:$FILE_TO_COMMIT)
-          export CONTENT=$(base64 -i $FILE_TO_COMMIT)
-          git checkout -b "$DESTINATION_BRANCH"
-          git push -u origin "$DESTINATION_BRANCH"
-          gh api --method PUT /repos/:owner/:repo/contents/$FILE_TO_COMMIT \
-            --field message="$MESSAGE" \
-            --field content="$CONTENT" \
-            --field encoding="base64" \
-            --field branch="$DESTINATION_BRANCH" \
-            --field sha="$SHA"
-          gh pr create --title "Update $FILE_TO_COMMIT" --body "This PR updates $FILE_TO_COMMIT" --head $DESTINATION_BRANCH --base main
+          BRANCH: chore/update-flake-lock
+
+      # - name: Commit changes
+      #   env:
+      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      #     FILE_TO_COMMIT: flake.lock
+      #     DESTINATION_BRANCH: chore/update-flake-lock
+      #   run: |
+      #     export TODAY=$(date -u '+%Y-%m-%d')
+      #     export MESSAGE="chore: update $FILE_TO_COMMIT for $TODAY"
+      #     export SHA=$(git rev-parse $DESTINATION_BRANCH:$FILE_TO_COMMIT)
+      #     export CONTENT=$(base64 -i $FILE_TO_COMMIT)
+      #     git checkout -b "$DESTINATION_BRANCH"
+      #     git push -u origin "$DESTINATION_BRANCH"
+      #     gh api --method PUT /repos/:owner/:repo/contents/$FILE_TO_COMMIT \
+      #       --field message="$MESSAGE" \
+      #       --field content="$CONTENT" \
+      #       --field encoding="base64" \
+      #       --field branch="$DESTINATION_BRANCH" \
+      #       --field sha="$SHA"
+      #     gh pr create --title "Update $FILE_TO_COMMIT" --body "This PR updates $FILE_TO_COMMIT" --head $DESTINATION_BRANCH --base main
 
       # - name: Update flake.lock
       #   uses: DeterminateSystems/update-flake-lock@main