flake-update #384

	name: flake-update

	on:
	schedule:
	# Runs at 04:00 UTC daily
	- cron: "0 4 * * *"
	workflow_dispatch:

	permissions:
	contents: write # push branches
	pull-requests: write # open PRs & enable auto-merge

	concurrency:
	group: flake-lock-updater
	cancel-in-progress: false

	jobs:
	update-flake-lock:
	runs-on: self-hosted
	steps:
	- name: Checkout (full history for clean diffs)
	uses: actions/checkout@v6
	with:
	fetch-depth: 0

	- name: Update flake.lock
	run: \|
	set -euo pipefail
	nix --version

	# update flake inputs, create a commit with more details in the message
	nix flake update

	# check if commit was made, if nothing changed, bail out early
	if git diff --quiet -- flake.lock; then
	echo "No flake.lock changes." \| tee -a "$GITHUB_STEP_SUMMARY"
	echo "have_changes=" >> "$GITHUB_OUTPUT"
	else
	echo "have_changes=true" >> "$GITHUB_OUTPUT"
	fi
	id: update

	- name: Create pull request
	if: steps.update.outputs.have_changes
	id: cpr
	uses: peter-evans/create-pull-request@v8
	with:
	token: ${{ secrets.BOT_GITHUB_TOKEN }}
	commit-message: "flake.lock: Update"
	title: "flake.lock: Update"
	body: \|
	Automated `nix flake update`.
	Generated by ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

	branch: flake-lock-update
	delete-branch: true

	- name: Enable auto-merge (rebase)
	if: steps.update.outputs.have_changes
	env:
	GH_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
	run: \|
	nix run --inputs-from . nixpkgs#gh -- \
	pr merge -R "${{ github.repository }}" \
	--rebase --auto "${{ steps.cpr.outputs.pull-request-number }}"

Navigation Menu