flake-update.yml

name: flake-update

on:
  schedule:
    # Runs at 04:00 UTC daily
    - cron: "0 4 * * *"
  workflow_dispatch:

permissions:
  contents: write        # push branches
  pull-requests: write   # open PRs & enable auto-merge

concurrency:
  group: flake-lock-updater
  cancel-in-progress: false

jobs:
  update-flake-lock:
    runs-on: self-hosted
    steps:
      - name: Checkout (full history for clean diffs)
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Update flake.lock
        run: |
          set -euo pipefail
          nix --version

          # update flake inputs, create a commit with more details in the message
          nix flake update

          # check if commit was made, if nothing changed, bail out early
          if git diff --quiet -- flake.lock; then
            echo "No flake.lock changes." | tee -a "$GITHUB_STEP_SUMMARY"
            echo "have_changes=" >> "$GITHUB_OUTPUT"
          else
            echo "have_changes=true" >> "$GITHUB_OUTPUT"
          fi
        id: update

      - name: Create pull request
        if: steps.update.outputs.have_changes
        id: cpr
        uses: peter-evans/create-pull-request@v8
        with:
          token: ${{ secrets.BOT_GITHUB_TOKEN }}
          commit-message: "flake.lock: Update"
          title: "flake.lock: Update"
          body: |
            Automated `nix flake update`.
            Generated by ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

          branch: flake-lock-update
          delete-branch: true

      - name: Enable auto-merge (rebase)
        if: steps.update.outputs.have_changes
        env:
          GH_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
        run: |
          nix run --inputs-from . nixpkgs#gh -- \
            pr merge -R "${{ github.repository }}" \
            --rebase --auto "${{ steps.cpr.outputs.pull-request-number }}"