Merge pull request #1107 from jbw976/nix-dupe

fix(ci): pin which Nix Renovate's post-upgrade tasks use

Author: jbw976

.github/renovate-entrypoint.sh

@@ -42,6 +42,16 @@ extra-substituters = https://crossplane.cachix.org
 extra-trusted-public-keys = crossplane.cachix.org-1:NJluVUN9TX0rY/zAxHYaT19Y5ik4ELH4uFuxje+62d4=
 EOF
 
-echo "Nix $(nix --version) installed successfully"
+# Renovate installs its own Nix when it updates flake.lock. It goes earlier on
+# PATH than ours and ignores the config above, so all nix commands we run (e.g.
+# postUpgradeTasks) will go through this launcher, which pins both the binary
+# and the config it reads.
+cat > /usr/local/bin/crossplane-nix << 'EOF'
+#!/bin/bash
+exec env NIX_CONF_DIR=/etc/nix /usr/bin/nix "$@"
+EOF
+chmod +x /usr/local/bin/crossplane-nix
+
+echo "Nix $(crossplane-nix --version) installed successfully"
 
 renovate

.github/renovate-nix.json5

@@ -56,8 +56,8 @@
       ],
       postUpgradeTasks: {
         commands: [
-          'nix run .#tidy',
-          'nix run .#generate',
+          'crossplane-nix run .#tidy',
+          'crossplane-nix run .#generate',
         ],
         fileFilters: [
           '**/*',
@@ -77,7 +77,7 @@
       ],
       postUpgradeTasks: {
         commands: [
-          'nix run .#lint',
+          'crossplane-nix run .#lint',
         ],
         fileFilters: [
           '**/*',

.github/workflows/renovate.yml

@@ -51,7 +51,7 @@ jobs:
           # Use GitHub API to create commits
           RENOVATE_PLATFORM_COMMIT: "true"
           LOG_LEVEL: ${{ github.event.inputs.logLevel || env.LOG_LEVEL }}
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^nix .+", "^earthly .+"]'
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^crossplane-nix .+", "^earthly .+"]'
         with:
           configurationFile: .github/renovate.json5
           token: '${{ steps.get-github-app-token.outputs.token }}'