ci: add Nix Flake Update GitHub workflow to keep flake inputs updated #520

trueNAHO · 2024-08-22T21:18:56Z

This change requires GitHub workflows to have read and write permissions 1 2.

This PR is stacked on top of the pending patchset #519 ("treewide: add developer shell and pre-commit hooks and simplify GitHub workflows") and should only be merged after it. Although ready for review, this PR will remain in Draft status until patchset "treewide: add developer shell and pre-commit hooks and simplify GitHub workflows" is merged.

NAHO (1):
  ci: add Nix Flake Update GitHub workflow to keep flake inputs updated

 .github/workflows/nix_flake_update.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/nix_flake_update.yml

This change requires GitHub workflows to have read and write permissions [1] [2]. [1]: DeterminateSystems/update-flake-lock#75 [2]: DeterminateSystems/update-flake-lock#88 Link: danth#520

trueNAHO · 2024-09-10T16:55:46Z

From 29d97f487312d3b56c4dd3da40cb43af858a02d4 Mon Sep 17 00:00:00 2001
From: NAHO <[email protected]>
Date: Thu, 22 Aug 2024 23:07:22 +0200
Subject: [PATCH] ci: add Nix Flake Update GitHub workflow to keep flake
 inputs updated

This change requires GitHub workflows to have read and write permissions
[1] [2].

[1]: https://github.com/DeterminateSystems/update-flake-lock/issues/75
[2]: https://github.com/DeterminateSystems/update-flake-lock/issues/88

Link: https://github.com/danth/stylix/pull/520
---
 .github/workflows/nix_flake_update.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/nix_flake_update.yml

diff --git a/.github/workflows/nix_flake_update.yml b/.github/workflows/nix_flake_update.yml
new file mode 100644
index 00000000..74c285d0
--- /dev/null
+++ b/.github/workflows/nix_flake_update.yml
@@ -0,0 +1,26 @@
+---
+name: Nix Flake Update
+
+on:  # yamllint disable-line rule:truthy
+  workflow_dispatch:
+
+  schedule:
+    - cron: "0 0 1 * *"
+
+jobs:
+  nix-flake-update:
+    runs-on: ubuntu-22.04
+
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@v13
+      - uses: DeterminateSystems/magic-nix-cache-action@v6
+
+      - uses: DeterminateSystems/update-flake-lock@v23
+        with:
+          pr-labels: dependencies
+          pr-title: "stylix: update all flake inputs"

Bump dependencies:

magic-nix-cache-action: v6 -> v8
nix-installer-action: v13 -> v14
update-flake-lock: v23 -> v24

This change requires GitHub workflows to have read and write permissions [1] [2]. [1]: DeterminateSystems/update-flake-lock#75 [2]: DeterminateSystems/update-flake-lock#88 Link: danth#520

trueNAHO · 2024-09-11T15:40:03Z

Changelog

v1: `706c8ef`

Bump magic-nix-cache-action GitHub Action: v6 -> v8
Bump nix-installer-action GitHub Action: v13 -> v14
Bump update-flake-lock GitHub Action: v23 -> v24
Rebase on top of commit ef81ad9 ("gnome: move gnome-shell overlay out of gnome scope (gnome: moved gnome-shell overlay outside its gnome packages umbrella #541)") because GitHub does not understand stacked PRs...

v0: `29d97f4`

This change requires GitHub workflows to have read and write permissions [1] [2]. [1]: DeterminateSystems/update-flake-lock#75 [2]: DeterminateSystems/update-flake-lock#88 Link: danth#520

trueNAHO · 2024-11-26T07:11:07Z

Changelog

v2: `4be09d0`

Bump nix-installer-action GitHub Action: v14 -> v16

v1: `706c8ef`

Bump magic-nix-cache-action GitHub Action: v6 -> v8
Bump nix-installer-action GitHub Action: v13 -> v14
Bump update-flake-lock GitHub Action: v23 -> v24
Rebase on top of commit ef81ad9 ("gnome: move gnome-shell overlay out of gnome scope (gnome: moved gnome-shell overlay outside its gnome packages umbrella #541)") because GitHub does not understand stacked PRs...

v0: `29d97f4`

trueNAHO · 2024-11-26T07:19:49Z

This PR is stacked on top of the pending patchset #519 ("treewide: add developer shell and pre-commit hooks and simplify GitHub workflows") and should only be merged after it. Although ready for review, this PR will remain in Draft status until patchset "treewide: add developer shell and pre-commit hooks and simplify GitHub workflows" is merged.

Considering that #519 is taking longer than expected to get merged, we might want to already merge this PR. Consequently, I moved this PR out of draft mode.

danth

We should use the GitHub App from #664 to allow GitHub Actions to run on the created pull request.

This change requires GitHub workflows to have read and write permissions [1] [2]. [1]: DeterminateSystems/update-flake-lock#75 [2]: DeterminateSystems/update-flake-lock#88 Link: danth#520

trueNAHO · 2024-12-18T14:51:19Z

.github/workflows/nix_flake_update.yml

+      - uses: DeterminateSystems/update-flake-lock@v24
+        with:
+          pr-labels: dependencies
+          pr-title: "stylix: update all flake inputs"


We should use the GitHub App from #664 to allow GitHub Actions to run on the created pull request.

-- #520 (review)

Upstream suggests adding an authentication token:

With a Personal Authentication Token

By providing a Personal Authentication Token, the PR will be submitted in a way that bypasses this limitation (GitHub will essentially think it is the owner of the PAT submitting the PR, and not an Action).
You can create a token by visiting https://github.com/settings/tokens and select at least the repo scope. For the new fine-grained tokens, you need to enable read and write access for "Contents" and "Pull Requests" permissions. Then, store this token in your repository secrets (i.e. https://github.com/<USER>/<REPO>/settings/secrets/actions) as GH_TOKEN_FOR_UPDATES and set up your workflow file like the following:

name: update-flake-lock on: workflow_dispatch: # allows manual triggering schedule: - cron: '0 0 * * 1,4' # Run twice a week jobs: lockfile: runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@v4 - name: Install Nix uses: DeterminateSystems/nix-installer-action@v1 - name: Update flake.lock uses: DeterminateSystems/update-flake-lock@vX with: token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}

-- https://github.com/DeterminateSystems/update-flake-lock/blob/0ba11186640dde09ade3e5599aabb2a57f28d8aa/README.md?plain=1#L185-L209

I assume we have to add the following and properly setup secrets.GH_TOKEN_UPDATE_FLAKE_LOCK:

Suggested change

pr-title: "stylix: update all flake inputs"

pr-title: "stylix: update all flake inputs"

token: ${{ secrets.GH_TOKEN_UPDATE_FLAKE_LOCK }}

I believe the app token functions the same as a PAT, except that any actions taken by it use the identity of the app rather than a personal account.

I believe the app token functions the same as a PAT, except that any actions taken by it use the identity of the app rather than a personal account.

Which of the two approaches should we use? I assume following upstream instructions might be more reliable.

I prefer the app approach as otherwise, the flake update pull requests would appear as if I created them myself, which I think is misleading. That might skew the contributors chart as well.

For reference, the app currently has the following permissions on the repository:

trueNAHO changed the title ~~ci: add nix flake update GitHub workflow to keep flake inputs updated~~ ci: add Nix Flake Update GitHub workflow to keep flake inputs updated Aug 22, 2024

trueNAHO force-pushed the ci-add-nix-flake-update-github-workflow-to-keep-flake-inputs-updated branch from 8793f7e to 29d97f4 Compare August 22, 2024 21:19

trueNAHO mentioned this pull request Aug 26, 2024

treewide: update option deprecations #514

Merged

trueNAHO force-pushed the ci-add-nix-flake-update-github-workflow-to-keep-flake-inputs-updated branch from 29d97f4 to 706c8ef Compare September 11, 2024 15:39

ci: add Nix Flake Update GitHub workflow to keep flake inputs updated

4be09d0

This change requires GitHub workflows to have read and write permissions [1] [2]. [1]: DeterminateSystems/update-flake-lock#75 [2]: DeterminateSystems/update-flake-lock#88 Link: danth#520

trueNAHO force-pushed the ci-add-nix-flake-update-github-workflow-to-keep-flake-inputs-updated branch from 706c8ef to 4be09d0 Compare November 26, 2024 07:10

trueNAHO marked this pull request as ready for review November 26, 2024 07:19

trueNAHO requested a review from danth November 26, 2024 07:20

danth requested changes Dec 10, 2024

View reviewed changes

trueNAHO commented Dec 18, 2024

View reviewed changes

trueNAHO mentioned this pull request Dec 31, 2024

treewide: add developer shell and pre-commit hooks and simplify GitHub workflows #519

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add Nix Flake Update GitHub workflow to keep flake inputs updated #520

ci: add Nix Flake Update GitHub workflow to keep flake inputs updated #520

trueNAHO commented Aug 22, 2024 •

edited

Loading

trueNAHO commented Sep 10, 2024 •

edited

Loading

trueNAHO commented Sep 11, 2024

trueNAHO commented Nov 26, 2024

trueNAHO commented Nov 26, 2024

danth left a comment

trueNAHO Dec 18, 2024

danth Dec 30, 2024

trueNAHO Dec 31, 2024 •

edited

Loading

danth Jan 4, 2025

	pr-title: "stylix: update all flake inputs"
	pr-title: "stylix: update all flake inputs"
	token: ${{ secrets.GH_TOKEN_UPDATE_FLAKE_LOCK }}

ci: add Nix Flake Update GitHub workflow to keep flake inputs updated #520

Are you sure you want to change the base?

ci: add Nix Flake Update GitHub workflow to keep flake inputs updated #520

Conversation

trueNAHO commented Aug 22, 2024 • edited Loading

trueNAHO commented Sep 10, 2024 • edited Loading

trueNAHO commented Sep 11, 2024

Changelog

v1: 706c8ef

v0: 29d97f4

trueNAHO commented Nov 26, 2024

Changelog

v2: 4be09d0

v1: 706c8ef

v0: 29d97f4

trueNAHO commented Nov 26, 2024

danth left a comment

Choose a reason for hiding this comment

trueNAHO Dec 18, 2024

Choose a reason for hiding this comment

With a Personal Authentication Token

danth Dec 30, 2024

Choose a reason for hiding this comment

trueNAHO Dec 31, 2024 • edited Loading

Choose a reason for hiding this comment

danth Jan 4, 2025

Choose a reason for hiding this comment

trueNAHO commented Aug 22, 2024 •

edited

Loading

trueNAHO commented Sep 10, 2024 •

edited

Loading

v1: `706c8ef`

v0: `29d97f4`

v2: `4be09d0`

v1: `706c8ef`

v0: `29d97f4`

trueNAHO Dec 31, 2024 •

edited

Loading