ci.yml

name: ci
on:
  workflow_call:
  pull_request:
jobs:
  secretlint:
    name: Secretlint
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@v4
      - name: setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: latest
          cache: npm
      - name: npm ci
        run: npm ci
      - name: Run secretlint
        run: npm run lint
  nix-flake:
    name: Nix Flake Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/magic-nix-cache-action@main
      - uses: DeterminateSystems/flake-checker-action@main
      - name: flake check
        run: nix flake check --all-systems
  dependabot:
    runs-on: ubuntu-latest
    needs: [secretlint, nix-flake]
    if: github.actor == 'dependabot[bot]'
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v2
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Merge PR
        run: gh pr merge --auto --merge "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}