nix-auto-update #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: nix-auto-update | |
| on: | |
| schedule: | |
| - cron: "0 6 */2 * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: ${{ github.workflow }} | |
| cancel-in-progress: true | |
| jobs: | |
| sync-and-update: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| head_sha: ${{ steps.commit.outputs.head_sha }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: nix-auto-updates | |
| fetch-depth: 0 | |
| - name: Setup git committer | |
| run: | | |
| git config user.name "nix-auto-updates[bot]" | |
| git config user.email "nix-auto-updates[bot]@users.noreply.github.com" | |
| - name: Sync with upstream/v2 | |
| run: | | |
| git remote add upstream https://github.com/anomalyco/opencode 2>/dev/null || true | |
| git fetch upstream v2 | |
| git merge upstream/v2 --no-edit --log | |
| echo "HEAD is now at $(git rev-parse --short HEAD)" | |
| - name: Push sync | |
| id: commit | |
| run: | | |
| set -euo pipefail | |
| if git push origin nix-auto-updates 2>&1; then | |
| echo "Pushed to nix-auto-updates" | |
| else | |
| echo "Nothing to push" | |
| fi | |
| echo "head_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" | |
| compute-hash: | |
| needs: sync-and-update | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - system: x86_64-linux | |
| runner: ubuntu-latest | |
| - system: aarch64-linux | |
| runner: ubuntu-24.04-arm | |
| - system: aarch64-darwin | |
| runner: macos-latest | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ needs.sync-and-update.outputs.head_sha }} | |
| - name: Setup Nix | |
| uses: cachix/install-nix-action@v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Configure binary cache | |
| uses: cachix/cachix-action@v17 | |
| with: | |
| name: re-nixpkgs | |
| - name: Compute node_modules hash | |
| id: hash | |
| env: | |
| SYSTEM: ${{ matrix.system }} | |
| run: | | |
| set -euo pipefail | |
| BUILD_LOG=$(mktemp) | |
| trap 'rm -f "$BUILD_LOG"' EXIT | |
| HASH="" | |
| MAX_ATTEMPTS=3 | |
| for ((ATTEMPT = 1; ATTEMPT <= MAX_ATTEMPTS; ATTEMPT++)); do | |
| nix build ".#packages.${SYSTEM}.node_modules_updater" --no-link 2>&1 | tee "$BUILD_LOG" || true | |
| HASH="$(nix run --inputs-from . nixpkgs#gnugrep -- -oP 'got:\s*\Ksha256-[A-Za-z0-9+/=]+' "$BUILD_LOG" | tail -n1 || true)" | |
| [ -n "$HASH" ] && break | |
| if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then | |
| echo "::warning::Attempt ${ATTEMPT}/${MAX_ATTEMPTS} produced no hash for ${SYSTEM}; retrying in $((ATTEMPT * 10))s" | |
| sleep $((ATTEMPT * 10)) | |
| fi | |
| done | |
| if [ -z "$HASH" ]; then | |
| echo "::error::Failed to compute hash for ${SYSTEM} after ${MAX_ATTEMPTS} attempts" | |
| cat "$BUILD_LOG" | |
| exit 1 | |
| fi | |
| echo "$HASH" > hash.txt | |
| echo "Computed hash for ${SYSTEM}: $HASH" | |
| - name: Upload hash | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: hash-${{ matrix.system }} | |
| path: hash.txt | |
| retention-days: 1 | |
| update-and-push: | |
| needs: [sync-and-update, compute-hash] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ needs.sync-and-update.outputs.head_sha }} | |
| - name: Setup git committer | |
| run: | | |
| git config user.name "nix-auto-updates[bot]" | |
| git config user.email "nix-auto-updates[bot]@users.noreply.github.com" | |
| - name: Download hash artifacts | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 | |
| with: | |
| path: hashes | |
| pattern: hash-* | |
| - name: Update hashes.json | |
| run: | | |
| set -euo pipefail | |
| HASH_FILE="nix/hashes.json" | |
| [ -f "$HASH_FILE" ] || echo '{"nodeModules":{}}' > "$HASH_FILE" | |
| for SYSTEM in x86_64-linux aarch64-linux aarch64-darwin; do | |
| FILE="hashes/hash-${SYSTEM}/hash.txt" | |
| if [ -f "$FILE" ]; then | |
| HASH="$(tr -d '[:space:]' < "$FILE")" | |
| echo "${SYSTEM}: ${HASH}" | |
| jq --arg sys "$SYSTEM" --arg h "$HASH" '.nodeModules[$sys] = $h' "$HASH_FILE" > tmp.json | |
| mv tmp.json "$HASH_FILE" | |
| else | |
| echo "::warning::Missing hash for ${SYSTEM}" | |
| fi | |
| done | |
| cat "$HASH_FILE" | |
| - name: Commit and push | |
| run: | | |
| set -euo pipefail | |
| if [ -z "$(git status --short)" ]; then | |
| echo "No changes to commit" | |
| exit 0 | |
| fi | |
| git add nix/hashes.json | |
| git commit -m "chore: update nix node_modules hashes" | |
| git pull --rebase --autostash origin nix-auto-updates | |
| git push origin HEAD:nix-auto-updates |