Update Nix hashes #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update Nix hashes | |
| # Recompute packaging/nix/release-data.json for a published release, on a Nix | |
| # runner — so maintainers without a Linux/Nix machine can update the Nix package. | |
| # Run it from the Actions tab after the GitHub release exists; it opens a PR with | |
| # the bumped version + the three fixed-output hashes, verified by a real build. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Release version without the leading v (e.g. 2.4.0)" | |
| required: true | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| update: | |
| runs-on: ubuntu-latest | |
| env: | |
| # cache.nixos.org intermittently corrupts NAR streams over HTTP/2 (seen as | |
| # "Stream error in the HTTP/2 framing layer" -> zstd corruption). Disable | |
| # HTTP/2 to dodge the bug and retry a few times on transient drops; every | |
| # nix command below also passes --fallback so an unusable substitute builds | |
| # from source instead of failing the run. | |
| NIX_CONFIG: | | |
| http2 = false | |
| download-attempts = 5 | |
| connect-timeout = 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@main | |
| - name: Compute hashes & update release-data.json | |
| env: | |
| V: ${{ inputs.version }} | |
| run: | | |
| set -euo pipefail | |
| DATA=packaging/nix/release-data.json | |
| FAKE="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" | |
| # 1) Source hash — the fetchFromGitHub tree for tag v$V. | |
| SRC_HASH=$(nix run --fallback nixpkgs#nix-prefetch-github -- ZenNotes zennotes --rev "v$V" | jq -r '.hash // .sha256') | |
| echo "hash (source) = $SRC_HASH" | |
| # 2) npmDepsHash — from the tag's root package-lock.json (npm workspaces | |
| # use one root lockfile, which is what buildNpmPackage hashes). | |
| curl -fsSL "https://raw.githubusercontent.com/ZenNotes/zennotes/v$V/package-lock.json" -o /tmp/package-lock.json | |
| NPM_HASH=$(nix run --fallback nixpkgs#prefetch-npm-deps -- /tmp/package-lock.json) | |
| echo "npmDepsHash = $NPM_HASH" | |
| # 2.5) desktopHash — the prebuilt linux-x64 release tarball the desktop | |
| # package fetchurl's (see package-desktop.nix). SRI hash of the asset. | |
| DESKTOP_HASH=$(nix store prefetch-file --json \ | |
| "https://github.com/ZenNotes/zennotes/releases/download/v$V/ZenNotes-$V-linux-x64.tar.gz" | jq -r '.hash') | |
| echo "desktopHash = $DESKTOP_HASH" | |
| # Write version + source + npm + desktop now; leave vendorHash fake so the | |
| # Go build surfaces the real one. | |
| jq --arg v "$V" --arg h "$SRC_HASH" --arg n "$NPM_HASH" --arg d "$DESKTOP_HASH" --arg f "$FAKE" \ | |
| '.version=$v | .hash=$h | .npmDepsHash=$n | .desktopHash=$d | .vendorHash=$f' "$DATA" > "$DATA.tmp" | |
| mv "$DATA.tmp" "$DATA" | |
| # 3) vendorHash — build the server; the Go vendor fixed-output derivation | |
| # reports the real hash as a mismatch against the fake one. | |
| set +e | |
| nix build --fallback .#zennotes-server --no-link 2> build.log | |
| set -e | |
| VENDOR_HASH=$(grep -oE 'got:[[:space:]]+sha256-[A-Za-z0-9+/=]+' build.log \ | |
| | grep -oE 'sha256-[A-Za-z0-9+/=]+' | head -1 || true) | |
| if [ -z "$VENDOR_HASH" ]; then | |
| echo "::error::Could not extract vendorHash from the build output." | |
| cat build.log | |
| exit 1 | |
| fi | |
| echo "vendorHash = $VENDOR_HASH" | |
| jq --arg vh "$VENDOR_HASH" '.vendorHash=$vh' "$DATA" > "$DATA.tmp" | |
| mv "$DATA.tmp" "$DATA" | |
| echo "=== updated release-data.json ===" | |
| cat "$DATA" | |
| - name: Verify the packages build with the new hashes | |
| run: nix build --fallback .#zennotes-desktop .#zennotes-server --no-link --print-build-logs | |
| - name: Open a PR with the update | |
| uses: peter-evans/create-pull-request@v6 | |
| with: | |
| branch: nix/update-v${{ inputs.version }} | |
| add-paths: packaging/nix/release-data.json | |
| commit-message: "packaging(nix): bump to v${{ inputs.version }} + recompute hashes" | |
| title: "packaging(nix): update release-data.json for v${{ inputs.version }}" | |
| body: | | |
| Automated Nix update for **v${{ inputs.version }}** (computed on a CI runner via the **Update Nix hashes** workflow): | |
| - `version` | |
| - `hash` (source) — `nix-prefetch-github` | |
| - `npmDepsHash` — `prefetch-npm-deps` | |
| - `vendorHash` — Go fixed-output build | |
| Verified with `nix build .#zennotes-desktop .#zennotes-server`. |