Skip to content

Commit a0fd7c0

Browse files
TakuyaYagam1TakuyaYagam1
committed
fix(ci): harden automated nix updates
1 parent c6b8889 commit a0fd7c0

5 files changed

Lines changed: 123 additions & 6 deletions

File tree

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Dependabot auto-merge
2+
3+
on:
4+
pull_request:
5+
types:
6+
- opened
7+
- reopened
8+
- synchronize
9+
- ready_for_review
10+
11+
permissions:
12+
contents: write
13+
pull-requests: write
14+
15+
jobs:
16+
dependabot:
17+
runs-on: ubuntu-latest
18+
if: github.event.pull_request.user.login == 'dependabot[bot]'
19+
20+
steps:
21+
- name: Dependabot metadata
22+
id: metadata
23+
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a
24+
with:
25+
github-token: ${{ secrets.GITHUB_TOKEN }}
26+
27+
- name: Approve patch and minor updates
28+
continue-on-error: true
29+
if: ${{ !github.event.pull_request.draft && (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor') }}
30+
run: gh pr review --approve "$PR_URL" --body "Auto-approved Dependabot $UPDATE_TYPE update."
31+
env:
32+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
33+
PR_URL: ${{ github.event.pull_request.html_url }}
34+
UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
35+
36+
- name: Merge patch and minor updates
37+
if: ${{ !github.event.pull_request.draft && (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor') }}
38+
run: |
39+
if gh pr merge --squash --delete-branch "$PR_URL"; then
40+
exit 0
41+
fi
42+
gh pr merge --auto --squash --delete-branch "$PR_URL"
43+
env:
44+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
45+
PR_URL: ${{ github.event.pull_request.html_url }}

‎.github/workflows/update-flake.yml‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Update flake inputs
33
on:
44
workflow_dispatch:
55
schedule:
6-
- cron: "0 6 * * 1"
6+
- cron: "0 1 * * *"
77

88
permissions:
99
contents: write
@@ -93,6 +93,7 @@ jobs:
9393
fi
9494
9595
- name: Create pull request
96+
id: cpr
9697
if: steps.check.outputs.modified == 'true'
9798
uses: peter-evans/create-pull-request@v8
9899
with:
@@ -103,6 +104,43 @@ jobs:
103104
add-paths: |
104105
flake.lock
105106
Linux/NixOS/flake.lock
106-
title: "Update flake locks"
107+
title: "chore(nix): update flake locks"
107108
body: |
109+
## What
110+
108111
Updates root and NixOS flake locks after scheduled input refresh.
112+
113+
## Why
114+
115+
Keeps pinned flake inputs current while preserving review through a pull request.
116+
117+
## Testing
118+
119+
- `nix flake check --no-build`
120+
- `nix build --no-link --print-build-logs .#checks.x86_64-linux.shells-module`
121+
- `nix build .#mysetup --print-build-logs`
122+
- `./result/bin/mysetup --help`
123+
- `nix build --no-link --print-build-logs '.#nixosConfigurations.NixOS.config.home-manager.users.user.xdg.configFile."hypr/end4".source'`
124+
- `nix build --no-link --print-build-logs '.#nixosConfigurations.NixOS.config.home-manager.users.user.programs.caelestia.package'`
125+
- `nix build .#mysetup --print-build-logs`
126+
- `./result/bin/mysetup --help`
127+
128+
- name: Approve pull request
129+
continue-on-error: true
130+
if: steps.cpr.outputs.pull-request-number != ''
131+
env:
132+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
133+
PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
134+
run: |
135+
gh pr review "$PR_NUMBER" --approve --body "Auto-approved after scheduled flake update checks passed."
136+
137+
- name: Merge pull request
138+
if: steps.cpr.outputs.pull-request-number != ''
139+
env:
140+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
141+
PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
142+
run: |
143+
if gh pr merge "$PR_NUMBER" --squash --delete-branch; then
144+
exit 0
145+
fi
146+
gh pr merge "$PR_NUMBER" --auto --squash --delete-branch

‎.github/workflows/update-omnirouter.yml‎

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,18 +134,50 @@ jobs:
134134
run: rm -f result result-*
135135

136136
- name: Create pull request
137+
id: cpr
137138
if: steps.compare.outputs.should_update == 'true'
138139
uses: peter-evans/create-pull-request@v8
139140
with:
140-
commit-message: "chore: update omnirouter"
141+
token: ${{ secrets.GITHUB_TOKEN }}
142+
commit-message: "chore(nix): update omnirouter"
141143
branch: "update-omnirouter"
142144
delete-branch: true
143145
add-paths: |
144146
Linux/NixOS/packages/omnirouter.nix
145-
title: "Update OmniRouter to v${{ steps.release.outputs.version }}"
147+
title: "chore(nix): update omnirouter to v${{ steps.release.outputs.version }}"
146148
body: |
149+
## What
150+
147151
Updates local `omnirouter` package to `v${{ steps.release.outputs.version }}`.
148152
149153
Updated hashes:
150154
- source: `${{ steps.src.outputs.hash }}`
151155
- npmDepsHash: `${{ steps.npm.outputs.hash }}`
156+
157+
## Why
158+
159+
Keeps the packaged OmniRouter release current.
160+
161+
## Testing
162+
163+
- `nix build --no-write-lock-file "$FLAKE#omnirouter"`
164+
165+
- name: Approve pull request
166+
continue-on-error: true
167+
if: steps.cpr.outputs.pull-request-number != ''
168+
env:
169+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
170+
PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
171+
run: |
172+
gh pr review "$PR_NUMBER" --approve --body "Auto-approved after scheduled OmniRouter update build passed."
173+
174+
- name: Merge pull request
175+
if: steps.cpr.outputs.pull-request-number != ''
176+
env:
177+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
178+
PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
179+
run: |
180+
if gh pr merge "$PR_NUMBER" --squash --delete-branch; then
181+
exit 0
182+
fi
183+
gh pr merge "$PR_NUMBER" --auto --squash --delete-branch

‎Linux/NixOS/home/home.nix‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,8 +100,8 @@ in
100100
# Caelestia ships its own bar - block any upstream waybar enable.
101101
programs.waybar.enable = lib.mkForce false;
102102

103-
# Silence HM 26.05 warning: keep gtk4 inheriting the gtk theme.
104-
gtk.gtk4.theme = config.gtk.theme;
103+
# Keep GTK4 inheriting the GTK theme unless Stylix defines it explicitly.
104+
gtk.gtk4.theme = lib.mkDefault config.gtk.theme;
105105

106106
# When HM uses the system package set, Stylix must not install package overlays
107107
# inside the HM evaluation as well.

‎Linux/NixOS/packages/omnirouter.nix‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ buildNpmPackage' rec {
5454
NEXT_TELEMETRY_DISABLED = "1";
5555
npm_config_arch = stdenv.hostPlatform.parsed.cpu.name;
5656
SHARP_IGNORE_GLOBAL_LIBVIPS = "0";
57+
# CPU binaries are bundled; skip optional CUDA downloads from NuGet.
58+
ONNXRUNTIME_NODE_INSTALL = "skip";
5759
};
5860

5961
doCheck = false;

0 commit comments

Comments
 (0)