Skip to content

Commit f4eaa78

Browse files
charliie-devcharliie-dev
committed
perf(ci): make bot commit verified and add dependabot for ci component autoupdate
1 parent b489175 commit f4eaa78

File tree

3 files changed

+203
-33
lines changed

3 files changed

+203
-33
lines changed

‎.github/dependabot.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Please see the documentation for all configuration options:
2+
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
3+
4+
version: 2
5+
updates:
6+
- package-ecosystem: "github-actions"
7+
#NOTE: no need to specify `/.github/workflows` for `directory`. use `directory: "/"`
8+
directory: "/"
9+
schedule:
10+
interval: "weekly"
11+
time: "07:00"
12+
target-branch: "main"
13+
commit-message:
14+
prefix: "chore(ci.deps)"
15+
groups:
16+
actions-dependencies:
17+
patterns:
18+
- "*"
19+
labels:
20+
- "ci"

‎.github/workflows/update_flake.yml‎

Lines changed: 89 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,100 @@
1-
name: update flake.lock
1+
---
2+
name: "Flake.lock: update Nix dependencies (Verified)"
23
on:
3-
# Scheduled update (1st of every month)
4-
schedule: [{ cron: "30 02 1 * *" }]
4+
schedule:
5+
- cron: 30 02 1 * * # 1st of every month
6+
7+
env:
8+
BRANCH: "main"
9+
COMMIT_MESSAGE: "chore(lockfile): auto update flake.lock"
510

611
jobs:
7-
update-lockfile:
12+
nix-flake-update:
813
if: github.repository_owner == 'ayamir'
9-
runs-on: ubuntu-latest
1014
permissions:
1115
contents: write
16+
id-token: write
17+
runs-on: ubuntu-latest
18+
1219
steps:
13-
- uses: actions/checkout@v5
14-
- uses: cachix/install-nix-action@v26
20+
- name: Checkout repository
21+
uses: actions/checkout@v5
22+
23+
- name: Install Nix
24+
uses: DeterminateSystems/determinate-nix-action@v3
25+
26+
- name: Check Nix flake inputs
27+
uses: DeterminateSystems/flake-checker-action@v12
1528
with:
16-
nix_path: nixpkgs=channel:nixos-unstable
17-
- name: Run flake-update
29+
ignore-missing-flake-lock: false
30+
fail-mode: true
31+
32+
- name: Update flake.lock
1833
run: |
1934
nix flake update
20-
- uses: stefanzweifel/git-auto-commit-action@v5
35+
36+
- name: Detect modified files
37+
id: diff
38+
shell: bash
39+
run: |
40+
set -euo pipefail
41+
# List modified (tracked) files relative to HEAD.
42+
# If you only want specific patterns, add a grep here (e.g., grep -E '(^|/)flake\.lock$').
43+
mapfile -t changed < <(git ls-files -m --full-name)
44+
45+
if [ "${#changed[@]}" -eq 0 ]; then
46+
echo "changed=false" >> "$GITHUB_OUTPUT"
47+
echo "changed_files=" >> "$GITHUB_OUTPUT"
48+
exit 0
49+
fi
50+
51+
# Join into a comma-separated string for downstream steps.
52+
IFS=',' read -r -a _ <<< ""
53+
changed_csv="$(printf "%s," "${changed[@]}")"
54+
changed_csv="${changed_csv%,}"
55+
56+
echo "Changed files:"
57+
printf ' - %s\n' "${changed[@]}"
58+
59+
echo "changed=true" >> "$GITHUB_OUTPUT"
60+
echo "changed_files=${changed_csv}" >> "$GITHUB_OUTPUT"
61+
62+
- name: Commit via REST Contents API (server-signed ??Verified)
63+
if: steps.diff.outputs.changed == 'true'
64+
uses: actions/github-script@v8
65+
env:
66+
CHANGED_FILES: ${{ steps.diff.outputs.changed_files }}
2167
with:
22-
commit_message: "chore(lockfile): auto update flake.lock"
23-
commit_user_name: "github-actions[bot]"
24-
commit_user_email: "41898282+github-actions[bot]@users.noreply.github.com"
25-
commit_author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
26-
file_pattern: "flake.lock"
68+
script: |
69+
const fs = require('fs');
70+
const owner = context.repo.owner;
71+
const repo = context.repo.repo;
72+
const branch = process.env.BRANCH;
73+
const message = process.env.COMMIT_MESSAGE;
74+
75+
const files = (process.env.CHANGED_FILES || '')
76+
.split(',')
77+
.map(s => s.trim())
78+
.filter(Boolean);
79+
80+
for (const path of files) {
81+
const content = fs.readFileSync(path, { encoding: 'base64' });
82+
83+
// Get existing sha if the file already exists
84+
let sha;
85+
try {
86+
const res = await github.rest.repos.getContent({ owner, repo, path, ref: branch });
87+
if (!Array.isArray(res.data)) sha = res.data.sha;
88+
} catch (e) {
89+
if (e.status !== 404) throw e;
90+
}
91+
92+
// NOTE: author/committer intentionally omitted to allow platform signing
93+
const r = await github.rest.repos.createOrUpdateFileContents({
94+
owner, repo, path, branch,
95+
message,
96+
content,
97+
sha
98+
});
99+
core.info(`Committed ${path}: ${r.data.commit.sha}`);
100+
}

‎.github/workflows/update_lockfile.yml‎

Lines changed: 94 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,117 @@
1-
name: update lockfile
1+
---
2+
name: "lazy-lock: update lazy.nvim dependencies (Verified)"
23
on:
3-
# Scheduled update (each day)
4-
schedule: [{ cron: "30 01 * * *" }]
4+
workflow_dispatch: # allows manual triggering
5+
schedule:
6+
# Scheduled update (each day)
7+
- cron: 30 01 * * *
8+
9+
env:
10+
BRANCH: "main"
11+
COMMIT_MESSAGE: "chore(lockfile): auto update lazy-lock.json"
512

613
jobs:
714
update-lockfile:
815
if: github.repository_owner == 'ayamir'
9-
runs-on: ubuntu-latest
1016
permissions:
1117
contents: write
18+
id-token: write
19+
runs-on: ubuntu-latest
20+
1221
steps:
13-
- uses: actions/checkout@v5
22+
- name: Checkout repository
23+
uses: actions/checkout@v5
1424
with:
1525
fetch-depth: 0 # Required to count the commits
16-
- uses: andstor/file-existence-action@v3
26+
27+
- name: Check if lockfile existed
28+
uses: andstor/file-existence-action@v3
1729
id: check_lockfile
1830
with:
1931
files: "lazy-lock.json"
32+
2033
- name: Run count-new-commits
34+
id: new-commits
2135
run: |
22-
echo "NEW_COMMIT_COUNT=$(git log --oneline --since '24 hours ago' --perl-regexp --author='^((?!github-actions).*)$' | wc -l)" >> "$GITHUB_ENV"
23-
- uses: rhysd/action-setup-vim@v1
24-
if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && env.NEW_COMMIT_COUNT > 0 }}
36+
echo "new_commit_count=$(git log --oneline --since '24 hours ago' --perl-regexp --author='^((?!github-actions).*)$' | wc -l)" >> "$GITHUB_OUTPUT"
37+
38+
- name: Setup neovim
39+
uses: rhysd/action-setup-vim@v1
40+
if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && steps.new-commits.outputs.new_commit_count > 0 }}
2541
with:
2642
neovim: true
27-
- name: Run lockfile-autoupdate
28-
if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && env.NEW_COMMIT_COUNT > 0 }}
43+
44+
- name: Run lazy update
45+
if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && steps.new-commits.outputs.new_commit_count > 0 }}
2946
timeout-minutes: 5
3047
run: |
3148
./scripts/install.sh
3249
nvim --headless "+Lazy! update" +qa
3350
cp -pv "${HOME}/.config/nvim/lazy-lock.json" .
34-
- uses: stefanzweifel/git-auto-commit-action@v6
35-
if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && env.NEW_COMMIT_COUNT > 0 }}
51+
52+
- name: Detect modified files
53+
if: ${{ steps.check_lockfile.outputs.files_exists == 'true' && steps.new-commits.outputs.new_commit_count > 0 }}
54+
id: diff
55+
shell: bash
56+
run: |
57+
set -euo pipefail
58+
# List modified (tracked) files relative to HEAD.
59+
# If you only want specific patterns, add a grep here (e.g., grep -E '(^|/)lazy-lock\.json$').
60+
mapfile -t changed < <(git ls-files -m --full-name)
61+
62+
if [ "${#changed[@]}" -eq 0 ]; then
63+
echo "changed=false" >> "$GITHUB_OUTPUT"
64+
echo "changed_files=" >> "$GITHUB_OUTPUT"
65+
exit 0
66+
fi
67+
68+
# Join into a comma-separated string for downstream steps.
69+
IFS=',' read -r -a _ <<< ""
70+
changed_csv="$(printf "%s," "${changed[@]}")"
71+
changed_csv="${changed_csv%,}"
72+
73+
echo "Changed files:"
74+
printf ' - %s\n' "${changed[@]}"
75+
76+
echo "changed=true" >> "$GITHUB_OUTPUT"
77+
echo "changed_files=${changed_csv}" >> "$GITHUB_OUTPUT"
78+
79+
- name: Commit via REST Contents API (server-signed ??Verified)
80+
if: ${{ steps.diff.outputs.changed == 'true' && steps.new-commits.outputs.new_commit_count > 0 }}
81+
uses: actions/github-script@v8
82+
env:
83+
CHANGED_FILES: ${{ steps.diff.outputs.changed_files }}
3684
with:
37-
commit_message: "chore(lockfile): auto update lazy-lock.json"
38-
commit_user_name: "github-actions[bot]"
39-
commit_user_email: "41898282+github-actions[bot]@users.noreply.github.com"
40-
commit_author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
41-
file_pattern: "lazy-lock.json"
85+
script: |
86+
const fs = require('fs');
87+
const owner = context.repo.owner;
88+
const repo = context.repo.repo;
89+
const branch = process.env.BRANCH;
90+
const message = process.env.COMMIT_MESSAGE;
91+
92+
const files = (process.env.CHANGED_FILES || '')
93+
.split(',')
94+
.map(s => s.trim())
95+
.filter(Boolean);
96+
97+
for (const path of files) {
98+
const content = fs.readFileSync(path, { encoding: 'base64' });
99+
100+
// Get existing sha if the file already exists
101+
let sha;
102+
try {
103+
const res = await github.rest.repos.getContent({ owner, repo, path, ref: branch });
104+
if (!Array.isArray(res.data)) sha = res.data.sha;
105+
} catch (e) {
106+
if (e.status !== 404) throw e;
107+
}
108+
109+
// NOTE: author/committer intentionally omitted to allow platform signing
110+
const r = await github.rest.repos.createOrUpdateFileContents({
111+
owner, repo, path, branch,
112+
message,
113+
content,
114+
sha
115+
});
116+
core.info(`Committed ${path}: ${r.data.commit.sha}`);
117+
}

0 commit comments

Comments
 (0)