Skip to content

Commit c06f5ec

Browse files
charliie-devcharliie-dev
committed
feat(ci): make bot commit verified
1 parent a8f4c89 commit c06f5ec

File tree

2 files changed

+179
-35
lines changed

2 files changed

+179
-35
lines changed

‎.github/workflows/update_flake.yml‎

Lines changed: 91 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,102 @@
1-
name: update flake.lock
1+
---
2+
name: "Flake.lock: update Nix dependencies (Verified)"
23
on:
34
workflow_dispatch: # allows manual triggering
4-
# Scheduled update (1st of every month)
5-
schedule: [{ cron: "30 02 1 * *" }]
5+
schedule:
6+
- cron: 30 02 1 * * # 1st of every month
7+
8+
env:
9+
BRANCH: "main"
10+
COMMIT_MESSAGE: "chore(lockfile): auto update flake.lock"
11+
# GIT_NAME: "github-actions[bot]"
12+
# GIT_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
613

714
jobs:
8-
update-lockfile:
9-
if: github.repository_owner == 'CharlesChiuGit'
10-
runs-on: ubuntu-latest
15+
nix-flake-update:
1116
permissions:
1217
contents: write
18+
id-token: write
19+
runs-on: ubuntu-latest
20+
1321
steps:
14-
- uses: actions/checkout@v5
15-
with:
16-
fetch-depth: 0 # Required to count the commits
17-
- uses: cachix/install-nix-action@v31
22+
- name: Checkout repository
23+
uses: actions/checkout@v5
24+
25+
- name: Install Nix
26+
uses: DeterminateSystems/determinate-nix-action@v3
27+
28+
- name: Check Nix flake inputs
29+
uses: DeterminateSystems/flake-checker-action@v12
1830
with:
19-
nix_path: nixpkgs=channel:nixos-unstable
20-
- name: Run flake-update
31+
ignore-missing-flake-lock: false
32+
fail-mode: true
33+
34+
- name: Update flake.lock
2135
run: |
2236
nix flake update
23-
- uses: stefanzweifel/git-auto-commit-action@v7
37+
38+
- name: Detect modified files
39+
id: diff
40+
shell: bash
41+
run: |
42+
set -euo pipefail
43+
# List modified (tracked) files relative to HEAD.
44+
# If you only want specific patterns, add a grep here (e.g., grep -E '(^|/)flake\.lock$').
45+
mapfile -t changed < <(git ls-files -m --full-name)
46+
47+
if [ "${#changed[@]}" -eq 0 ]; then
48+
echo "changed=false" >> "$GITHUB_OUTPUT"
49+
echo "changed_files=" >> "$GITHUB_OUTPUT"
50+
exit 0
51+
fi
52+
53+
# Join into a comma-separated string for downstream steps.
54+
IFS=',' read -r -a _ <<< ""
55+
changed_csv="$(printf "%s," "${changed[@]}")"
56+
changed_csv="${changed_csv%,}"
57+
58+
echo "Changed files:"
59+
printf ' - %s\n' "${changed[@]}"
60+
61+
echo "changed=true" >> "$GITHUB_OUTPUT"
62+
echo "changed_files=${changed_csv}" >> "$GITHUB_OUTPUT"
63+
64+
- name: Commit via REST Contents API (server-signed ??Verified)
65+
if: steps.diff.outputs.changed == 'true'
66+
uses: actions/github-script@v8
67+
env:
68+
CHANGED_FILES: ${{ steps.diff.outputs.changed_files }}
2469
with:
25-
commit_message: "chore(lockfile): auto update flake.lock"
26-
commit_user_name: "github-actions[bot]"
27-
commit_user_email: "41898282+github-actions[bot]@users.noreply.github.com"
28-
commit_author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
29-
file_pattern: "flake.lock"
70+
script: |
71+
const fs = require('fs');
72+
const owner = context.repo.owner;
73+
const repo = context.repo.repo;
74+
const branch = process.env.BRANCH;
75+
const message = process.env.COMMIT_MESSAGE;
76+
77+
const files = (process.env.CHANGED_FILES || '')
78+
.split(',')
79+
.map(s => s.trim())
80+
.filter(Boolean);
81+
82+
for (const path of files) {
83+
const content = fs.readFileSync(path, { encoding: 'base64' });
84+
85+
// Get existing sha if the file already exists
86+
let sha;
87+
try {
88+
const res = await github.rest.repos.getContent({ owner, repo, path, ref: branch });
89+
if (!Array.isArray(res.data)) sha = res.data.sha;
90+
} catch (e) {
91+
if (e.status !== 404) throw e;
92+
}
93+
94+
// NOTE: author/committer intentionally omitted to allow platform signing
95+
const r = await github.rest.repos.createOrUpdateFileContents({
96+
owner, repo, path, branch,
97+
message,
98+
content,
99+
sha
100+
});
101+
core.info(`Committed ${path}: ${r.data.commit.sha}`);
102+
}

‎.github/workflows/update_lockfile.yml‎

Lines changed: 88 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,112 @@
1-
name: update lockfile
1+
---
2+
name: "lazy-lock: update lazy.nvim dependencies (Verified)"
23
on:
3-
# workflow_dispatch # manual update
4-
# Scheduled update (07:30 everyday at UTC+8)
5-
schedule: [{ cron: "30 23 * * *" }]
6-
workflow_dispatch:
4+
workflow_dispatch: # allows manual triggering
5+
schedule:
6+
# Scheduled update (07:30 everyday at UTC+8)
7+
- cron: 30 23 * * *
8+
9+
env:
10+
BRANCH: "main"
11+
COMMIT_MESSAGE: "chore(lockfile): auto update flake.lock"
712

813
jobs:
914
update-lockfile:
1015
if: github.repository_owner == 'CharlesChiuGit'
11-
runs-on: ubuntu-latest
1216
permissions:
1317
contents: write
18+
id-token: write
19+
runs-on: ubuntu-latest
20+
1421
steps:
15-
- uses: actions/checkout@v5
22+
- name: Checkout repository
23+
uses: actions/checkout@v5
1624
with:
1725
fetch-depth: 0 # Required to count the commits
18-
- uses: andstor/file-existence-action@v3
26+
27+
- name: Check if lockfile existed
28+
uses: andstor/file-existence-action@v3
1929
id: check_lockfile
2030
with:
2131
files: "lazy-lock.json"
22-
- uses: rhysd/action-setup-vim@v1
32+
33+
- name: Setup neovim
34+
uses: rhysd/action-setup-vim@v1
2335
if: ${{ steps.check_lockfile.outputs.files_exists == 'true' }}
2436
with:
2537
neovim: true
2638
# version: nightly
27-
- name: Run lockfile-autoupdate
39+
40+
- name: Run lazy update
2841
if: ${{ steps.check_lockfile.outputs.files_exists == 'true' }}
2942
timeout-minutes: 5
3043
run: |
3144
./scripts/update_lockfile.sh
3245
nvim --headless "+Lazy! update" +qa
3346
cp -pv "${HOME}/.config/nvim/lazy-lock.json" .
34-
- uses: stefanzweifel/git-auto-commit-action@v7
35-
if: ${{ steps.check_lockfile.outputs.files_exists == 'true' }}
47+
48+
- name: Detect modified files
49+
id: diff
50+
shell: bash
51+
run: |
52+
set -euo pipefail
53+
# List modified (tracked) files relative to HEAD.
54+
# If you only want specific patterns, add a grep here (e.g., grep -E '(^|/)lazy-lock\.json$').
55+
mapfile -t changed < <(git ls-files -m --full-name)
56+
57+
if [ "${#changed[@]}" -eq 0 ]; then
58+
echo "changed=false" >> "$GITHUB_OUTPUT"
59+
echo "changed_files=" >> "$GITHUB_OUTPUT"
60+
exit 0
61+
fi
62+
63+
# Join into a comma-separated string for downstream steps.
64+
IFS=',' read -r -a _ <<< ""
65+
changed_csv="$(printf "%s," "${changed[@]}")"
66+
changed_csv="${changed_csv%,}"
67+
68+
echo "Changed files:"
69+
printf ' - %s\n' "${changed[@]}"
70+
71+
echo "changed=true" >> "$GITHUB_OUTPUT"
72+
echo "changed_files=${changed_csv}" >> "$GITHUB_OUTPUT"
73+
74+
- name: Commit via REST Contents API (server-signed ??Verified)
75+
if: steps.diff.outputs.changed == 'true'
76+
uses: actions/github-script@v8
77+
env:
78+
CHANGED_FILES: ${{ steps.diff.outputs.changed_files }}
3679
with:
37-
commit_message: "chore(lockfile): auto update lazy-lock.json"
38-
commit_user_name: "github-actions[bot]"
39-
commit_user_email: "41898282+github-actions[bot]@users.noreply.github.com"
40-
commit_author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
41-
file_pattern: "lazy-lock.json"
80+
script: |
81+
const fs = require('fs');
82+
const owner = context.repo.owner;
83+
const repo = context.repo.repo;
84+
const branch = process.env.BRANCH;
85+
const message = process.env.COMMIT_MESSAGE;
86+
87+
const files = (process.env.CHANGED_FILES || '')
88+
.split(',')
89+
.map(s => s.trim())
90+
.filter(Boolean);
91+
92+
for (const path of files) {
93+
const content = fs.readFileSync(path, { encoding: 'base64' });
94+
95+
// Get existing sha if the file already exists
96+
let sha;
97+
try {
98+
const res = await github.rest.repos.getContent({ owner, repo, path, ref: branch });
99+
if (!Array.isArray(res.data)) sha = res.data.sha;
100+
} catch (e) {
101+
if (e.status !== 404) throw e;
102+
}
103+
104+
// NOTE: author/committer intentionally omitted to allow platform signing
105+
const r = await github.rest.repos.createOrUpdateFileContents({
106+
owner, repo, path, branch,
107+
message,
108+
content,
109+
sha
110+
});
111+
core.info(`Committed ${path}: ${r.data.commit.sha}`);
112+
}

0 commit comments

Comments
 (0)