update-flake.yml

name: Update Flake Lock

on:
  workflow_dispatch:
  schedule:
    # Run every Sunday at 00:00 UTC
    - cron: '0 0 * * 0'

permissions:
  contents: write
  pull-requests: write

jobs:
  update:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          nix_path: nixpkgs=channel:nixos-unstable

      - name: Setup Cachix
        uses: cachix/cachix-action@v17
        with:
          name: kiriwalawren
          skipPush: true
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Update flake.lock
        run: nix flake update

      - name: Update non-flake pins
        run: nix develop --command bash -c "./update.sh"

      - name: Create Pull Request
        run: |
          BRANCH="update-flake-lock"
          gh auth status

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git checkout -b "$BRANCH"
          git add --all
          git commit -m "update flake.lock"
          git push origin "$BRANCH"

          gh pr create \
            --title "chore: update flake.lock" \
            --body "Automated flake.lock update." \
            --base main \
            --head "$BRANCH"
        env:
          GH_TOKEN: ${{ secrets.GH_PAT }}