klaatuandroot
de1ec998e6
- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in shell mode, with options for enable, instanceURL, name, labels, and tokenFile (agenix secret path). - Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with appropriate labels. Agenix secret placeholders left with TODOs. - Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday midnight) that runs nix flake update and opens a PR if flake.lock changed, using GITEA_TOKEN secret for authentication. Closes part of #15 (NixOS shell runners + flake-lock workflow).
58 lines
1.7 KiB
YAML
58 lines
1.7 KiB
YAML
name: Update flake.lock
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 0 * * 0' # Every Sunday at midnight UTC
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
update-flake-lock:
|
|
runs-on: [self-hosted, bare-metal]
|
|
container:
|
|
image: nixos/nix:latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Configure Nix
|
|
run: |
|
|
mkdir -p /etc/nix
|
|
echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
|
|
|
|
- name: Update flake.lock
|
|
run: nix flake update
|
|
|
|
- name: Check for changes
|
|
id: changes
|
|
run: |
|
|
if git diff --quiet flake.lock; then
|
|
echo "changed=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "changed=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Commit and open PR
|
|
if: steps.changes.outputs.changed == 'true'
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
BRANCH="automated/flake-lock-$(date +%Y%m%d)"
|
|
git config user.name "klaatu"
|
|
git config user.email "klaatu@thehellings.com"
|
|
git checkout -b "$BRANCH"
|
|
git add flake.lock
|
|
git commit -m "chore: update flake.lock"
|
|
git push origin "$BRANCH"
|
|
|
|
# Open PR via Gitea API
|
|
curl -s -X POST \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"title\": \"chore: update flake.lock\",
|
|
\"head\": \"${BRANCH}\",
|
|
\"base\": \"main\",
|
|
\"body\": \"Automated weekly flake.lock update.\n\nGenerated by the update-flake-lock workflow.\"
|
|
}" \
|
|
"${GITHUB_SERVER_URL%/}/api/v1/repos/${GITHUB_REPOSITORY}/pulls"
|