nmrs/.github/workflows/nix.yml at master · cachebag/nmrs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
name: Nix Derivation

on:
  pull_request_target:
    branches: [master]
    paths:
      - 'Cargo.lock'
      - 'package.nix'
      - '.github/workflows/nix.yml'

jobs:
  fix-hashes:
    name: Fix Nix Hashes
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Install Nix
        uses: cachix/install-nix-action@v31

      - uses: dtolnay/rust-toolchain@stable

      - name: Install fixsha
        run: cargo install fixsha

      - name: Run fixsha
        run: fixsha

      - name: Push hash fix if needed
        if: github.event.pull_request.head.repo.full_name == github.repository
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if [[ -z $(git status -s package.nix) ]]; then
            echo "No hash changes needed"
            exit 0
          fi

          CONTENT=$(base64 -w 0 package.nix)
          SHA=$(gh api repos/${{ github.repository }}/contents/package.nix \
            --jq '.sha' \
            -H "Accept: application/vnd.github+json" \
            --method GET \
            -f ref=${{ github.event.pull_request.head.ref }})

          gh api repos/${{ github.repository }}/contents/package.nix \
            --method PUT \
            -H "Accept: application/vnd.github+json" \
            -f message="fix(nix): update cargoHash" \
            -f content="$CONTENT" \
            -f sha="$SHA" \
            -f branch=${{ github.event.pull_request.head.ref }}

          echo "Nix hashes updated via API commit"

      - name: Comment on fork PRs
        if: github.event.pull_request.head.repo.full_name != github.repository
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if [[ -z $(git status -s package.nix) ]]; then
            echo "No hash changes needed"
            exit 0
          fi

          NEW_HASH=$(grep 'cargoHash' package.nix | sed 's/.*"\(.*\)".*/\1/')

          gh pr comment ${{ github.event.pull_request.number }} \
            -R ${{ github.repository }} \
            --body "The \`cargoHash\` in \`package.nix\` needs updating. Please update it to:

          \`\`\`nix
          cargoHash = \"$NEW_HASH\";
          \`\`\`"