7c60ea0296
Using a GitHub App is more secure and idiomatic than using a Personal Access Token or SSH Deploy Key. See https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#triggering-further-workflow-runs and https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#authenticating-with-github-app-generated-tokens
24 lines
789 B
YAML
24 lines
789 B
YAML
name: Update flake inputs
|
|
on:
|
|
schedule:
|
|
# Update every Sunday and Wednesday
|
|
- cron: "51 3 * * 0,3"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
update:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name != 'schedule' || github.repository_owner == 'nix-community'
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
- name: Install Nix
|
|
uses: cachix/install-nix-action@v31
|
|
- name: Update flake.lock
|
|
uses: DeterminateSystems/update-flake-lock@v25
|
|
with:
|
|
# NOTE: this uses the GH_TOKEN_FOR_UPDATES because pushing a flake
|
|
# update PR using GITHUB_TOKEN does not trigger CI.
|
|
# TODO: consider switching to a GitHub App
|
|
token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
|
|
pr-labels: dependencies
|