nandi.uk
Nix packages for third-party projects that don't ship their own flakes
1name: Update packages
2
3on:
4 schedule:
5 # Mondays 06:17 UTC — off-peak, slightly jittered
6 - cron: "17 6 * * 1"
7 workflow_dispatch:
8 inputs:
9 packages:
10 description: "Space-separated package names (empty = all)"
11 required: false
12 default: ""
13
14permissions:
15 contents: write
16 pull-requests: write
17
18concurrency:
19 group: update-packages
20 cancel-in-progress: false
21
22jobs:
23 update:
24 name: Bump package versions
25 runs-on: ubuntu-latest
26 timeout-minutes: 60
27 steps:
28 - name: Checkout
29 uses: actions/checkout@v4
30
31 - name: Install Nix
32 uses: DeterminateSystems/nix-installer-action@v16
33
34 - name: Magic Nix Cache
35 uses: DeterminateSystems/magic-nix-cache-action@v9
36
37 - name: Setup Node.js
38 uses: actions/setup-node@v4
39 with:
40 node-version: "22"
41
42 - name: Update packages from upstream
43 env:
44 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
45 run: |
46 set -euo pipefail
47 chmod +x scripts/update-packages.sh
48 if [ -n "${{ inputs.packages }}" ]; then
49 # workflow_dispatch with explicit package list
50 # shellcheck disable=SC2086
51 ./scripts/update-packages.sh ${{ inputs.packages }}
52 else
53 ./scripts/update-packages.sh
54 fi
55
56 - name: Create pull request
57 uses: peter-evans/create-pull-request@v7
58 with:
59 token: ${{ secrets.GITHUB_TOKEN }}
60 commit-message: |
61 chore(packages): weekly upstream version bumps
62
63 Automated update from scripts/update-packages.sh
64 title: "chore(packages): weekly upstream version bumps"
65 body: |
66 ## Weekly package update
67
68 This PR was opened by the [Update packages](../actions/workflows/update-packages.yml) workflow.
69
70 It re-checks each `packages/*/upstream.json` source (GitHub tags, etc.),
71 refreshes source hashes / lockfiles / `npmDepsHash`, and verifies
72 `nix build` for each bumped package.
73
74 ### Review checklist
75 - [ ] Diff looks intentional (version + hashes + lockfile only)
76 - [ ] `nix build .#<pkg>` works locally if you want a second check
77 - [ ] Merge when ready — no human edits required unless a package needs a packaging fix
78 base: main
79 branch: chore/update-packages
80 delete-branch: true
81 add-paths: |
82 packages/**