update-flake-lock.yml

name: Update flake.lock
on:
  workflow_dispatch: # allows manual triggering
  schedule:
    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00

# WARNING:
# When extending this action, be aware that $GITHUB_TOKEN allows write access to
# the GitHub repository. This means that it should not evaluate user input in a
# way that allows code injection.

permissions:
  contents: read

jobs:
  lockfile:
    if: "github.repository_owner == 'epics-extensions'"
    strategy:
      matrix:
        branch:
          - master
          - nixos-24.05
          - nixos-23.11
          - nixos-23.05
    permissions:
      contents: write # to create branch
      pull-requests: write # to create PR to backport
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ matrix.branch }}
          persist-credentials: false
      - uses: cachix/install-nix-action@3715ab1a11cac9e991980d7b4a28d80c7ebdd8f9 # v27
      - uses: DeterminateSystems/update-flake-lock@a2bbe0274e3a0c4194390a1e445f734c597ebc37 # v24
        with:
          branch: "update-flake-lock/${{ matrix.branch }}"
          pr-title: "[${{ matrix.branch }}] Update flake.lock"
          pr-labels: |
            dependencies