fix schedule?

.github/workflows/main.yml

@@ -0,0 +1,18 @@
+name: "build Nix packages"
+on:
+  pull_request:
+  push:
+  schedule:
+  - cron: '53 20 * * *'  # AEST 6:53 am
+  workflow_dispatch:
+jobs:
+  nix:
+    strategy:
+      matrix:
+        pkg: [aslp, bap-aslp, basil, bap-uq-pac]
+    runs-on: ubuntu-latest
+    uses: ./github/workflows/upgrade.yml@main
+    with:
+      pkg: ${{matrix.pkg}}
+    secrets: inherit
+

.github/workflows/nix.yml

@@ -1,18 +1,62 @@
-name: "build Nix packages"
+name: "update and check Nix packages"
 on:
-  pull_request:
-  push:
-  schedule:
-  - cron: '53 20 * * *'  # AEST 6:53 am
-  workflow_dispatch:
+  workflow_call:
+    inputs:
+      pkg: { required: true, type: string }
 jobs:
-  nix:
-    strategy:
-      matrix:
-        pkg: [aslp, bap-aslp, basil, bap-uq-pac]
+  check:
     runs-on: ubuntu-latest
-    uses: ./github/workflows/upgrade.yml@main
-    with:
-      pkg: ${{matrix.pkg}}
-    secrets: inherit
+    steps:
+    - uses: actions/checkout@v3
+    - uses: cachix/install-nix-action@v20
+      with: { nix_path: nixpkgs=channel:nixos-unstable }
+    - uses: cachix/cachix-action@v12
+      with: { name: pac-nix, authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' }
+
+    - run: nix-build ./update-shell.nix
+    - run: |
+        nix-shell ./update-shell.nix --pure \
+          --run './update.py check -A ${{inputs.pkg}}'
+
+  do-upgrade:
+    if: |
+      github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+      && contains('schedule workflow_dispatch', github.event_name)
+    concurrency: do-upgrade  # one package upgrade in-flight at a time
+    runs-on: ubuntu-latest
+    needs: check
+    steps:
+    - uses: actions/checkout@v3
+    - uses: cachix/install-nix-action@v20
+      with: { nix_path: nixpkgs=channel:nixos-unstable }
+    - uses: cachix/cachix-action@v12
+      with: { name: pac-nix, authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' }
+
+    - run: nix-build ./update-shell.nix
+    - run: |
+        git config user.name 'github-actions[bot]'
+        git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+    - run: |
+        nix-shell ./update-shell.nix --pure \
+          --run './update.py do-upgrade -A ${{inputs.pkg}}'
+    - run: git push
+
+  build:
+    runs-on: ubuntu-latest
+    needs: do-upgrade
+    steps:
+    - uses: actions/checkout@v3
+    - uses: cachix/install-nix-action@v20
+      with: { nix_path: nixpkgs=channel:nixos-unstable }
+    - uses: cachix/cachix-action@v12
+      with: { name: pac-nix, authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' }
+
+    - run: nix-build -A ${{inputs.pkg}}
+    - name: nix-build -A ${{inputs.pkg}}.tests -o result-tests
+      run: |
+        if nix-instantiate --eval -A ${{inputs.pkg}}.tests; then
+          nix-build -A ${{inputs.pkg}}.tests -o result-tests
+        fi
+    - run: ls -l
+