sync-upstream.yml

---
name: Synchronize upstream inputs
on:
  workflow_dispatch:
    inputs:
      target:
        type: string
        description: flake input to be synced
        options:
          - dotfiles
        required: true

jobs:
  sync-upstream:
    runs-on: ubuntu-latest
    steps:
      - name: Generate GitHub auth token
        # https://github.com/tibdex/github-app-token
        id: generate_token
        uses: tibdex/github-app-token@v2.1.0
        with:
          app_id: ${{ secrets.GH_APP_ID }}
          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - uses: actions/checkout@main
        with:
        #   ref: master
        #   submodules: true
          token: ${{ steps.generate_token.outputs.token }}

      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/magic-nix-cache-action@main
      - uses: DeterminateSystems/flake-checker-action@main

      - name: update flake upstream input
        shell: bash
        run: |
          nix flake lock --update-input ${{ inputs.target }}

      - uses: EndBug/add-and-commit@main
        with:
          add: flake.lock
          commit: --signoff
          message: "chore(flake): update flake.lock to sync input.${{ inputs.target }}"