update.yaml

name: "Update lock file"
on:
  schedule:
    - cron: "0 */6 * * *"
  workflow_dispatch:
jobs:
  tests:
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout the repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Generate a GitHub App token
        uses: tibdex/github-app-token@v2.1
        id: generate-token
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main

      - name: Setup Git author
        run: |
          git config user.name 'GitHub Actions'
          git config user.email 'noreply@github.com'

      - name: Update lock file
        run: nix flake update --no-registries --commit-lock-file

      - name: Get commit message
        id: commit
        run: |
          delimiter="$(openssl rand -hex 16)"
          echo "message<<${delimiter}" >> "${GITHUB_OUTPUT}"
          git log -1 --pretty=%B | tail +3 | awk -f ./misc/flake-to-markdown.awk >> "${GITHUB_OUTPUT}"
          echo "${delimiter}" >> "${GITHUB_OUTPUT}"

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v6.1.0
        with:
          token: "${{ steps.generate-token.outputs.token }}"
          title: "Automated Flake update"
          body: "${{ steps.commit.outputs.message }}"
          delete-branch: true