Skip to content

Commit 199bcc4

Browse files
zimegzimeg
authored
ci: keep dependencies up to date using latest versions with automation magic (#22)
1 parent 8d67773 commit 199bcc4

File tree

2 files changed

+151
-0
lines changed

2 files changed

+151
-0
lines changed

‎.github/workflows/dependencies.yml‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
2+
name: Update dependencies
3+
on:
4+
pull_request:
5+
schedule:
6+
- cron: "11 11 * * *"
7+
workflow_dispatch:
8+
jobs:
9+
dependabot:
10+
name: Merge automatic pull requests
11+
if: github.actor == 'dependabot[bot]'
12+
runs-on: ubuntu-latest
13+
timeout-minutes: 12
14+
permissions:
15+
actions: write
16+
contents: write
17+
pull-requests: write
18+
steps:
19+
- name: Collect update metadata
20+
id: metadata
21+
uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
22+
with:
23+
github-token: "${{ secrets.GITHUB_TOKEN }}"
24+
- name: Checkout this repo
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
with:
27+
fetch-depth: "0"
28+
persist-credentials: true
29+
ref: ${{ github.head_ref }}
30+
- name: Configure git credentials
31+
run: |
32+
git config user.name 'github-actions[bot]'
33+
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
34+
- name: Install a flaked Nix
35+
uses: DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3 # v17
36+
- name: Start the tests
37+
run: |
38+
gh api \
39+
--method POST \
40+
-H "Accept: application/vnd.github+json" \
41+
-H "X-GitHub-Api-Version: 2022-11-28" \
42+
"/repos/$REPO/actions/workflows/test.yml/dispatches" \
43+
-f "ref=$REF"
44+
env:
45+
GH_TOKEN: ${{ github.token }}
46+
REF: ${{ github.head_ref }}
47+
REPO: ${{ github.repository }}
48+
- name: Wait for tests to succeed
49+
uses: lewagon/wait-on-check-action@ccfb013c15c8afb7bf2b7c028fb74dc5a068cccc # v1.3.4
50+
with:
51+
allowed-conclusions: success
52+
check-name: "Report"
53+
ref: ${{ github.head_ref }}
54+
repo-token: ${{ secrets.GITHUB_TOKEN }}
55+
wait-interval: 10
56+
- name: Merge requests from the kind dependabot
57+
if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
58+
run: gh pr merge --auto --squash "$PR_URL"
59+
env:
60+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
61+
PR_URL: ${{ github.event.pull_request.html_url }}
62+
- name: Perform more tests
63+
run: |
64+
gh api \
65+
--method POST \
66+
-H "Accept: application/vnd.github+json" \
67+
-H "X-GitHub-Api-Version: 2022-11-28" \
68+
"/repos/$REPO/actions/workflows/test.yml/dispatches" \
69+
-f "ref=main"
70+
env:
71+
GH_TOKEN: ${{ github.token }}
72+
REPO: ${{ github.repository }}
73+
flake:
74+
name: Freeze the latest lockfile
75+
if: github.event_name != 'pull_request'
76+
runs-on: ubuntu-latest
77+
permissions:
78+
actions: write
79+
contents: write
80+
steps:
81+
- name: Checkout this repo
82+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
83+
with:
84+
persist-credentials: true
85+
ref: main
86+
- name: Configure git credentials
87+
run: |
88+
git config user.name 'github-actions[bot]'
89+
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
90+
- name: Install a flaked Nix
91+
uses: DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3 # v17
92+
- name: Checkout an update
93+
run: |
94+
git checkout -b update
95+
- name: Update to the latest
96+
run: |
97+
nix flake update
98+
- name: Check for changes
99+
id: diff
100+
run: |
101+
if ! git diff --quiet; then
102+
echo "changed=true" >> "$GITHUB_OUTPUT"
103+
else
104+
echo "changed=false" >> "$GITHUB_OUTPUT"
105+
fi
106+
- name: Save the flake locks
107+
if: steps.diff.outputs.changed == 'true'
108+
run: |
109+
git commit --all --message "chore(deps): automatic version bump to the most recent packages"
110+
git push -u origin update
111+
- name: Start the tests
112+
if: steps.diff.outputs.changed == 'true'
113+
run: |
114+
gh api \
115+
--method POST \
116+
-H "Accept: application/vnd.github+json" \
117+
-H "X-GitHub-Api-Version: 2022-11-28" \
118+
"/repos/$REPO/actions/workflows/test.yml/dispatches" \
119+
-f "ref=update"
120+
env:
121+
GH_TOKEN: ${{ github.token }}
122+
REPO: ${{ github.repository }}
123+
- name: Wait for tests to succeed
124+
if: steps.diff.outputs.changed == 'true'
125+
uses: lewagon/wait-on-check-action@ccfb013c15c8afb7bf2b7c028fb74dc5a068cccc # v1.3.4
126+
with:
127+
allowed-conclusions: success
128+
check-name: "Report"
129+
ref: update
130+
repo-token: ${{ secrets.GITHUB_TOKEN }}
131+
wait-interval: 10
132+
- name: Save changed version
133+
if: steps.diff.outputs.changed == 'true'
134+
run: |
135+
git checkout main
136+
git merge update
137+
git push -u origin main
138+
git push origin --delete update
139+
- name: Confirm the tests
140+
if: steps.diff.outputs.changed == 'true'
141+
run: |
142+
gh api \
143+
--method POST \
144+
-H "Accept: application/vnd.github+json" \
145+
-H "X-GitHub-Api-Version: 2022-11-28" \
146+
"/repos/$REPO/actions/workflows/test.yml/dispatches" \
147+
-f "ref=main"
148+
env:
149+
GH_TOKEN: ${{ github.token }}
150+
REPO: ${{ github.repository }}

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ to [Semantic Versioning][semver].
1010
### Maintenance
1111

1212
- Use minimum sets of permission and pinned external workflow step actions.
13+
- Keep dependencies up to date using latest versions with automation magic.
1314

1415
## [0.2.1] - 2025-05-13
1516

0 commit comments

Comments
 (0)