Update Flake Sources #149
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update Flake Sources | |
| on: | |
| # Trigger after Desktop Release completes (which uploads the tarballs) | |
| workflow_run: | |
| workflows: ["Desktop Release"] | |
| types: [completed] | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version tag (e.g., v0.1.2)' | |
| required: true | |
| type: string | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| update-sources: | |
| runs-on: ubuntu-latest | |
| # Only run if: | |
| # - workflow_dispatch (manual trigger), OR | |
| # - workflow_run completed successfully AND was triggered by a tag push | |
| if: > | |
| github.event_name == 'workflow_dispatch' || | |
| (github.event.workflow_run.conclusion == 'success' && | |
| startsWith(github.event.workflow_run.head_branch, 'v')) | |
| steps: | |
| - name: Generate GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ secrets.BOT_APP_ID }} | |
| private-key: ${{ secrets.BOT_PRIVATE_KEY }} | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 | |
| with: | |
| nix_path: nixpkgs=channel:nixos-unstable | |
| - name: Get version | |
| id: version | |
| run: | | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| VERSION="${{ inputs.version }}" | |
| else | |
| # workflow_run trigger - get tag from the triggering workflow | |
| VERSION="${{ github.event.workflow_run.head_branch }}" | |
| fi | |
| echo "version=${VERSION#v}" >> $GITHUB_OUTPUT | |
| echo "tag=$VERSION" >> $GITHUB_OUTPUT | |
| echo "Using version: $VERSION" | |
| - name: Update desktop-sources.json | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| TAG="${{ steps.version.outputs.tag }}" | |
| # Define platforms and their target triples | |
| # Note: Windows not included (Nix doesn't run on Windows) | |
| declare -A PLATFORMS=( | |
| ["x86_64-linux"]="x86_64-unknown-linux-gnu" | |
| ["x86_64-darwin"]="x86_64-apple-darwin" | |
| ["aarch64-darwin"]="aarch64-apple-darwin" | |
| ) | |
| # Start building JSON | |
| echo "{" > desktop-sources.json.new | |
| echo " \"version\": \"$VERSION\"," >> desktop-sources.json.new | |
| FIRST=true | |
| FOUND_ANY=false | |
| for PLATFORM in "${!PLATFORMS[@]}"; do | |
| TARGET="${PLATFORMS[$PLATFORM]}" | |
| URL="https://github.com/rustledger/rustfava/releases/download/$TAG/rustfava-desktop-$TARGET.tar.gz" | |
| echo "Fetching hash for $PLATFORM ($TARGET)..." | |
| # Check if the file exists | |
| if curl --head --silent --fail "$URL" > /dev/null 2>&1; then | |
| HASH=$(nix-prefetch-url --type sha256 "$URL" 2>/dev/null) | |
| SRI_HASH=$(nix hash to-sri --type sha256 "$HASH") | |
| if [ "$FIRST" = true ]; then | |
| FIRST=false | |
| else | |
| echo "," >> desktop-sources.json.new | |
| fi | |
| echo " \"$PLATFORM\": {" >> desktop-sources.json.new | |
| echo " \"url\": \"$URL\"," >> desktop-sources.json.new | |
| echo " \"hash\": \"$SRI_HASH\"" >> desktop-sources.json.new | |
| echo -n " }" >> desktop-sources.json.new | |
| echo " $PLATFORM: $SRI_HASH" | |
| FOUND_ANY=true | |
| else | |
| echo " $PLATFORM: tarball not found, skipping" | |
| fi | |
| done | |
| echo "" >> desktop-sources.json.new | |
| echo "}" >> desktop-sources.json.new | |
| # Fail if no tarballs were found | |
| if [ "$FOUND_ANY" = false ]; then | |
| echo "ERROR: No desktop tarballs found for $TAG" | |
| echo "This likely means the Desktop Release workflow hasn't uploaded them yet." | |
| exit 1 | |
| fi | |
| # Pretty print with jq | |
| jq '.' desktop-sources.json.new > desktop-sources.json | |
| rm desktop-sources.json.new | |
| echo "Updated desktop-sources.json:" | |
| cat desktop-sources.json | |
| # Use app token so the PR triggers CI workflows automatically | |
| # (GITHUB_TOKEN can't trigger other workflows) | |
| - name: Create Pull Request | |
| uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| base: main | |
| commit-message: "chore: update desktop sources for ${{ steps.version.outputs.tag }}" | |
| title: "chore: update desktop sources for ${{ steps.version.outputs.tag }}" | |
| body: | | |
| Automated update of `desktop-sources.json` for release ${{ steps.version.outputs.tag }}. | |
| This updates the Nix flake to use the new desktop release binaries. | |
| branch: update-desktop-sources-${{ steps.version.outputs.version }} | |
| delete-branch: true |