mirror of
https://github.com/LGUG2Z/komorebi.git
synced 2026-11-14 12:53:43 +01:00
LGUG2Z
166e5f353a
The write token goes to cachix-action on a push (master and the temporary komomono trigger, without naming either), a manual run and a schedule; a pull request, a fork and the merge queue only read. The flake-lock update goes through the nix action too, and the nixpkgs canary reads the cache but never pushes (push: "false" replaces cache: "false"). docs(ci): the write rule, the read-only path and a checklist for the first push to komomono.
31 lines
1.1 KiB
YAML
31 lines
1.1 KiB
YAML
# komorebi tracks the tip of nixpkgs-unstable, so the lock moves every week. The pull request runs
|
|
# the ladder of ci.yaml like any other, which is what says whether the new nixpkgs still builds. The
|
|
# lock is updated with the token of the repository: a pull request opened with it does not start
|
|
# other workflows, so close and reopen it (or push to its branch as a person) to run the ladder.
|
|
|
|
name: update-flake-lock
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 3 * * 1" # Every Monday at 03:00 UTC
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
update:
|
|
if: github.repository == 'LGUG2Z/komorebi'
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: ./.github/actions/nix
|
|
with:
|
|
cachix-cache: ${{ vars.CACHIX_CACHE }}
|
|
cachix-auth-token: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
|
- uses: DeterminateSystems/update-flake-lock@v29
|
|
with:
|
|
commit-msg: "chore(deps): flake.lock: Update"
|
|
pr-title: "chore(deps): flake.lock: Update"
|
|
pr-assignees: LGUG2Z
|