chore: add audit fix #83
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Automated | |
| on: | |
| push: | |
| paths: | |
| - "pnpm-lock.yaml" | |
| - "package.json" | |
| branches: | |
| - "main" | |
| schedule: | |
| - cron: "0 8 * * 0" | |
| workflow_dispatch: | |
| concurrency: | |
| group: automation-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| actions: write | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| nix-pnpm-hash: | |
| name: Update Nix PNPM Hash | |
| if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v6 | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@main | |
| with: | |
| determinate: true | |
| - name: Cache Nix store | |
| uses: DeterminateSystems/magic-nix-cache-action@main | |
| - name: Compute correct PNPM dependencies hash | |
| run: | | |
| CURRENT_HASH=$(grep -oP "hash = \"\K[^\"]*" nix/package.nix) | |
| sed -i "s|hash = \"$CURRENT_HASH\"|hash = \"\"|" nix/package.nix | |
| NEW_HASH=$(nix build .#headplane.pnpmDeps --no-link 2>&1 \ | |
| | grep 'got:' \ | |
| | awk '{print $2}') | |
| if [ -n "$NEW_HASH" ]; then | |
| sed -i "s|hash = \"\"|hash = \"$NEW_HASH\"|" nix/package.nix | |
| else | |
| git checkout nix/package.nix | |
| fi | |
| - name: Commit and push | |
| run: | | |
| if git diff --quiet nix/package.nix; then | |
| echo "Hash is already up to date, skipping" | |
| exit 0 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add nix/package.nix | |
| git commit -m "chore: update nix pnpm deps hash" | |
| git push | |
| flake-inputs: | |
| name: Update Flake Inputs | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v6 | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@main | |
| with: | |
| determinate: true | |
| - name: Update flake.lock | |
| uses: DeterminateSystems/update-flake-lock@main | |
| with: | |
| pr-title: "chore: update flake.lock" | |
| pr-labels: | | |
| automated |