flake_vendorhash.yaml

name: "Flake vendorHash Updater"
on:
  push:
    branches: 
    - main
    paths:
    - 'go.mod'
    - 'go.sum'
  workflow_dispatch:
  workflow_call:
    
jobs:
  updateVendorHash:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@v2
        with:
          app_id: ${{ secrets.OCMBOT_APP_ID }}
          private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ steps.generate_token.outputs.token }}
      - name: Setup git config
        run: |
          git config user.name "GitHub Actions Bot"
          git config user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main
      - name: Update ocm vendor hash
        run: nix run .#nixpkgs.nix-update -- --flake --version=skip ocm
      - name: Check diff
        id: check-diff
        run: |
          diff=$(git diff)
          if [[ -z "$diff" ]]; then
            echo "Everything is tidy."
            exit 0
          fi

          cat << EOF >> "${GITHUB_STEP_SUMMARY}"
          \`\`\`diff
          ${diff}
          \`\`\`
          EOF
          echo "push='true'" >> $GITHUB_ENV
      - name: Push changes
        if: github.event.pull_request.head.repo.fork == false && env.push == 'true'
        run: |
          diff=$(git diff)
          if [[ ! -z "$diff" ]]; then
            git config --global user.name "ocm-vendorhash"
            git config --global user.email "ocm-vendorhash@users.noreply.github.com"
            git commit -am "flake: update ocm vendorHash"
            git push
          fi