cf7d357f17
The docs, option descriptions and comments that named the swarm root, the swarm CA or the hive CA as an existing trust anchor now name the secret store's pki root or the trust bundle that holds it: - docs/swarm/README.md, secrets.md, bao.md - deploy.bao.clientCaFile's and gateway.verifiedProxyTo's descriptions - comments in hive-c0re/src/meta.rs, hive-agent/src/swarm_queue.rs, swarm-logs/src/auth.rs, swarm-controller/src/vcs_metrics.rs, hive-forge, swarm-authelia, swarm-ci-runner, glue-bao-tls, swarm-bao, swarm-grafana, swarm-otel, otel, hive-c0re, lib/hive-ca-trust.nix, hive-forge/Cargo.toml and the flake-update workflow Nothing behaves differently: every edit is a nix, Rust or TOML comment, an option description, or a test assertion message. The Rust edits change the workspace source, which this PR already rebuilds for hivectl. Refs #4588
61 lines
2.4 KiB
YAML
61 lines
2.4 KiB
YAML
name: flake update
|
|
|
|
# Daily `nix flake update`; opens a PR only if the lock changed, never
|
|
# merges (mara does, by hand - branch protection requires it anyway).
|
|
# Separate file from ci.yml/coverage.yml for the same reason coverage.yml
|
|
# is: a workflow_dispatch in ci.yml fires every job there.
|
|
#
|
|
# Plain branch + curl POST (not AGit), mirroring mara's own
|
|
# nixos-configuration:.forgejo/workflows/flake-update.yaml - a daily lock
|
|
# bump never updates an existing PR, so AGit's advantage there doesn't
|
|
# apply. Stale PRs just stack; newest lock wins.
|
|
#
|
|
# `PR_BOT_TOKEN` (repo secret) is the `flake-bot` account's write token.
|
|
# Self-signed forge cert: not worked around with `curl -k` - swarm-ci-runner.nix
|
|
# already sets SSL_CERT_FILE to a bundle with the store's pki root (wiring
|
|
# confirmed; anchor coverage for the swarm forge specifically isn't).
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 3 * * *"
|
|
|
|
jobs:
|
|
update:
|
|
name: nix flake update
|
|
if: vars.PUBLIC_FORGE != 'true'
|
|
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: update and open a PR if the lock changed
|
|
env:
|
|
PR_BOT_TOKEN: ${{ secrets.PR_BOT_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
nix flake update
|
|
|
|
if git diff --quiet -- flake.lock; then
|
|
echo "flake.lock unchanged, nothing to do"
|
|
exit 0
|
|
fi
|
|
|
|
# origin's scheme+host, not a hardcoded forge URL - checkout
|
|
# already resolved an address this runner can reach.
|
|
origin_url="$(git remote get-url origin)"
|
|
scheme="${origin_url%%://*}"
|
|
host="$(printf '%s\n' "$origin_url" | sed -E 's#^[a-z]+://([^/]+)/.*#\1#')"
|
|
|
|
branch="flake-update-$(date +%F)"
|
|
git checkout -b "$branch"
|
|
git -c user.name="flake-bot" \
|
|
-c user.email="git+flake-bot@darkest.space" \
|
|
commit -am "nix flake update"
|
|
git push "${scheme}://flake-bot:${PR_BOT_TOKEN}@${host}/hyperhive/hyperhive.git" "$branch"
|
|
|
|
printf '{"title":"nix flake update","head":"%s","base":"main"}' \
|
|
"$branch" > /tmp/flake-update-pr.json
|
|
curl -sf -X POST \
|
|
-H "Authorization: token ${PR_BOT_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
-d @/tmp/flake-update-pr.json \
|
|
"${scheme}://${host}/api/v1/repos/hyperhive/hyperhive/pulls"
|