DankMaterialShell/.github/workflows/update-vendor-hash.yml

name: Update Vendor Hash

on:
  workflow_dispatch:
  push:
    paths:
      - "core/go.mod"
      - "core/go.sum"
    branches:
      - master
      - "stable-*"

permissions:
  contents: write

jobs:
  update-vendor-hash:
    runs-on: ubuntu-latest
    steps:
      - name: Create GitHub App token
        id: app_token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ steps.app_token.outputs.token }}

      - name: Install Nix
        uses: cachix/install-nix-action@v31

      - name: Update vendorHash in flake.nix
        run: scripts/update-vendor-hash.sh

      - name: Commit and push vendorHash update
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
        run: |
          set -euo pipefail
          if ! git diff --quiet flake.nix; then
            git config user.name "dux-ci[bot]"
            git config user.email "344434142+dux-ci[bot]@users.noreply.github.com"
            git add flake.nix
            git commit -m "nix: update vendorHash for go.mod changes" || exit 0
            git pull --rebase origin ${{ github.ref_name }}
            git push https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git HEAD:${{ github.ref_name }}
          else
            echo "No changes to flake.nix"
          fi