54 lines
2.3 KiB
YAML
54 lines
2.3 KiB
YAML
# # GitLab CI job template for `nix flake update --commit-lock-file`
|
|
#
|
|
# This requires a masked or protected variable `UPDATE_ACCESS_TOKEN` that contains a project access token with at least the scope `api` and `write_repository`.
|
|
# The job is intended to be run from a scheduled pipeline. See https://docs.gitlab.com/ee/ci/pipelines/schedules.html
|
|
#
|
|
# ## Example
|
|
#
|
|
# ```
|
|
# include:
|
|
# - https://gist.github.com/dadada/c9184fef6dc7b66c8e94ecf65783ce43/raw
|
|
# nix-flake-update:
|
|
# variables:
|
|
# # The name of the branch that will have the updates.
|
|
# BRANCH: update-flake-inputs
|
|
# NOTIFY_USERS: "@admin"
|
|
# stage: update
|
|
# extends: .nix-flake-update
|
|
# ```
|
|
|
|
.nix-flake-update:
|
|
# NixOS Docker image
|
|
image: nixos/nix
|
|
script:
|
|
nix flake update --commit-lock-file
|
|
before_script:
|
|
# Enable support for flakes.
|
|
- echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
|
|
# Use the vendored nixpkgs version.
|
|
- nix registry add nixpkgs path:$(readlink -f ${NIX_PATH%%:*}/nixpkgs)
|
|
# Install jq for processing MR.
|
|
- nix profile install nixpkgs#jq nixpkgs#gnused
|
|
# Set up git.
|
|
- git config user.email "noreply@${CI_SERVER_HOST}"
|
|
- git config user.name "Update Flakes"
|
|
- git remote remove gitlab_origin || true
|
|
- git remote add gitlab_origin "https://oauth2:${UPDATE_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
|
|
- git fetch gitlab_origin main
|
|
after_script:
|
|
- |
|
|
if git diff --exit-code HEAD gitlab_origin/main
|
|
then
|
|
exit
|
|
fi
|
|
# Upload changes to merge request.
|
|
git push -f gitlab_origin HEAD:refs/heads/${BRANCH}
|
|
PROJECT_PATH="$(sed 's/\//%2F/g' <<< $CI_PROJECT_PATH)"
|
|
MR_ID=$(curl --silent --header "PRIVATE-TOKEN: ${UPDATE_ACCESS_TOKEN}" "${CI_API_V4_URL}/projects/${PROJECT_PATH}/merge_requests?source_branch=${BRANCH}&state=opened" | jq '.[0].id')
|
|
if [ "$MR_ID" = "null" ]
|
|
then
|
|
curl --fail --json "{\"source_branch\": \"$BRANCH\", \"target_branch\": \"main\", \"title\": \"Update inputs\", \"should_remove_source_branch\": true, \"description\": \"$NOTIFY_USERS\"}" --header "PRIVATE-TOKEN: ${UPDATE_ACCESS_TOKEN}" "${CI_API_V4_URL}/projects/${PROJECT_PATH}/merge_requests"
|
|
fi
|
|
rules:
|
|
# Only run on scheduled pipelines.
|
|
- if: $CI_PIPELINE_SOURCE == "schedule"
|