1name: "Auto update packages"
 2on:
 3  workflow_dispatch:
 4  schedule:
 5    - cron: "13 20 * * *"
 6# See https://forgejo.org/docs/latest/user/api/authorized-integrations/
 7enable-openid-connect: true
 8env:
 9  AUTHORIZED_INTEGRATION_AUDIENCE: "u:302663:cf6d5efd-a70c-4b33-a5af-d9b6eea3b0bd"
10jobs:
11  auto-update:
12    runs-on: nixos-latest
13    steps:
14      - name: Checkout repository
15        uses: actions/checkout@v6
16        with:
17          # Do not persist the (read-only) automatic token; all git operations
18          # authenticate with the Authorized Integration JWT instead.
19          persist-credentials: false
20      - name: Fetch JWT for authorized integration
21        id: jwt
22        env:
23          AUD: u:4:ae3ef453-d9e5-4e8a-be08-e5841f02e319
24        run: |
25          jwt=$(
26            curl --fail \
27              -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
28              "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=$AUD" \
29            | jq -r .value
30          )
31          echo "::add-mask::$jwt"
32          echo "jwt=$jwt" >> "$FORGEJO_OUTPUT"
33      - name: Setup GitHub Token
34        run: |
35          echo "access-tokens = github.com=${{ secrets.NIX_GITHUB_TOKEN }}" >> /etc/nix/nix.conf
36          nixpkgsRev=$(nix-instantiate --eval -E '(builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked.rev' | tr -d '"')
37          echo "NIX_PATH=nixpkgs=https://github.com/NixOS/nixpkgs/archive/${nixpkgsRev}.tar.gz" >> "$FORGEJO_ENV"
38      - name: Update packages and open PRs
39        env:
40          FORGEJO_TOKEN: ${{ steps.jwt.outputs.jwt }}
41        run: |
42          echo "::group::Build nix-shell environment"
43          nix-shell shell.nix --run 'true'
44          echo "::endgroup::"
45          nix-shell shell.nix --run './scripts/update-ci.sh'