mirror of
https://github.com/juanfont/headscale.git
synced 2026-10-01 04:20:53 +09:00
Kristoffer Dalby
99cbba7aff
AGENTS.md says the tool "opens one pull request a day", but the workflow only had workflow_dispatch, so since it merged it has run zero times.
88 lines
3.4 KiB
YAML
88 lines
3.4 KiB
YAML
name: Version Bump
|
|
|
|
# Deliberately not a pull_request workflow. Running on the default branch is
|
|
# what makes the gate cheap: a default-branch job's binary-cache writes are
|
|
# readable by every later pull request job, so the nix checks run here are the
|
|
# same derivations nix-checks.yml then gets as cache hits. See gc.yml for the
|
|
# scoping rule.
|
|
#
|
|
# The schedule only ever fires upstream: the job guard below falls through to
|
|
# the repository check for anything that is not a manual dispatch, and GitHub
|
|
# does not run schedules in forks to begin with.
|
|
on:
|
|
schedule:
|
|
# Early enough that a pull request opened here has its checks done by the
|
|
# time anyone looks, and far from the hours the integration matrix is
|
|
# usually busy.
|
|
- cron: "0 4 * * *"
|
|
workflow_dispatch:
|
|
inputs:
|
|
dry-run:
|
|
description: "Apply and report, but run no final gate and touch no remote"
|
|
type: boolean
|
|
default: false
|
|
areas:
|
|
description: "Comma-separated areas to run (default: all)"
|
|
type: string
|
|
default: ""
|
|
gate:
|
|
description: "Final gate level"
|
|
type: choice
|
|
options: [full, quick, none]
|
|
default: full
|
|
force:
|
|
description: "Open a pull request even if an identical one was closed unmerged"
|
|
type: boolean
|
|
default: false
|
|
|
|
concurrency:
|
|
group: version-bump
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
bump:
|
|
# A manual dispatch is safe anywhere: the job can do nothing without
|
|
# WORKFLOW_SECRET, which a fork only has if its owner deliberately added
|
|
# one. That is what makes the whole thing testable on a fork before it is
|
|
# trusted here. A schedule, when one is added, stays upstream-only.
|
|
if: github.event_name == 'workflow_dispatch' || github.repository == 'juanfont/headscale'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 240
|
|
defaults:
|
|
run:
|
|
shell: nix develop --fallback --command bash -e {0}
|
|
steps:
|
|
# The bot's own token, not GITHUB_TOKEN: pull requests opened by
|
|
# GITHUB_TOKEN do not trigger pull_request workflows, which is exactly how
|
|
# the previous flake.lock bot ended up shipping untested changes.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
token: ${{ secrets.WORKFLOW_SECRET }}
|
|
|
|
- uses: NixOS/nix-installer-action@62c1943b776c509394b550f3f983adc14e9212d6 # main
|
|
- uses: Mic92/hestia@dfed9ced335d28978ba74e513939a10db1f71025 # v3.1.0
|
|
|
|
- name: Configure the committer
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
|
|
# There is no separate lock-update step: the tool rebuilds the branch from
|
|
# the base itself, so anything done before it would be discarded. The
|
|
# devShell above only supplies the Go that runs the tool; the tool
|
|
# re-enters `nix develop` per command, which is how the steps after the
|
|
# lock update see the toolchain that was just locked.
|
|
- name: Bump
|
|
env:
|
|
GH_TOKEN: ${{ secrets.WORKFLOW_SECRET }}
|
|
run: |
|
|
go run ./tools/bump run \
|
|
--gate="${{ inputs.gate || 'full' }}" \
|
|
--areas="${{ inputs.areas }}" \
|
|
--dry-run="${{ inputs.dry-run || false }}" \
|
|
--force="${{ inputs.force || false }}"
|