freshlybakedca.ke
Your one-stop-cake-shop for everything Freshly Baked has to offer
ci: translate to tangled
We've been using github CI for a while, let's translate everything to
tangled format so that we can move across!
We need to put our CI in the root of our monorepo as otherwise it won't
run on our tangled spindle...
a.starrysky.fyi
+265
-329
+22
.tangled/workflows/github.yml
+22
.tangled/workflows/github.yml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
when:
6
+
- event: ["push"]
7
+
branch: ["release"]
8
+
9
+
engine: nixery
10
+
11
+
steps:
12
+
- name: Write SSH Key
13
+
command: |
14
+
echo $GITHUB_SSH_KEY > ssh_key
15
+
chmod 600 ssh_key
16
+
- name: Push to GitHub
17
+
command: |
18
+
export GIT_SSH_COMMAND="ssh -i $(realpath ./ssh_key) -o StrictHostKeyChecking=no"
19
+
git remote add github git@github.com:freshlybakedca.ke/Patisserie
20
+
git fetch --unshallow origin
21
+
git fetch github
22
+
git push tangled HEAD
+111
.tangled/workflows/packetmix-build.yml
+111
.tangled/workflows/packetmix-build.yml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
when:
5
+
- event: ["push", "pull_request"]
6
+
branch: ["main"]
7
+
8
+
engine: nixery
9
+
10
+
dependencies:
11
+
nixpkgs:
12
+
- lix
13
+
- gnugrep
14
+
- openssh
15
+
16
+
steps:
17
+
- name: Get remote builds SSH key
18
+
command: |
19
+
echo "$KEY_SSH_REMOTE_BUILD" > /tmp/key-ssh-remote-build
20
+
chmod 600 /tmp/key-ssh-remote-build
21
+
- name: Add base system files
22
+
command: |
23
+
# Let us SSH to midnight by name
24
+
echo "192.168.0.6 midnight" >> /etc/hosts
25
+
26
+
# Avoid missing user with UID 0 error on ssh...
27
+
echo "root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash" >> /etc/passwd
28
+
29
+
# Turn off SSH host key checking
30
+
echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config
31
+
echo "UserKnownHostsFile /dev/null" >> /etc/ssh/ssh_config
32
+
33
+
echo "Host midnight" >> /etc/ssh/ssh_config
34
+
echo " User remoteBuilds" >> /etc/ssh/ssh_config
35
+
echo " IdentityFile /tmp/key-ssh-remote-build" >> /etc/ssh/ssh_config
36
+
37
+
echo "extra-experimental-features = nix-command" >> /etc/nix/nix.conf
38
+
echo "max-jobs = 0" >> /etc/nix/nix.conf
39
+
echo "builders = ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build x86_64-linux" >> /etc/nix/nix.conf
40
+
- name: Evaluate all systems
41
+
command: |
42
+
set +e
43
+
set -o pipefail
44
+
45
+
eval_out=$(nix eval \
46
+
-f ./packetmix/nilla.nix packages.allNixOSSystems.result.x86_64-linux.drvPath \
47
+
--show-trace --raw \
48
+
2>&1 >/tmp/systems-drv-path | tee /dev/stderr)
49
+
eval_status=$?
50
+
51
+
if [ $eval_status -ne 0 ]; then
52
+
echo "Evaluating your configuration failed with exit code $eval_status"
53
+
echo "Please fix this and squash into your existing commits"
54
+
exit $eval_status
55
+
fi
56
+
57
+
eval_warns=$(echo "$eval_out" | grep "evaluation warning:" || true)
58
+
59
+
if [ -n "$eval_warns" ]; then
60
+
echo "There were some warnings while evaluating your systems:"
61
+
echo "$eval_warns"
62
+
echo "Please fix these and squash into your existing commits"
63
+
exit 1
64
+
fi
65
+
- name: Evaluate all homes
66
+
command: |
67
+
set +e
68
+
set -o pipefail
69
+
70
+
eval_out=$(nix eval \
71
+
-f ./packetmix/nilla.nix packages.allHomes.result.x86_64-linux.drvPath \
72
+
--show-trace --raw \
73
+
2>&1 >/tmp/homes-drv-path | tee /dev/stderr)
74
+
eval_status=$?
75
+
76
+
if [ $eval_status -ne 0 ]; then
77
+
echo "Evaluating your configuration failed with exit code $eval_status"
78
+
echo "Please fix this and squash into your existing commits"
79
+
exit $eval_status
80
+
fi
81
+
82
+
eval_warns=$(echo "$eval_out" | grep "evaluation warning:" || true)
83
+
84
+
if [ -n "$eval_warns" ]; then
85
+
echo "There were some warnings while evaluating your homes:"
86
+
echo "$eval_warns"
87
+
echo "Please fix these and squash into your existing commits"
88
+
exit 1
89
+
fi
90
+
- name: Build all systems
91
+
command: |
92
+
set -e
93
+
nix-copy-closure \
94
+
--to 'midnight' \
95
+
"$(cat /tmp/systems-drv-path)"
96
+
nix build \
97
+
"$(cat /tmp/systems-drv-path)"'^*' \
98
+
--store 'ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build' \
99
+
--eval-store auto \
100
+
--show-trace --print-out-paths
101
+
- name: Build all homes
102
+
command: |
103
+
set -e
104
+
nix-copy-closure \
105
+
--to 'midnight' \
106
+
"$(cat /tmp/homes-drv-path)"
107
+
nix build \
108
+
"$(cat /tmp/homes-drv-path)"'^*' \
109
+
--store 'ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build' \
110
+
--eval-store auto \
111
+
--show-trace --print-out-paths
+25
.tangled/workflows/packetmix-npins-duplicate-check.yml
+25
.tangled/workflows/packetmix-npins-duplicate-check.yml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
when:
6
+
- event: ["push", "pull_request"]
7
+
branch: ["main"]
8
+
9
+
engine: nixery
10
+
11
+
dependencies:
12
+
nixpkgs:
13
+
- jq
14
+
15
+
steps:
16
+
- name: Check for duplicate npins keys
17
+
command: |
18
+
dupes=$(jq --stream 'select((.[0] | length == 3) and (.[0][2] == "type")) | .[0][1]' ./packetmix/npins/sources.json | sort | uniq -d)
19
+
# We have to use the stream parser else jq will get rid of the duplicates
20
+
21
+
if [ ! -z "$dupes" ]; then
22
+
echo "The following keys are duplicated in your npins pins. By default, npins will take *the later definition*:"
23
+
echo "$dupes"
24
+
exit 1
25
+
fi
+63
.tangled/workflows/packetmix-treefmt.yaml
+63
.tangled/workflows/packetmix-treefmt.yaml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
when:
6
+
- event: ["push", "pull_request"]
7
+
branch: ["main"]
8
+
9
+
engine: nixery
10
+
11
+
dependencies:
12
+
nixpkgs:
13
+
- lix
14
+
- openssh
15
+
16
+
steps:
17
+
- name: Get remote builds SSH key
18
+
command: |
19
+
echo "$KEY_SSH_REMOTE_BUILD" > /tmp/key-ssh-remote-build
20
+
chmod 600 /tmp/key-ssh-remote-build
21
+
- name: Add base system files
22
+
command: |
23
+
# Let us SSH to midnight by name
24
+
echo "192.168.0.6 midnight" >> /etc/hosts
25
+
26
+
# Avoid missing user with UID 0 error on ssh...
27
+
echo "root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash" >> /etc/passwd
28
+
29
+
# Turn off SSH host key checking
30
+
echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config
31
+
echo "UserKnownHostsFile /dev/null" >> /etc/ssh/ssh_config
32
+
33
+
echo "Host midnight" >> /etc/ssh/ssh_config
34
+
echo " User remoteBuilds" >> /etc/ssh/ssh_config
35
+
echo " IdentityFile /tmp/key-ssh-remote-build" >> /etc/ssh/ssh_config
36
+
37
+
echo "extra-experimental-features = nix-command" >> /etc/nix/nix.conf
38
+
echo "sandbox = false" >> /etc/nix/nix.conf
39
+
echo "max-jobs = 0" >> /etc/nix/nix.conf
40
+
- name: Ensure files are formatted with treefmt
41
+
command: |
42
+
set -e
43
+
44
+
treefmt=$(nix build \
45
+
-f ./packetmix/nilla.nix packages.treefmt.result.x86_64-linux \
46
+
--store 'ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build' \
47
+
--eval-store auto \
48
+
--show-trace --print-out-paths)
49
+
nix copy \
50
+
--from 'ssh-ng://remoteBuilds@midnight?ssh-key=/tmp/key-ssh-remote-build' \
51
+
--no-check-sigs \
52
+
"$treefmt"
53
+
54
+
set +e
55
+
56
+
"${treefmt}/bin/treefmt" --ci -C packetmix
57
+
exitCode=$?
58
+
59
+
if [ $exitCode -ne 0 ]; then
60
+
echo "Your code isn't formatted correctly, please run 'nilla fmt' and squash it into each commit"
61
+
fi
62
+
63
+
exit $exitCode
+17
.tangled/workflows/reuse.yml
+17
.tangled/workflows/reuse.yml
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
when:
6
+
- event: ["push", "pull_request"]
7
+
branch: ["main"]
8
+
9
+
engine: nixery
10
+
11
+
dependencies:
12
+
nixpkgs:
13
+
- reuse
14
+
15
+
steps:
16
+
- name: Check for REUSE compliance
17
+
command: reuse lint
-51
packetmix/.github/workflows/eval.yml
-51
packetmix/.github/workflows/eval.yml
···
1
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
-
#
3
-
# SPDX-License-Identifier: MIT
4
-
5
-
name: Evaluate NixOS systems and Homes
6
-
7
-
on:
8
-
push:
9
-
branches: [ "main" ]
10
-
pull_request:
11
-
branches: [ "main" ]
12
-
13
-
workflow_dispatch:
14
-
15
-
jobs:
16
-
evaluate:
17
-
runs-on: ubuntu-latest
18
-
19
-
steps:
20
-
- uses: actions/checkout@v4
21
-
22
-
- name: Install Lix
23
-
uses: samueldr/lix-gha-installer-action@8dc19fbd6451fa106a68ecb2dafeeeb90dff3a29
24
-
with:
25
-
extra_nix_config: "experimental-features = nix-command"
26
-
27
-
- run: cd $GITHUB_WORKSPACE
28
-
29
-
- name: Evaluate all systems
30
-
run: |
31
-
eval_out=$(nix-instantiate ./ci.nix -A packages.allNixOSSystems.result.x86_64-linux --add-root ./system-root 2>&1 | tee /dev/stderr)
32
-
eval_warns=$(echo "$eval_out" | grep "evaluation warning:" || true)
33
-
34
-
if [ -n "$eval_warns" ]; then
35
-
echo "There were some warnings while evaluating your systems:"
36
-
echo "$eval_warns"
37
-
echo "Please fix these and squash into your existing commits"
38
-
exit 1
39
-
fi
40
-
41
-
- name: Evaluate all homes
42
-
run: |
43
-
eval_out=$(nix-instantiate ./ci.nix -A packages.allNixOSSystems.result.x86_64-linux --add-root ./home-root 2>&1 | tee /dev/stderr)
44
-
eval_warns=$(echo "$eval_out" | grep "evaluation warning:" || true)
45
-
46
-
if [ -n "$eval_warns" ]; then
47
-
echo "There were some warnings while evaluating your homes:"
48
-
echo "$eval_warns"
49
-
echo "Please fix these and squash into your existing commits"
50
-
exit 1
51
-
fi
-69
packetmix/.github/workflows/nixos.yml
-69
packetmix/.github/workflows/nixos.yml
···
1
-
# SPDX-FileCopyrightText: 2025 Collabora Productivity Limited
2
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
3
-
# SPDX-FileCopyrightText: 2022 Markus Dobel
4
-
#
5
-
# SPDX-License-Identifier: MIT
6
-
7
-
name: Build and cache NixOS systems and Homes
8
-
9
-
on:
10
-
push:
11
-
branches: [ "main" ]
12
-
pull_request:
13
-
branches: [ "main" ]
14
-
15
-
workflow_dispatch:
16
-
17
-
concurrency: # Since as this check is expensive, it's a bad idea to keep running it when we push new commits...
18
-
group: ${{ github.workflow }}-${{ github.ref }}
19
-
cancel-in-progress: true
20
-
21
-
jobs:
22
-
build:
23
-
runs-on: ubuntu-latest
24
-
25
-
steps:
26
-
- name: Clean up runner
27
-
uses: easimon/maximize-build-space@c28619d8999a147d5e09c1199f84ff6af6ad5794
28
-
with:
29
-
overprovision-lvm: true # needed for our mount path to be /nix - we'll cope with the weird errors this option suggests may arise as it'd be untenable to constantly readjust root-reserve-mb
30
-
remove-dotnet: true
31
-
remove-android: true
32
-
remove-haskell: true
33
-
remove-codeql: true
34
-
remove-docker-images: true
35
-
build-mount-path: /nix
36
-
build-mount-path-ownership: root:root
37
-
38
-
- uses: actions/checkout@v4
39
-
40
-
- name: Install Lix
41
-
uses: samueldr/lix-gha-installer-action@8dc19fbd6451fa106a68ecb2dafeeeb90dff3a29
42
-
with:
43
-
extra_nix_config: "experimental-features = nix-command"
44
-
45
-
- run: cd $GITHUB_WORKSPACE
46
-
47
-
- name: Set up a cachix cache
48
-
uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad
49
-
with:
50
-
# Name of a cachix cache to push and pull/substitute
51
-
name: "freshlybakedcake"
52
-
authToken: "${{ secrets.CACHIX_TOKEN }}"
53
-
54
-
# see https://git.lix.systems/lix-project/lix/issues/545
55
-
- name: Fix apparmor configuration for building Lix
56
-
run: |
57
-
sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
58
-
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
59
-
60
-
- name: Build all systems
61
-
run: nix build -f ./ci.nix packages.allNixOSSystems.result.x86_64-linux --show-trace
62
-
63
-
- name: Build all homes
64
-
run: nix build -f ./ci.nix packages.allHomes.result.x86_64-linux --show-trace
65
-
66
-
- if: github.event_name == 'push'
67
-
name: Push to release branch
68
-
run: |
69
-
git push -f origin HEAD:release
-38
packetmix/.github/workflows/npins-duplicate-check.yml
-38
packetmix/.github/workflows/npins-duplicate-check.yml
···
1
-
# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
2
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
3
-
#
4
-
# SPDX-License-Identifier: CC0-1.0
5
-
6
-
name: Check for npins duplicate keys
7
-
# As it's possible to specify duplicate keys in npins, we need to route them
8
-
# out... Duplicated npins keys cause the earlier definition of a pin to be
9
-
# silently ignored, potentially causing confusion about what version is being
10
-
# used
11
-
12
-
on:
13
-
push:
14
-
branches: [ "main" ]
15
-
pull_request:
16
-
branches: [ "main" ]
17
-
workflow_dispatch:
18
-
19
-
permissions:
20
-
contents: read
21
-
22
-
jobs:
23
-
npins-duplicate-checker:
24
-
runs-on: ubuntu-latest
25
-
steps:
26
-
- name: Checkout
27
-
uses: actions/checkout@v4
28
-
29
-
- name: Check for duplicate npins keys
30
-
run: |
31
-
dupes=$(jq --stream 'select((.[0] | length == 3) and (.[0][2] == "type")) | .[0][1]' $GITHUB_WORKSPACE/npins/sources.json | sort | uniq -d)
32
-
# We have to use the stream parser else jq will get rid of the duplicates
33
-
34
-
if [ ! -z "$dupes" ]; then
35
-
echo "The following keys are duplicated in your npins pins. By default, npins will take *the later definition*:"
36
-
echo "$dupes"
37
-
exit 1
38
-
fi
-24
packetmix/.github/workflows/reuse.yml
-24
packetmix/.github/workflows/reuse.yml
···
1
-
# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
2
-
#
3
-
# SPDX-License-Identifier: CC0-1.0
4
-
5
-
name: Check REUSE compliance
6
-
7
-
on:
8
-
push:
9
-
branches: [ "main" ]
10
-
pull_request:
11
-
branches: [ "main" ]
12
-
13
-
permissions:
14
-
contents: read
15
-
16
-
jobs:
17
-
reuse:
18
-
runs-on: ubuntu-latest
19
-
steps:
20
-
- name: Checkout
21
-
uses: actions/checkout@v4
22
-
23
-
- name: Check REUSE compliance
24
-
uses: fsfe/reuse-action@a46482ca367aef4454a87620aa37c2be4b2f8106
-33
packetmix/.github/workflows/tangled.yml
-33
packetmix/.github/workflows/tangled.yml
···
1
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
-
#
3
-
# SPDX-License-Identifier: MIT
4
-
5
-
name: Mirror to tangled.sh
6
-
7
-
on:
8
-
push:
9
-
branches: [ "main", "release" ]
10
-
11
-
jobs:
12
-
tangled-push:
13
-
runs-on: ubuntu-latest
14
-
15
-
steps:
16
-
- uses: actions/checkout@v4
17
-
18
-
- run: cd $GITHUB_WORKSPACE
19
-
20
-
- name: Write out SSH key
21
-
env:
22
-
TANGLED_SSH_KEY: ${{ secrets.TANGLED_SSH_KEY }}
23
-
run: |
24
-
echo "$TANGLED_SSH_KEY" > ../tangled_ssh_key
25
-
chmod 600 ../tangled_ssh_key
26
-
27
-
- name: Push to tangled
28
-
run: |
29
-
git remote add tangled git@tangled.sh:freshlybakedca.ke/packetmix
30
-
export GIT_SSH_COMMAND="ssh -i $(realpath ../tangled_ssh_key) -o StrictHostKeyChecking=no"
31
-
git fetch --unshallow origin
32
-
git fetch tangled
33
-
git push tangled HEAD
-51
packetmix/.github/workflows/treefmt.yaml
-51
packetmix/.github/workflows/treefmt.yaml
···
1
-
# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
2
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
3
-
#
4
-
# SPDX-License-Identifier: CC0-1.0
5
-
6
-
name: Ensure files are formatted with treefmt
7
-
8
-
on:
9
-
push:
10
-
branches: [ "main" ]
11
-
pull_request:
12
-
branches: [ "main" ]
13
-
workflow_dispatch:
14
-
15
-
permissions:
16
-
contents: read
17
-
18
-
jobs:
19
-
treefmt-check:
20
-
runs-on: ubuntu-latest
21
-
steps:
22
-
- name: Checkout
23
-
uses: actions/checkout@v4
24
-
25
-
- name: Install Nix
26
-
uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641
27
-
with:
28
-
extra_nix_config: "experimental-features = nix-command"
29
-
30
-
- run: cd $GITHUB_WORKSPACE
31
-
32
-
- name: Set up a cachix cache
33
-
uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad
34
-
with:
35
-
# Name of a cachix cache to push and pull/substitute
36
-
name: "freshlybakedcake"
37
-
authToken: "${{ secrets.CACHIX_TOKEN }}"
38
-
39
-
- name: Ensure all files are formatted
40
-
run: |
41
-
set +e
42
-
43
-
nix-shell ./ci.nix -A shells.default.result.x86_64-linux --run 'treefmt --ci'
44
-
45
-
exitCode=$?
46
-
47
-
if [ $exitCode -ne 0 ]; then
48
-
echo "Your code isn't formatted correctly, please run 'nilla fmt' and squash it into each commit"
49
-
fi
50
-
51
-
exit $exitCode
-63
packetmix/.github/workflows/update-npins.yml
-63
packetmix/.github/workflows/update-npins.yml
···
1
-
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
-
#
3
-
# SPDX-License-Identifier: MIT
4
-
5
-
name: Update npins dependencies
6
-
# This is inspired by https://github.com/getchoo/update-npins - though I wrote it from scratch
7
-
# I'm not using it as I need to run the npins command in a shell
8
-
9
-
on:
10
-
schedule:
11
-
- cron: "48 02 * * *" # Time is pretty arbitrary - the only important thing is that it's unlikely to be a peak time...
12
-
13
-
workflow_dispatch:
14
-
15
-
jobs:
16
-
update-npins:
17
-
runs-on: ubuntu-latest
18
-
19
-
steps:
20
-
- name: Generate GitHub token for RoboPâtissière
21
-
uses: actions/create-github-app-token@v1
22
-
id: generate-token
23
-
with:
24
-
app-id: ${{ secrets.CUSTOM_GITHUB_APP_ID }}
25
-
private-key: ${{ secrets.CUSTOM_GITHUB_APP_PRIVATE_KEY }}
26
-
27
-
- uses: actions/checkout@v4
28
-
29
-
- name: Install Nix
30
-
uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641
31
-
with:
32
-
extra_nix_config: "experimental-features = nix-command"
33
-
34
-
- run: cd $GITHUB_WORKSPACE
35
-
36
-
- name: Set up a cachix cache
37
-
uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad
38
-
with:
39
-
# Name of a cachix cache to push and pull/substitute
40
-
name: "freshlybakedcake"
41
-
authToken: "${{ secrets.CACHIX_TOKEN }}"
42
-
43
-
- name: Run npins update
44
-
run: nix-shell ./ci.nix -A shells.default.result.x86_64-linux --run 'npins update'
45
-
46
-
- name: Create a pull request
47
-
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e
48
-
id: pull-request
49
-
with:
50
-
branch: auto/update-npins
51
-
commit-message: "chore: bump npins dependencies"
52
-
token: ${{ steps.generate-token.outputs.token }}
53
-
title: "chore: bump npins dependencies"
54
-
author: "RoboPâtissière[bot] <213641064+robopatissiere[bot]@users.noreply.github.com>"
55
-
committer: "RoboPâtissière[bot] <213641064+robopatissiere[bot]@users.noreply.github.com>"
56
-
body: |
57
-
This is an automated npins dependency bump
58
-
59
-
- if: steps.pull-request.outputs.pull-request-operation == 'created'
60
-
name: Automerge pull request
61
-
run: gh pr merge --rebase --auto "${{ steps.pull-request.outputs.pull-request-number }}"
62
-
env:
63
-
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+26
packetmix/systems/midnight/packetmix-update.nix
+26
packetmix/systems/midnight/packetmix-update.nix
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
{
6
+
systemd.services."update-packetmix-npins" = {
7
+
script = ''
8
+
export WORKING_DIR=mktemp -d
9
+
export GIT_SSH_COMMAND="ssh -i /etc/ssh/ssh_host_ed25519_key"
10
+
git clone git@tangled.sh:freshlybakedca.ke/patisserie $WORKING_DIR
11
+
cd $WORKING_DIR/packetmix
12
+
git checkout -b auto/update-npins
13
+
npins update
14
+
git add .
15
+
git commit -am "chore: bump npins dependencies"
16
+
git push
17
+
# TODO: Make web request to create PR
18
+
rm -rf $WORKING_DIR
19
+
'';
20
+
serviceConfig = {
21
+
Type = "oneshot";
22
+
User = "root";
23
+
};
24
+
startAt = "*-*-* 00:00:00";
25
+
};
26
+
}