infrastructure/workflows/npins-update.nix

# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{ lib, nix-actions, ... }:

let
  inherit (nix-actions.lib) secret;

  inherit (lib) genAttrs mapAttrs' nameValuePair;

  dependencies = builtins.attrNames (import ../npins);
in

{
  name = "Update dependencies";
  on.schedule = [
    # Run every 24h
    { cron = "15 12 * * *"; }
  ];

  # Global environment, necessary for rebases and commits
  env = rec {
    GIT_AUTHOR_NAME = "HT Chores";
    GIT_AUTHOR_EMAIL = "chores@mail.hubrecht.ovh";
    GIT_COMMITTER_NAME = GIT_AUTHOR_NAME;
    GIT_COMMITTER_EMAIL = GIT_AUTHOR_EMAIL;
  };

  jobs = mapAttrs' (name: nameValuePair (builtins.replaceStrings [ "." ] [ "_" ] name)) (
    genAttrs dependencies (name: {
      runs-on = "nix";
      steps = [
        (nix-actions.lib.steps.checkout {
          fetch-depth = 0;
          token = secret "TEA_DGNUM_CHORES_TOKEN";
        })

        {
          env.GIT_UPDATE_BRANCH = "npins-updates/${name}";

          name = "Switch to a new branch";
          run = # bash
            ''
              if git ls-remote --exit-code --heads origin "refs/heads/$GIT_UPDATE_BRANCH"; then
                git switch "$GIT_UPDATE_BRANCH"
                git rebase main
                echo "EXISTING_BRANCH=1" >> $GITHUB_ENV
              else
                git switch -C "$GIT_UPDATE_BRANCH"
              fi
            '';
        }

        {
          env = {
            GIT_UPDATE_BRANCH = "npins-updates/${name}";
            COMMIT_MESSAGE = "chore(npins): Update ${name}";
          };

          name = "Open a PR if updates are present";
          run = # bash
            ''
              nix-shell -A npins-shell --run 'npins update ${name}'

              if [ ! -z "$(git diff --name-only)" ]; then
                echo "[+] Changes detected, pushing updates."

                git add npins

                if [ -n "$EXISTING_BRANCH" ]; then
                  git commit --amend --no-edit
                  git push --force
                else
                  git commit --message "$COMMIT_MESSAGE"
                  git push -u origin "$GIT_UPDATE_BRANCH"
                fi

                # Connect to the server with the cli
                tea login add -n dgnum-chores -t "${secret "TEA_DGNUM_CHORES_TOKEN"}" -u https://git.dgnum.eu

                # Create a pull request if needed
                # i.e. no PR with the same title exists
                if [ -z $(tea pr ls -f='head' -o simple | grep "$GIT_UPDATE_BRANCH") ]; then
                  tea pr create --description "Automatic npins update" --title "$COMMIT_MESSAGE" --head "$GIT_UPDATE_BRANCH"
                fi
              elif [ -n "$EXISTING_BRANCH" ]; then
                git push --force
              fi
            '';
        }
      ];
    })
  );
}