Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

finally at least be able to sign commits #800

Merged
merged 1 commit into from
Jun 6, 2024
Merged

finally at least be able to sign commits #800

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 34 additions & 5 deletions .github/workflows/flake_vendorhash.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,39 +27,64 @@ jobs:
with:
fetch-depth: 0
token: ${{ steps.generate_token.outputs.token }}
persist-credentials: false
- name: Enable GPG signing
run: |
echo '#!/bin/bash' > gpg-wrapper
echo 'gpg --passphrase "'${{ secrets.OCMBOT_SIGNING_KEY_PASS }}'" --yes --batch --pinentry-mode loopback $@ <&0' >> gpg-wrapper
echo 'exit $?' >> gpg-wrapper
chmod +x gpg-wrapper
echo -n "${{ secrets.OCMBOT_SIGNING_KEY }}" | base64 -d | ./gpg-wrapper --import
git config --global gpg.program "$(realpath gpg-wrapper)"
git config --global user.name ocmbot[bot]
git config --global user.email 125909804+ocmbot[bot]@users.noreply.github.com
git config --global user.signingkey ${{ secrets.OCMBOT_SIGNING_KEY_ID }}
git config --global commit.gpgsign true
git config --global tag.gpgsign true
- name: Install Nix
uses: DeterminateSystems/nix-installer-action@v12
- name: Update ocm vendor hash
run: nix run .#nixpkgs.nix-update -- --flake --version=skip ocm
- name: Check diff
- name: Check diff and create action summary
id: check-diff
run: |
diff=$(git diff)
if [[ -z "$diff" ]]; then
echo "Everything is tidy."
exit 0
fi

cat << EOF >> "${GITHUB_STEP_SUMMARY}"
\`\`\`diff
${diff}
\`\`\`
EOF
cat << EOF >> body
This PR updates the vendorHash in flake.nix.
\`\`\`bash
nix run .#nixpkgs.nix-update -- --flake --version=skip ocm
\`\`\`
\`\`\`diff
${diff}
\`\`\`
EOF
echo "body=$(realpath body)" >> "$GITHUB_OUTPUT"
- name: Commit
run: |
diff=$(git diff)
if [[ ! -z "$diff" ]]; then
git config --global user.name "ocmbot"
git config --global user.email "ocmbot@users.noreply.github.com"
git commit -S -am "update vendorHash"
git add flake.*
git commit -S -m "update vendorHash"
fi
- name: Create pull request
id: create_pull_request
uses: peter-evans/create-pull-request@v6
with:
token: ${{ steps.generate_token.outputs.token }}
title: Update vendorHash in flake.nix
body-path: ${{ steps.check-diff.outputs.body }}
branch: nix/flake
committer: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
author: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com>
team-reviewers: ocm-dev
add-paths: |
flake.nix
Expand All @@ -71,3 +96,7 @@ jobs:
token: ${{ steps.generate_token.outputs.token }}
pull-request-number: ${{ steps.create_pull_request.outputs.pull-request-number }}
merge-method: squash
- name: Cleanup
if: always()
run: |
rm -rf gpg-wrapper
Loading