From e7bfe276c3141ac622766c41ed4849f640a012bd Mon Sep 17 00:00:00 2001 From: Frank Stellmacher Date: Mon, 20 Apr 2026 23:16:25 +0200 Subject: [PATCH] ci(release): route nix lock refresh through PR + auto-merge (#224) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After enabling branch protection rulesets on main, the existing direct push from the verify-nix job (`git push origin HEAD:main`) is rejected. Push the refresh commit to a per-release branch (`chore/nix-lock-refresh-v`) instead, open a PR, and enable auto-merge so the change lands as soon as repo conditions allow (0 required reviews + 0 required status checks → instant). Adds `pull-requests: write` to job permissions so GITHUB_TOKEN can create + merge the PR. Co-authored-by: Psychotoxical Co-authored-by: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b9c59bf3..552cd223 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -240,6 +240,7 @@ jobs: runs-on: ubuntu-24.04 permissions: contents: write + pull-requests: write steps: - uses: actions/checkout@v5 with: @@ -291,7 +292,9 @@ jobs: # cachix dedupes against anything already in the cache. nix path-info --recursive .#psysonic | cachix push psysonic - - name: commit + push refreshed lock and hash (if changed) + - name: open + auto-merge PR with refreshed lock and hash (if changed) + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | set -euo pipefail git config user.name "github-actions[bot]" @@ -302,5 +305,13 @@ jobs: exit 0 fi VERSION="${{ needs.create-release.outputs.package_version }}" + BRANCH="chore/nix-lock-refresh-v${VERSION}" + git checkout -b "$BRANCH" git commit -m "chore(nix): refresh lock + npmDepsHash for v${VERSION}" - git push origin HEAD:main + git push origin "$BRANCH" + gh pr create \ + --base main \ + --head "$BRANCH" \ + --title "chore(nix): refresh lock + npmDepsHash for v${VERSION}" \ + --body "Auto-generated after the v${VERSION} release: refreshes \`flake.lock\` and \`nix/upstream-sources.json\` so the Cachix substituter resolves the latest pin." + gh pr merge "$BRANCH" --squash --auto --delete-branch