supabase-postgres.git / summary / log / commit / refs
commit be0013981bc2208db2389ad5bdae5fed021ccdcc
Author: Márton Boros <martonboros@gmail.com>
Commit: GitHub <noreply@github.com>
Date: Thu Aug 27 15:20:57 2026 +0000
ci: fix update-flake-lock workflow (app token + update-flake-lock action) (#2281)
* ci: fix update-flake-lock PR creation (duplicate auth header)
checkout@v6 persists credentials that collide with the auth header set
by create-pull-request, producing a duplicate Authorization header and
a HTTP 400 on push. Disable credential persistence since
create-pull-request supplies its own token.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci: use update-flake-lock action with a GitHub App token
Switch to DeterminateSystems/update-flake-lock for better ergonomics and
authenticate via actions/create-github-app-token. A GitHub App token is
required because the org disables "Allow GitHub Actions to create and
approve pull requests", so GITHUB_TOKEN cannot open the PR.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci: use client-id input for create-github-app-token (app-id deprecated)
* ci: make flake lock updates manual
* ci: document disabled flake lock schedule
* ci: update all flake inputs
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
.github/workflows/update-flake-lock.yml | 44 +++++++++++++++------------------
1 file changed, 20 insertions(+), 24 deletions(-)
diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml
index 5093b73c..2edf31f9 100644
--- a/.github/workflows/update-flake-lock.yml
+++ b/.github/workflows/update-flake-lock.yml
@@ -2,8 +2,9 @@ name: Update Flake Lock
on:
workflow_dispatch:
- schedule:
- - cron: '0 0 1 * *'
+ # TODO: enable scheduled updates when nixpkgs is updated.
+ # schedule:
+ # - cron: '0 0 1 * *'
jobs:
update-flake-lock:
@@ -12,34 +13,29 @@ jobs:
contents: write
pull-requests: write
steps:
+ - name: Generate app token
+ id: app-token
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+ with:
+ client-id: ${{ secrets.UPDATE_APP_ID }}
+ private-key: ${{ secrets.UPDATE_APP_PRIVATE_KEY }}
+
- name: Checkout repository
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ token: ${{ steps.app-token.outputs.token }}
- name: Install Nix
uses: ./.github/actions/nix-install-ephemeral
- - name: Update critical flake inputs
- run: |
- nix flake update \
- nixpkgs \
- rust-overlay \
- multigres \
- nix-eval-jobs
-
- - name: Create Pull Request
- uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+ - name: Update flake.lock and open PR
+ uses: DeterminateSystems/update-flake-lock@834c491b2ece4de0bbd00d85214bb5e83b4da5c6 # v28
with:
- token: ${{ secrets.GITHUB_TOKEN }}
- commit-message: "chore: update flake.lock (monthly)"
- title: "chore: update flake.lock (monthly)"
- body: |
- Automated monthly update of critical flake inputs:
- - `nixpkgs` (nixos-unstable channel)
- - `rust-overlay`
- - `multigres`
- - `nix-eval-jobs`
- branch: auto-update-flake-lock
- base: develop
- labels: |
+ token: ${{ steps.app-token.outputs.token }}
+ commit-msg: "chore: update flake.lock (monthly)"
+ pr-title: "chore: update flake.lock (monthly)"
+ pr-labels: |
dependencies
automated
+ branch: auto-update-flake-lock
+ base: develop