update.yml

---
name: Update

on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * *"

concurrency:
  group: update
  cancel-in-progress: true

jobs:
  update:
    runs-on: macos-latest
    permissions:
      contents: write
      id-token: write
      pull-requests: write
    steps:
      - name: Create GH App token
        uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ vars.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: main
      - name: Install Nix
        uses: cachix/install-nix-action@v31
      - name: Install devenv
        run: nix profile add --accept-flake-config github:cachix/devenv/latest
      - name: Compile cli
        run: devenv shell -- go build .
        working-directory: cli
      - name: Update versions
        id: update
        run: |
          commit_message=$(cli/cli update)
          echo "commit_message=$commit_message" >> "$GITHUB_OUTPUT"
        env:
          CLI_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
      - name: Create pull request
        if: ${{ steps.update.outputs.commit_message }}
        uses: peter-evans/create-pull-request@v8
        with:
          commit-message: ${{ steps.update.outputs.commit_message }}
          title: ${{ steps.update.outputs.commit_message }}
          body: |
            Automatically created pull-request to update Terraform versions.

            This is the result of configuring a CLI_GITHUB_TOKEN in `.env` and running:

            ```sh
            pushd cli
            go build .
            popd
            cli/cli update
            ```
          delete-branch: true
          reviewers: |
            oscar-izval
            sestrella
          token: ${{ steps.app-token.outputs.token }}

  notify:
    if: failure()
    runs-on: ubuntu-latest
    needs: [update]
    steps:
      - uses: slackapi/slack-github-action@v2
        with:
          webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
          webhook-type: webhook-trigger
          payload: |
            {
              "text": "*nixpkgs-terraform*: :elmofire: *${{ github.workflow }}* workflow failed on *${{ github.ref_name }}* (<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|open run>)"
            }