on:
  schedule:
    - cron: '47 12 10 * *'
  workflow_dispatch:

name: Update Nix lockfile

jobs:
  bump-nix:
    name: Update Nix lockfile
    if: github.repository_owner == 'davidlattimore'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install Nix
        uses: nixbuild/nix-quick-install-action@v34

      - name: Update lock file
        run: |
          nix flake update -L --show-trace

      - name: Commit changes
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git branch -D nix_update || true
          git checkout -b nix_update
          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"
          git add flake.lock
          git commit -m "Update nix flake.lock"
          git push -f https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }} nix_update
