Merge branch 'main' into reproducibility-check

.github/workflows/dotnet.yaml

@@ -107,7 +107,12 @@ jobs:
         run: 'nix develop --command markdown-link-check {,**/}*.md'
 
   all-required-checks-complete:
+    if: ${{ always() }}
     needs: [check-dotnet-format, check-nix-format, build, build-nix, linkcheck, check-flake]
     runs-on: ubuntu-latest
     steps:
-      - run: echo "All required checks complete."
+      - uses: actions/checkout@v4
+      - name: Check job statuses
+        env:
+            RESULTS: ${{ toJSON(needs) }}
+        run: python .github/workflows/required_checks.py

.github/workflows/flake_update.yaml

@@ -0,0 +1,57 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/github-workflow.json
+name: Weekly Nix Flake Update
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'  # Runs at 00:00 every Sunday
+  workflow_dispatch:  # Allows manual triggering
+
+jobs:
+  update-nix-flake:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Update Nix flake
+        run: 'nix flake update'
+
+      - name: Build passthru
+        run: 'nix build ".#default.passthru.fetch-deps"'
+
+      - name: Run passthru
+        run: |
+            set -o pipefail
+            ./result | tee /tmp/passthru.txt
+            cp /"$(cat /tmp/passthru.txt | grep " wrote lockfile to " | cut -d / -f 2-)" nix/deps.nix
+
+      - name: Format
+        run: 'nix develop --command alejandra .'
+
+      - name: Create token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          # https://github.com/actions/create-github-app-token/issues/136
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Raise pull request
+        uses: Smaug123/commit-action@cc25e6d80a796c49669dda4a0aa36c54c573983d
+        id: cpr
+        with:
+            bearer-token: ${{ steps.generate-token.outputs.token }}
+            pr-title: "Upgrade Nix flake and deps"
+
+      - name: Enable Pull Request Automerge
+        if: ${{ steps.cpr.outputs.pull-request-number }}
+        uses: peter-evans/enable-pull-request-automerge@v3
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
+          merge-method: squash

.github/workflows/required_checks.py

@@ -0,0 +1,40 @@
+import os
+import json
+import sys
+from typing import Any
+
+results_json = os.environ.get('RESULTS', '{}') or sys.exit(1)
+
+try:
+    results = json.loads(results_json)
+except json.JSONDecodeError:
+    print("Error: Unable to parse RESULTS as JSON")
+    exit(1)
+
+def process_job(job_name: str, job_data: dict[str, Any]) -> int:
+    """
+    Returns 0 on success and 1 on error.
+    """
+    status = job_data['result']
+    print(f"Processing job: {job_name} with status: {status}")
+
+    if status == "success":
+        print(f"Job {job_name} succeeded.")
+        return 0
+    elif status in {"failure", "cancelled"}:
+        print(f"Job {job_name} failed: status {status}!")
+        return 1
+    else:
+        print(f"Job {job_name} has unknown status: {status}!")
+        return 1
+
+# Iterate over each job
+exit_status = 0
+for job_name, job_data in results.items():
+    if not isinstance(job_data, dict):
+        print(f"Unexpected shape at key {job_name}: {job_data}")
+        sys.exit(2)
+    exit_status += process_job(job_name, job_data)
+
+if exit_status > 0:
+    sys.exit(3)

flake.lock

@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1717112898,
+        "lastModified": 1720687749,
-        "narHash": "sha256-7R2ZvOnvd9h8fDd65p0JnB7wXfUvreox3xFdYWd1BnY=",
+        "narHash": "sha256-nqJ+iK/zyqCJ/YShqCpZ2cJKE1UtjZIEUWLUFZqvxcA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6132b0f6e344ce2fe34fc051b72fb46e34f668e0",
+        "rev": "6af55cb91ca2005516b9562f707bb99c8f79bf77",
         "type": "github"
       },
       "original": {

flake.nix

@@ -20,7 +20,7 @@
       dotnet-sdk = pkgs.dotnet-sdk_8;
       dotnet-runtime = pkgs.dotnetCorePackages.runtime_8_0;
       version = "0.1";
-      dotnetTool = toolName: toolVersion: sha256:
+      dotnetTool = toolName: toolVersion: hash:
         pkgs.stdenvNoCC.mkDerivation rec {
           name = toolName;
           version = toolVersion;
@@ -28,7 +28,7 @@
           src = pkgs.fetchNuGet {
             pname = name;
             version = version;
-            sha256 = sha256;
+            hash = hash;
             installPhase = ''mkdir -p $out/bin && cp -r tools/net6.0/any/* $out/bin'';
           };
           installPhase = ''
@@ -49,7 +49,7 @@
       };
     in {
       packages = {
-        fantomas = dotnetTool "fantomas" (builtins.fromJSON (builtins.readFile ./.config/dotnet-tools.json)).tools.fantomas.version (builtins.head (builtins.filter (elem: elem.pname == "fantomas") ((import ./nix/deps.nix) {fetchNuGet = x: x;}))).sha256;
+        fantomas = dotnetTool "fantomas" (builtins.fromJSON (builtins.readFile ./.config/dotnet-tools.json)).tools.fantomas.version (builtins.head (builtins.filter (elem: elem.pname == "fantomas") ((import ./nix/deps.nix) {fetchNuGet = x: x;}))).hash;
         default = default;
       };
       apps = {