ci: scheduled flake-inputs-update workflow (openchamber + opencode)

.github/workflows/flake-inputs-update.yml

@@ -0,0 +1,269 @@
+# Keeps the flake's openchamber and opencode inputs current with
+# developing-today/openchamber and developing-today/opencode. The openchamber
+# input keeps its `inputs.opencode.follows = "opencode"`, so the two pins
+# always move together against the same opencode rev.
+#
+# Daily (and on demand): update only those two inputs, then validate the
+# flake by evaluating the outputs that consume them (plus the dev shell the
+# repo's own nix-ci evaluates). This repo has no OpenChamber-specific test
+# suite, so evaluation is the check — no full test run. If validation passes
+# and flake.lock moved, the change lands as a pull request that this
+# workflow merges itself.
+#
+# Failures are tracked in ONE issue (title in FAILURE_ISSUE_TITLE below):
+# the first failure opens it, later failures edit it in place (attempt count,
+# first/last failure times, one history entry per attempt), and the next
+# success closes it — the successful update PR carries a "Fixes #<n>" line,
+# and the merge step comments the passing revs before closing. A failed run
+# never disables later runs: every scheduled run retries with the newest
+# revs, and while a failure issue is open validation runs even when the
+# lockfile did not move, so a manual fix is picked up too.
+name: flake-inputs-update
+
+on:
+  schedule:
+    # Daily at 07:23 UTC, an hour after openchamber's own opencode-update
+    # run, so this picks up the openchamber rev that run just merged.
+    - cron: "23 7 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+concurrency:
+  group: flake-inputs-update
+  cancel-in-progress: false
+
+env:
+  FAILURE_ISSUE_TITLE: "chore(deps): automated openchamber+opencode input update failing"
+  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GH_REPO: ${{ github.repository }}
+  RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - name: Check out main
+        uses: actions/checkout@v7
+        with:
+          ref: main
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
+
+      - name: Find an open failure issue
+        id: failure-issue
+        run: |
+          gh issue list --state open --limit 100 --json number,title > "$RUNNER_TEMP/issues.json"
+          number=$(jq -r --arg title "$FAILURE_ISSUE_TITLE" \
+            '.[] | select(.title == $title) | .number' "$RUNNER_TEMP/issues.json" | head -n 1)
+          echo "number=${number}" >> "$GITHUB_OUTPUT"
+          if [ -n "${number}" ]; then
+            echo "An open failure issue already exists: #${number}"
+          else
+            echo "No open failure issue."
+          fi
+
+      - name: Record the currently pinned revs
+        id: before
+        run: |
+          echo "openchamber_rev=$(jq -r '.nodes.openchamber.locked.rev' flake.lock)" >> "$GITHUB_OUTPUT"
+          echo "opencode_rev=$(jq -r '.nodes.opencode.locked.rev' flake.lock)" >> "$GITHUB_OUTPUT"
+
+      - name: Update the openchamber and opencode inputs
+        id: update
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          nix flake update openchamber opencode 2>&1 | tee "$RUNNER_TEMP/update.log"
+
+      - name: Plan verification
+        id: plan
+        run: |
+          echo "openchamber_rev=$(jq -r '.nodes.openchamber.locked.rev' flake.lock)" >> "$GITHUB_OUTPUT"
+          echo "opencode_rev=$(jq -r '.nodes.opencode.locked.rev' flake.lock)" >> "$GITHUB_OUTPUT"
+          if git diff --quiet -- flake.lock; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+          # Verify when the pins moved, and also while a failure issue is open
+          # (a manual fix elsewhere can make the same revs pass again).
+          if [ "${{ steps.update.outcome }}" != "success" ]; then
+            echo "verify=false" >> "$GITHUB_OUTPUT"
+          elif ! git diff --quiet -- flake.lock || [ -n "${{ steps.failure-issue.outputs.number }}" ]; then
+            echo "verify=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "verify=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Validate the flake
+        id: validate
+        if: steps.plan.outputs.verify == 'true'
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          {
+            nix eval .#devShells.x86_64-linux.default.drvPath
+            nix eval --raw --impure --expr 'let f = builtins.getFlake (toString ./.); in f.inputs.openchamber.packages.x86_64-linux.openchamber.drvPath'
+            nix eval --raw --impure --expr 'let f = builtins.getFlake (toString ./.); in f.inputs.opencode.packages.x86_64-linux.opencode.drvPath'
+          } 2>&1 | tee "$RUNNER_TEMP/validate.log"
+
+      - name: Decide the outcome
+        id: outcome
+        if: always()
+        run: |
+          failed_step=""
+          error_log=""
+          if [ "${{ steps.update.outcome }}" = "failure" ]; then
+            failed_step="nix flake update openchamber opencode"
+            error_log="$RUNNER_TEMP/update.log"
+          elif [ "${{ steps.plan.outputs.verify }}" = "true" ] && [ "${{ steps.validate.outcome }}" = "failure" ]; then
+            failed_step="flake validation (nix eval of the openchamber/opencode outputs)"
+            error_log="$RUNNER_TEMP/validate.log"
+          fi
+          if [ -n "${failed_step}" ]; then
+            echo "result=failure" >> "$GITHUB_OUTPUT"
+            echo "failed_step=${failed_step}" >> "$GITHUB_OUTPUT"
+            echo "error_log=${error_log}" >> "$GITHUB_OUTPUT"
+          else
+            echo "result=success" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Record the failure on the tracking issue
+        if: steps.outcome.outputs.result == 'failure'
+        env:
+          FAILED_STEP: ${{ steps.outcome.outputs.failed_step }}
+          ERROR_LOG: ${{ steps.outcome.outputs.error_log }}
+          EXISTING_NUMBER: ${{ steps.failure-issue.outputs.number }}
+          NEW_OC_REV: ${{ steps.plan.outputs.openchamber_rev }}
+          NEW_OPENCODE_REV: ${{ steps.plan.outputs.opencode_rev }}
+        run: |
+          now=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+          attempts=1
+          first_failure="${now}"
+          history_file="$RUNNER_TEMP/history.md"
+          : > "${history_file}"
+          if [ -n "${EXISTING_NUMBER}" ]; then
+            gh issue view "${EXISTING_NUMBER}" --json body --jq .body > "$RUNNER_TEMP/old-body.md"
+            previous=$(grep -E '^Attempts: ' "$RUNNER_TEMP/old-body.md" | head -n 1 | grep -oE '[0-9]+' || true)
+            if [ -n "${previous}" ]; then
+              attempts=$((previous + 1))
+            fi
+            previous_first=$(sed -n 's/^First failure: //p' "$RUNNER_TEMP/old-body.md" | head -n 1)
+            if [ -n "${previous_first}" ]; then
+              first_failure="${previous_first}"
+            fi
+            awk '/^## Failure history/{found=1; next} found' "$RUNNER_TEMP/old-body.md" > "${history_file}"
+          fi
+          # Error excerpt: last lines of the failing step's log, capped, with
+          # code fences neutralized so the issue body stays valid Markdown.
+          tail -n 80 "${ERROR_LOG}" | sed 's/~~~/---/g' | head -c 5000 > "$RUNNER_TEMP/excerpt.txt" || true
+          entry_file="$RUNNER_TEMP/entry.md"
+          {
+            echo "### Attempt ${attempts} — ${now} — openchamber \`${NEW_OC_REV}\`, opencode \`${NEW_OPENCODE_REV}\`"
+            echo "- Failed step: ${FAILED_STEP}"
+            echo "- Run: ${RUN_URL}"
+            echo "- Error excerpt (full log in the run linked above):"
+            echo
+            echo '~~~'
+            cat "$RUNNER_TEMP/excerpt.txt"
+            echo
+            echo '~~~'
+            echo
+          } > "${entry_file}"
+          body_file="$RUNNER_TEMP/issue-body.md"
+          {
+            echo "<!-- automated-failure-issue: flake-inputs-update -->"
+            echo "Automated openchamber+opencode input updates are currently failing. This issue is maintained by the \`flake-inputs-update\` workflow: one issue per workflow, edited in place on every failed attempt, and closed by the next successful update."
+            echo
+            echo "Attempts: ${attempts}"
+            echo "First failure: ${first_failure}"
+            echo "Last failure: ${now}"
+            echo "Latest attempted: openchamber \`${NEW_OC_REV}\`, opencode \`${NEW_OPENCODE_REV}\`"
+            echo "Latest run: ${RUN_URL}"
+            echo
+            echo "## Failure history"
+            cat "${history_file}"
+            cat "${entry_file}"
+          } > "${body_file}"
+          if [ -n "${EXISTING_NUMBER}" ]; then
+            gh issue edit "${EXISTING_NUMBER}" --body-file "${body_file}"
+            echo "Updated failure issue #${EXISTING_NUMBER} (attempt ${attempts})."
+          else
+            gh issue create --title "${FAILURE_ISSUE_TITLE}" --body-file "${body_file}"
+            echo "Opened a new failure issue (attempt ${attempts})."
+          fi
+          exit 1
+
+      - name: Publish and merge the update
+        if: steps.outcome.outputs.result == 'success' && steps.plan.outputs.changed == 'true'
+        env:
+          OLD_OC_REV: ${{ steps.before.outputs.openchamber_rev }}
+          OLD_OPENCODE_REV: ${{ steps.before.outputs.opencode_rev }}
+          NEW_OC_REV: ${{ steps.plan.outputs.openchamber_rev }}
+          NEW_OPENCODE_REV: ${{ steps.plan.outputs.opencode_rev }}
+          EXISTING_NUMBER: ${{ steps.failure-issue.outputs.number }}
+        run: |
+          branch="automation/flake-inputs-update-$(date -u +%Y%m%d)-${GITHUB_RUN_ID}"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -b "${branch}"
+          git add flake.lock
+          git commit -m "chore(deps): update openchamber to ${NEW_OC_REV:0:12} and opencode to ${NEW_OPENCODE_REV:0:12}"
+          git push origin "${branch}"
+          pr_body="$RUNNER_TEMP/pr-body.md"
+          {
+            echo "Automated update of the \`openchamber\` and \`opencode\` flake inputs, produced by the \`flake-inputs-update\` workflow. The openchamber input's \`inputs.opencode.follows = \"opencode\"\` is unchanged, so OpenChamber is evaluated against this same opencode pin."
+            echo
+            echo "- openchamber: \`${OLD_OC_REV}\` → \`${NEW_OC_REV}\`"
+            echo "- opencode: \`${OLD_OPENCODE_REV}\` → \`${NEW_OPENCODE_REV}\`"
+            echo "- Validation in this run: the flake evaluates, including the openchamber and opencode package outputs and the default dev shell. This repo has no OpenChamber-specific test suite, so no tests were run."
+            echo "- Run: ${RUN_URL}"
+            if [ -n "${EXISTING_NUMBER}" ]; then
+              echo
+              echo "Fixes #${EXISTING_NUMBER}"
+            fi
+          } > "${pr_body}"
+          pr_url=$(gh pr create --base main --head "${branch}" \
+            --title "chore(deps): update openchamber to ${NEW_OC_REV:0:12} and opencode to ${NEW_OPENCODE_REV:0:12}" \
+            --body-file "${pr_body}")
+          pr_number="${pr_url##*/}"
+          echo "Opened PR #${pr_number}: ${pr_url}"
+          merged="false"
+          if gh pr merge "${pr_number}" --merge; then
+            merged="true"
+            echo "PR #${pr_number} merged directly."
+          else
+            gh pr merge "${pr_number}" --auto --merge
+            echo "Direct merge was refused; auto-merge enabled for PR #${pr_number}."
+          fi
+          if [ -n "${EXISTING_NUMBER}" ]; then
+            if [ "${merged}" = "true" ]; then
+              merge_commit=$(gh pr view "${pr_number}" --json mergeCommit --jq .mergeCommit.oid)
+              state=$(gh issue view "${EXISTING_NUMBER}" --json state --jq .state)
+              if [ "${state}" = "OPEN" ]; then
+                gh issue comment "${EXISTING_NUMBER}" --body "Resolved: openchamber \`${NEW_OC_REV}\` and opencode \`${NEW_OPENCODE_REV}\` validate against this flake. Merged in #${pr_number} (merge commit \`${merge_commit}\`). Run: ${RUN_URL}"
+                gh issue close "${EXISTING_NUMBER}" --reason completed
+              fi
+              echo "Failure issue #${EXISTING_NUMBER} closed."
+            else
+              gh issue comment "${EXISTING_NUMBER}" --body "Fixed by PR #${pr_number}: openchamber \`${NEW_OC_REV}\` and opencode \`${NEW_OPENCODE_REV}\` validate against this flake (run: ${RUN_URL}). The PR carries a \`Fixes #${EXISTING_NUMBER}\` line and is set to auto-merge; this issue closes when it lands."
+              echo "Failure issue #${EXISTING_NUMBER} will close when PR #${pr_number} merges."
+            fi
+          fi
+
+      - name: Close the failure issue (pins already current)
+        if: steps.outcome.outputs.result == 'success' && steps.plan.outputs.changed == 'false' && steps.failure-issue.outputs.number != ''
+        env:
+          EXISTING_NUMBER: ${{ steps.failure-issue.outputs.number }}
+          NEW_OC_REV: ${{ steps.plan.outputs.openchamber_rev }}
+          NEW_OPENCODE_REV: ${{ steps.plan.outputs.opencode_rev }}
+        run: |
+          gh issue comment "${EXISTING_NUMBER}" --body "Resolved without a new PR: main already pins openchamber \`${NEW_OC_REV}\` and opencode \`${NEW_OPENCODE_REV}\`, and this run verified the flake evaluates with them, including the openchamber and opencode package outputs. Run: ${RUN_URL}"
+          gh issue close "${EXISTING_NUMBER}" --reason completed
+          echo "Failure issue #${EXISTING_NUMBER} closed."