update-deps.yml

name: Update Flakes
on:
  schedule:
    - cron: "40 0 * * 0"
  workflow_dispatch:
jobs:
  get-flakes:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.get-flakes.outputs.matrix }}
    steps:
      - uses: actions/checkout@v4
      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
        with:
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - name: generate flake matrix
        id: get-flakes
        run: |
          set -euo pipefail

          flakes="$(nix flake metadata --json | jq -rcM '.locks.nodes.root.inputs | {flake: keys}')"
          echo "::set-output name=matrix::$flakes"
  flake-update:
    runs-on: ubuntu-latest
    needs:
      - get-flakes
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.get-flakes.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v4

      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
        with:
          nix_path: nixpkgs=channel:nixos-unstable-small
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}

      - uses: actions/create-github-app-token@v1.9.0
        id: generate-token
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: cpcloud/flake-update-action@v2.0.1
        with:
          dependency: ${{ matrix.flake }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          pull-request-token: ${{ steps.generate-token.outputs.token }}
          pull-request-author: "phillip-ground[bot] <phillip-ground[bot]@users.noreply.github.com>"
          pull-request-labels: dependencies,autorebase:opt-in
          automerge: true
          delete-branch: true