automatically tag releases when a new cli version is released (#4)

Adds a workflow that runs daily, and creates new tagged commits when a new CLi version is found.

.github/workflows/check-for-updates.yml

@@ -0,0 +1,54 @@
+# Checks for new CLI releases. If one is found updates the package in this repo
+# to pont to the latest version, creates a new commit, and tags it with the CLI
+# version.
+name: Check for updates
+
+on:
+  schedule:
+    - cron: '15 0 * * *'
+
+jobs:
+  check_for_updates:
+    name: Check for updates
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout 🛎️
+        uses: actions/[email protected]
+
+      - name: Install Nix ❄
+        uses: DeterminateSystems/nix-installer-action@v4
+
+      - name: Update to latest CLI version
+        id: update
+        run: |
+          new_version=$(nix run .#update)
+          echo "VERSION=$new_version" >> $GITHUB_OUTPUT
+
+      - name: run checks 🔨
+        run: nix flake check
+
+      # And then we commit the changes
+
+      - name: Set up Git Config
+        run: |
+          git config user.name "automatic-updater"
+          git config user.email "[email protected]"
+
+      - name: Commit changes
+        env:
+          VERSION: ${{ steps.update.outputs.VERSION }}
+        run: |
+          git add .
+          # Skip committing or pushing if there are no changes
+          if [[ $(git status -s) ]]; then
+            branch="$(git branch --show-current)"
+            tag="$VERSION"
+            git commit -m "update to $VERSION"
+            git tag "$tag"
+            git push --atomic origin "$branch" "$tag"
+            echo "Created an update commit, and created tag, $tag"
+          else
+            echo "No new CLI release today"
+          fi

.github/workflows/test.yml

@@ -0,0 +1,22 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - main
+      - 'v*'
+  pull_request:
+
+jobs:
+  tests:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout 🛎️
+        uses: actions/[email protected]
+
+      - name: Install Nix ❄
+        uses: DeterminateSystems/nix-installer-action@v4
+
+      - name: run checks 🔨
+        run: nix flake check

.gitignore

@@ -0,0 +1 @@
+/result

README.md

@@ -52,9 +52,8 @@ packages to the latest CLI version run the update script:
 $ nix run .#update
 ```
 
-This requires read access to the CLI source repository to get a list of tags. It
-is also possible to update without repository access by specifying a specific
-version:
+Or to create packaging for a specific version provide the version string as an
+argument:
 
 ```
 $ nix run .#update v2.15.0

flake.nix

@@ -25,8 +25,8 @@
             update = pkgs.writeShellApplication {
               name = "update";
               runtimeInputs = with pkgs; [
-                common-updater-scripts # provides list-git-tags
                 coreutils
+                curl
                 gnugrep
                 jq
               ];
@@ -37,6 +37,11 @@
             };
           };
 
+          checks = {
+            default = pkgs.callPackage ./packages/check.nix {
+              ddn = self.packages.${system}.ddn;
+            };
+          };
         }) // {
 
       overlays.default = final: prev: {

packages/check.nix

@@ -0,0 +1,39 @@
+# Checks that the ddn package builds and contains the expected version string.
+# If this derivation fails to build that means something is wrong.
+{ ddn
+, bintools
+, coreutils
+, gnugrep
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation {
+  name = "ddn-checks";
+  src = ./.;
+  buildInputs = [
+    bintools # provides `strings` command
+    coreutils
+    gnugrep
+  ];
+  buildPhase = ''
+    expected_version="${ddn.version}"
+
+    # Scan the binary for the version number instead of running `ddn --version`
+    # because when the program runs it connects to the internet to check for an
+    # updated version, and that doesn't work in the nix build sandbox.
+    actual_version="$(strings ${ddn}/bin/ddn | grep -Po '(?<=BuildVersion=)\S+' | head -n1)"
+
+    if [ "$expected_version" != "$actual_version" ]; then
+      echo "Expected version: $expected_version"
+      echo "Actual version: $actual_version"
+      echo
+      echo 'You might see this error if you updated "version" in packages/ddn.nix, but did not update hashes correctly.'
+      exit 1
+    fi
+
+    echo "ok! ddn's reported version matches the expected version, $expected_version"
+  '';
+  installPhase = ''
+    echo "ok" > "$out"
+  '';
+}

scripts/update.sh

@@ -1,34 +1,22 @@
 # Automatically updates ddn.nix to build the given version of the CLI. Run with
 # an argument to specify a specific version, e.g. v2.15.0. Or run without
-# arguments to automatically select the latest version (requires read access to
-# the CLI repo).
+# arguments to automatically select the latest version.
 #
 # Run this script through its nix package:
 #
 #     $ nix run .#update
 #
-# Assumes that these environment variables are set:
-#
-# - BINARY_URL_PATTERN
 
 if [ $# -eq 0 ]; then
   VERSION=""
 else
   VERSION="$1"
 fi
 
-REPO_URL="${REPO_URL:="[email protected]:hasura/v3-cli-go.git"}";
 PACKAGE_EXPRESSION="${PACKAGE_EXPRESSION:="packages/ddn.nix"}";
 
-function list-tags() {
-  list-git-tags --url="$REPO_URL" \
-    | grep -E "^v[0-9.]+$" # excludes pre-releases
-}
-
 function latest-tag() {
-  list-tags \
-    | sort --version-sort --reverse \
-    | head --lines=1
+  curl "https://graphql-engine-cdn.hasura.io/ddn/cli/v4/latest.json" | jq -r .latest
 }
 
 function fetch-hash() {