From 43cb3d88dd2161fb1d14b8e016a70158067ae54f Mon Sep 17 00:00:00 2001 From: Sam Estep Date: Sun, 5 Jul 2026 10:46:25 -0400 Subject: [PATCH 1/2] Add per-package diffs to update PR body Build the current and updated closures for each machine and run `nix store diff-closures` to produce the same fine-grained version diffs that `nh {os,home} switch` shows, then include them in the update PR body (and the run's step summary). Also adds a `pull_request` trigger scoped to this workflow so the rendered Markdown can be previewed in the step summary before merge; on PR previews the create-pull-request step is skipped. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_015MdeUZ7q1EdciK4Bax5RYu --- .github/workflows/update.yml | 128 +++++++++++++++++------------------ 1 file changed, 62 insertions(+), 66 deletions(-) diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml index 7de9041..b0737bd 100644 --- a/.github/workflows/update.yml +++ b/.github/workflows/update.yml @@ -3,6 +3,11 @@ on: schedule: - cron: "0 9 * * *" workflow_dispatch: + # Preview scaffolding: run on PRs that touch this workflow so the rendered + # Markdown can be inspected in the step summary before merging. + pull_request: + paths: + - .github/workflows/update.yml permissions: contents: write @@ -22,99 +27,90 @@ jobs: flake.lock nix-flake-update.txt - nixos: + build: needs: lock - runs-on: ubuntu-24.04 - steps: - - uses: cachix/install-nix-action@v31 - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v8 - with: - name: flake.lock - - run: nix build --print-build-logs .#nixosConfigurations.nixos.config.system.build.toplevel - - hm-nixos: - needs: lock - runs-on: ubuntu-24.04 - steps: - - uses: cachix/install-nix-action@v31 - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v8 - with: - name: flake.lock - - run: nix build --print-build-logs .#homeConfigurations.sam.activationPackage - - hm-macos: - needs: lock - runs-on: macos-26 - steps: - - uses: cachix/install-nix-action@v31 - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v8 - with: - name: flake.lock - - run: nix build --print-build-logs .#homeConfigurations.samueles.activationPackage - - hm-docker-x86: - needs: lock - runs-on: ubuntu-24.04 - steps: - - uses: cachix/install-nix-action@v31 - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v8 - with: - name: flake.lock - - run: nix build --print-build-logs .#homeConfigurations.agent-amd64.activationPackage - - hm-docker-arm: - needs: lock - runs-on: ubuntu-24.04-arm + strategy: + fail-fast: false + matrix: + include: + - { name: nixos, os: ubuntu-24.04, attr: nixosConfigurations.nixos.config.system.build.toplevel } + - { name: sam, os: ubuntu-24.04, attr: homeConfigurations.sam.activationPackage } + - { name: samueles, os: macos-26, attr: homeConfigurations.samueles.activationPackage } + - { name: agent-amd64, os: ubuntu-24.04, attr: homeConfigurations.agent-amd64.activationPackage } + - { name: agent-arm64, os: ubuntu-24.04-arm, attr: homeConfigurations.agent-arm64.activationPackage } + - { name: admin, os: macos-26, attr: homeConfigurations.admin.activationPackage } + runs-on: ${{ matrix.os }} steps: - uses: cachix/install-nix-action@v31 - uses: actions/checkout@v6 + # Build the current closure first, while the checked-out flake.lock is + # still the one from the base branch. + - name: Build current closure + run: echo "OLD=$(nix build --print-build-logs --no-link --print-out-paths '.#${{ matrix.attr }}')" >> "$GITHUB_ENV" - uses: actions/download-artifact@v8 with: name: flake.lock - - run: nix build --print-build-logs .#homeConfigurations.agent-arm64.activationPackage - - hm-tart: - needs: lock - runs-on: macos-26 - steps: - - uses: cachix/install-nix-action@v31 - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v8 + - name: Build updated closure + run: echo "NEW=$(nix build --print-build-logs --no-link --print-out-paths '.#${{ matrix.attr }}')" >> "$GITHUB_ENV" + - name: Diff closures + run: nix store diff-closures "$OLD" "$NEW" | tee "${{ matrix.name }}.diff" + - uses: actions/upload-artifact@v7 with: - name: flake.lock - - run: nix build --print-build-logs .#homeConfigurations.admin.activationPackage + name: diff-${{ matrix.name }} + path: ${{ matrix.name }}.diff pr: needs: - lock - - nixos - - hm-nixos - - hm-macos - - hm-docker-x86 - - hm-docker-arm - - hm-tart + - build runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v6 - uses: actions/download-artifact@v8 with: name: flake.lock + path: ${{ runner.temp }}/lock + - uses: actions/download-artifact@v8 + with: + pattern: diff-* + merge-multiple: true + path: ${{ runner.temp }}/diffs - name: Generate pull request body id: body run: | + cp "$RUNNER_TEMP/lock/flake.lock" flake.lock { - echo 'body<$name" + echo + echo '```' + if [ -s "$f" ]; then cat "$f"; else echo 'No changes.'; fi + echo '```' + echo + echo '' + done + } > "$RUNNER_TEMP/body.md" + cat "$RUNNER_TEMP/body.md" >> "$GITHUB_STEP_SUMMARY" + { + echo 'body<> "$GITHUB_OUTPUT" - - uses: peter-evans/create-pull-request@v8 + # On real (scheduled / manual) runs, open the update PR with the same body + # that was just written to the step summary. Skipped for PR previews. + - if: github.event_name != 'pull_request' + uses: peter-evans/create-pull-request@v8 with: commit-message: Update `flake.lock` branch: update From 71343a798e07d08487c12baab69ea1151185bf75 Mon Sep 17 00:00:00 2001 From: Sam Estep Date: Sun, 5 Jul 2026 21:52:30 -0400 Subject: [PATCH 2/2] Use dix for package diffs `nh` renders its package diffs with dix, so use the same tool here for output matching what `nh {os,home} switch` shows. dix is packaged in nixpkgs, and `--color never` keeps ANSI escape codes out of the diff artifacts -- unlike `nix store diff-closures`, which emits color even when writing to a pipe. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_015MdeUZ7q1EdciK4Bax5RYu --- .github/workflows/update.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml index b0737bd..2a9002e 100644 --- a/.github/workflows/update.yml +++ b/.github/workflows/update.yml @@ -53,7 +53,11 @@ jobs: - name: Build updated closure run: echo "NEW=$(nix build --print-build-logs --no-link --print-out-paths '.#${{ matrix.attr }}')" >> "$GITHUB_ENV" - name: Diff closures - run: nix store diff-closures "$OLD" "$NEW" | tee "${{ matrix.name }}.diff" + # Use dix (the same tool `nh` uses) so the diff matches what + # `nh {os,home} switch` shows. `--color never` keeps ANSI escape codes + # out of the artifact; `nix store diff-closures` emits them even to a + # pipe (https://github.com/NixOS/nix/blob/master/src/nix/diff-closures.cc). + run: nix run nixpkgs#dix -- --color never "$OLD" "$NEW" | tee "${{ matrix.name }}.diff" - uses: actions/upload-artifact@v7 with: name: diff-${{ matrix.name }}