1name: Nixpkgs Bump PR
2
3# Triggers on stable release publish. Opens PR against NixOS/nixpkgs
4# bumping pkgs/by-name/ma/matcha/package.nix to the new version.
5# Requires:
6# - Fork floatpane/nixpkgs to exist
7# - NIXPKGS_BUMP_TOKEN secret: PAT with `repo` scope on floatpane/nixpkgs
8# and permission to open PRs against NixOS/nixpkgs
9# - Initial matcha package already merged into nixpkgs (this workflow updates, not inits)
10
11on:
12 release:
13 types: [published]
14 workflow_dispatch:
15 inputs:
16 version:
17 description: "Version to bump to (without v prefix)"
18 required: true
19
20permissions:
21 contents: read
22
23jobs:
24 bump:
25 runs-on: ubuntu-latest
26 steps:
27 - name: Determine version
28 id: ver
29 run: |
30 if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
31 VERSION="${{ inputs.version }}"
32 else
33 TAG="${{ github.event.release.tag_name }}"
34 VERSION="${TAG#v}"
35 fi
36 # Skip nightly / preview tags
37 if [[ "$VERSION" == nightly* || "$VERSION" == preview* ]]; then
38 echo "Skipping non-stable release: $VERSION"
39 echo "skip=true" >> $GITHUB_OUTPUT
40 else
41 echo "skip=false" >> $GITHUB_OUTPUT
42 fi
43 echo "version=$VERSION" >> $GITHUB_OUTPUT
44
45 - name: Install Nix
46 if: steps.ver.outputs.skip != 'true'
47 uses: cachix/install-nix-action@v31
48 with:
49 extra_nix_config: |
50 experimental-features = nix-command flakes
51
52 - name: Checkout nixpkgs fork
53 if: steps.ver.outputs.skip != 'true'
54 uses: actions/checkout@v6
55 with:
56 repository: floatpane/nixpkgs
57 token: ${{ secrets.HOMEBREW_GITHUB_TOKEN }}
58 path: nixpkgs
59 fetch-depth: 0
60
61 - name: Sync fork with upstream master and fetch staging
62 if: steps.ver.outputs.skip != 'true'
63 working-directory: nixpkgs
64 run: |
65 git config user.name "Floatpane Bot"
66 git config user.email "us@floatpane.com"
67 git remote add upstream https://github.com/NixOS/nixpkgs.git
68 git fetch upstream master staging
69 git checkout master
70 git reset --hard upstream/master
71 git push origin master --force-with-lease
72
73 - name: Get current version (from master)
74 if: steps.ver.outputs.skip != 'true'
75 id: current
76 working-directory: nixpkgs
77 run: |
78 PKG=pkgs/by-name/ma/matcha/package.nix
79 OLD=$(grep -E '^\s*version\s*=\s*"' "$PKG" | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
80 echo "old=$OLD" >> $GITHUB_OUTPUT
81
82 - name: Checkout staging for build verification
83 if: steps.ver.outputs.skip != 'true'
84 working-directory: nixpkgs
85 run: |
86 # Build against staging (has newer go) — final PR branch is rebased onto master later.
87 git checkout -B build-staging upstream/staging
88
89 - name: Set bump branch name
90 if: steps.ver.outputs.skip != 'true'
91 run: |
92 BRANCH="matcha-${{ steps.ver.outputs.version }}"
93 echo "BRANCH=$BRANCH" >> $GITHUB_ENV
94
95 - name: Bump version and reset hashes
96 if: steps.ver.outputs.skip != 'true'
97 working-directory: nixpkgs
98 run: |
99 PKG=pkgs/by-name/ma/matcha/package.nix
100 NEW="${{ steps.ver.outputs.version }}"
101 # Replace version line
102 sed -i -E "s/(version\s*=\s*\")[^\"]+(\")/\1$NEW\2/" "$PKG"
103 # Reset src hash + vendorHash to fakeHash so nix build prints real ones
104 sed -i -E 's|hash = "sha256-[A-Za-z0-9+/=]+"|hash = lib.fakeHash|' "$PKG"
105 sed -i -E 's|vendorHash = "sha256-[A-Za-z0-9+/=]+"|vendorHash = lib.fakeHash|' "$PKG"
106
107 - name: Build to extract src hash
108 if: steps.ver.outputs.skip != 'true'
109 id: src_hash
110 working-directory: nixpkgs
111 run: |
112 set +e
113 OUT=$(nix-build -A matcha --no-out-link 2>&1)
114 RC=$?
115 echo "$OUT"
116 HASH=$(echo "$OUT" | grep -oE 'got:[[:space:]]+sha256-[A-Za-z0-9+/=]+' | head -1 | awk '{print $2}')
117 if [ -z "$HASH" ]; then
118 echo "Failed to extract src hash"; exit 1
119 fi
120 echo "hash=$HASH" >> $GITHUB_OUTPUT
121 sed -i -E "s|hash = lib.fakeHash|hash = \"$HASH\"|" pkgs/by-name/ma/matcha/package.nix
122
123 - name: Build to extract vendorHash
124 if: steps.ver.outputs.skip != 'true'
125 working-directory: nixpkgs
126 run: |
127 set +e
128 OUT=$(nix-build -A matcha --no-out-link 2>&1)
129 RC=$?
130 echo "$OUT"
131 HASH=$(echo "$OUT" | grep -oE 'got:[[:space:]]+sha256-[A-Za-z0-9+/=]+' | head -1 | awk '{print $2}')
132 if [ -z "$HASH" ]; then
133 echo "Failed to extract vendorHash"; exit 1
134 fi
135 sed -i -E "s|vendorHash = lib.fakeHash|vendorHash = \"$HASH\"|" pkgs/by-name/ma/matcha/package.nix
136
137 - name: Final build (sanity check)
138 if: steps.ver.outputs.skip != 'true'
139 working-directory: nixpkgs
140 run: nix-build -A matcha --no-out-link
141
142 - name: Move final package.nix onto master-based bump branch
143 if: steps.ver.outputs.skip != 'true'
144 working-directory: nixpkgs
145 run: |
146 PKG=pkgs/by-name/ma/matcha/package.nix
147 cp "$PKG" /tmp/package.nix.new
148 git checkout -- "$PKG"
149 git checkout master
150 git checkout -B "$BRANCH"
151 cp /tmp/package.nix.new "$PKG"
152
153 - name: Commit and push
154 if: steps.ver.outputs.skip != 'true'
155 working-directory: nixpkgs
156 run: |
157 git add pkgs/by-name/ma/matcha/package.nix
158 git commit -m "matcha: ${{ steps.current.outputs.old }} -> ${{ steps.ver.outputs.version }}"
159 git push -u origin "$BRANCH" --force-with-lease
160
161 - name: Open PR against NixOS/nixpkgs
162 if: steps.ver.outputs.skip != 'true'
163 env:
164 GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_TOKEN }}
165 working-directory: nixpkgs
166 run: |
167 BODY=$(cat <<EOF
168 ## Description
169
170 Automated version bump for \`matcha\` email client.
171
172 - Old: ${{ steps.current.outputs.old }}
173 - New: ${{ steps.ver.outputs.version }}
174 - Upstream release: https://github.com/floatpane/matcha/releases/tag/v${{ steps.ver.outputs.version }}
175
176 ## Things done
177
178 - Built on \`x86_64-linux\` via GitHub Actions
179 - Hashes regenerated from upstream tarball
180 - No package metadata changes beyond version + hashes
181
182 cc maintainer for review.
183 EOF
184 )
185 gh pr create \
186 --repo NixOS/nixpkgs \
187 --base master \
188 --head "floatpane:$BRANCH" \
189 --title "matcha: ${{ steps.current.outputs.old }} -> ${{ steps.ver.outputs.version }}" \
190 --body "$BODY"