From 74f17dcb8c14aa0e28cb64e8b3ce031520b03ed8 Mon Sep 17 00:00:00 2001 From: Scott Lougheed Date: Tue, 21 Jul 2026 15:14:56 -0700 Subject: [PATCH 1/8] fixing branch detection logic --- .github/workflows/update-flake-dependencies.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index 9bf968f3..471c3f88 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -30,7 +30,7 @@ jobs: # if branch exists on remote already BRANCH_EXISTS=false if git checkout "$COMMIT_BRANCH" > /dev/null 2>&1; then - # pull changeshttps://github.com/1Password/shell-plugins/pull/595 + # pull changes git pull BRANCH_EXISTS=true else @@ -48,7 +48,8 @@ jobs: --field content="$(base64 -w 0 $FILE_TO_COMMIT)" \ --field branch="$COMMIT_BRANCH" \ --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" - if [ "$BRANCH_EXISTS" = "false" ]; then + OPEN_PR_COUNT=$(gh pr list --head "$COMMIT_BRANCH" --state open --json number --jq 'length') + if [ "$OPEN_PR_COUNT" -eq 0]; then gh pr create --title "[automation]: Update Flake dependencies" \ --body "This is an automated PR to update \`flake.lock\`" \ --label "flake.lock automation" \ From 943410ea11b76cd9ee72624ea0b8538541495eba Mon Sep 17 00:00:00 2001 From: Scott Lougheed Date: Tue, 21 Jul 2026 15:18:58 -0700 Subject: [PATCH 2/8] updating reviewer list --- .github/workflows/update-flake-dependencies.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index 471c3f88..f023e02c 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -53,7 +53,7 @@ jobs: gh pr create --title "[automation]: Update Flake dependencies" \ --body "This is an automated PR to update \`flake.lock\`" \ --label "flake.lock automation" \ - --reviewer mrjones2014 \ + --reviewer scottisloud,bertrmz,jillregan,rishiy15 \ --base main --head $COMMIT_BRANCH fi fi From 1885a9552ee3a6a10af124ba9035cdc648d99f6d Mon Sep 17 00:00:00 2001 From: Scott Lougheed Date: Tue, 21 Jul 2026 15:22:12 -0700 Subject: [PATCH 3/8] fixing syntax errors, removing dead code --- .github/workflows/update-flake-dependencies.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index f023e02c..ca5363c4 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -28,11 +28,9 @@ jobs: # fetch remote state git fetch # if branch exists on remote already - BRANCH_EXISTS=false if git checkout "$COMMIT_BRANCH" > /dev/null 2>&1; then # pull changes git pull - BRANCH_EXISTS=true else # otherwise, create the branch and push it to remote git checkout -b "$COMMIT_BRANCH" @@ -49,7 +47,7 @@ jobs: --field branch="$COMMIT_BRANCH" \ --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" OPEN_PR_COUNT=$(gh pr list --head "$COMMIT_BRANCH" --state open --json number --jq 'length') - if [ "$OPEN_PR_COUNT" -eq 0]; then + if [ "$OPEN_PR_COUNT" -eq 0 ]; then gh pr create --title "[automation]: Update Flake dependencies" \ --body "This is an automated PR to update \`flake.lock\`" \ --label "flake.lock automation" \ From c89ec70529c17592a5ec96ee21956b28c2018117 Mon Sep 17 00:00:00 2001 From: Scott Lougheed Date: Wed, 22 Jul 2026 15:50:35 -0700 Subject: [PATCH 4/8] adding draft updated workflow with token minting --- .../workflows/update-flake-dependencies.yml | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index ca5363c4..161fc446 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -13,14 +13,23 @@ jobs: with: egress-policy: audit + - name: Generate GitHub App installation token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ secrets.FLAKE_BOT_APP_ID }} + private-key: ${{ secrets.FLAKE_BOT_APP_PRIVATE_KEY }} + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + token: ${{ steps.app-token.outputs.token }} - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 with: use-flakehub: false - name: Update flake.lock and create signed commit with flake.lock changes env: - GITHUB_TOKEN: ${{ secrets.OP_BOT_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} FILE_TO_COMMIT: flake.lock COMMIT_BRANCH: automation/update-flake-dependencies COMMIT_MESSAGE: "chore(nix): Update Flake dependencies" @@ -28,9 +37,11 @@ jobs: # fetch remote state git fetch # if branch exists on remote already + BRANCH_EXISTS=false if git checkout "$COMMIT_BRANCH" > /dev/null 2>&1; then - # pull changes + # pull changeshttps://github.com/1Password/shell-plugins/pull/595 git pull + BRANCH_EXISTS=true else # otherwise, create the branch and push it to remote git checkout -b "$COMMIT_BRANCH" @@ -46,12 +57,11 @@ jobs: --field content="$(base64 -w 0 $FILE_TO_COMMIT)" \ --field branch="$COMMIT_BRANCH" \ --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" - OPEN_PR_COUNT=$(gh pr list --head "$COMMIT_BRANCH" --state open --json number --jq 'length') - if [ "$OPEN_PR_COUNT" -eq 0 ]; then + if [ "$BRANCH_EXISTS" = "false" ]; then gh pr create --title "[automation]: Update Flake dependencies" \ --body "This is an automated PR to update \`flake.lock\`" \ --label "flake.lock automation" \ - --reviewer scottisloud,bertrmz,jillregan,rishiy15 \ + --reviewer mrjones2014 \ --base main --head $COMMIT_BRANCH fi fi From 0008344883ccb1417ac6d81ac7e899e8ff9f05b4 Mon Sep 17 00:00:00 2001 From: Scott Lougheed Date: Fri, 24 Jul 2026 09:22:36 -0700 Subject: [PATCH 5/8] updating reviewers --- .github/workflows/update-flake-dependencies.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index 161fc446..2c2c2b8e 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -17,7 +17,7 @@ jobs: id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ secrets.FLAKE_BOT_APP_ID }} + client-id: ${{ secrets.FLAKE_BOT_APP_ID }} private-key: ${{ secrets.FLAKE_BOT_APP_PRIVATE_KEY }} - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 @@ -61,7 +61,7 @@ jobs: gh pr create --title "[automation]: Update Flake dependencies" \ --body "This is an automated PR to update \`flake.lock\`" \ --label "flake.lock automation" \ - --reviewer mrjones2014 \ + --reviewer open-source \ --base main --head $COMMIT_BRANCH fi fi From 989f2f34e5725610d0b4243c3d7950480b5351ca Mon Sep 17 00:00:00 2001 From: Scott Lougheed Date: Fri, 24 Jul 2026 09:32:16 -0700 Subject: [PATCH 6/8] reverting token minting to test PR flow --- .../workflows/update-flake-dependencies.yml | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index 2c2c2b8e..2ee35cd7 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -13,23 +13,14 @@ jobs: with: egress-policy: audit - - name: Generate GitHub App installation token - id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - with: - client-id: ${{ secrets.FLAKE_BOT_APP_ID }} - private-key: ${{ secrets.FLAKE_BOT_APP_PRIVATE_KEY }} - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - token: ${{ steps.app-token.outputs.token }} - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 with: use-flakehub: false - name: Update flake.lock and create signed commit with flake.lock changes env: - GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} + GITHUB_TOKEN: ${{ secrets.OP_BOT_TOKEN }} FILE_TO_COMMIT: flake.lock COMMIT_BRANCH: automation/update-flake-dependencies COMMIT_MESSAGE: "chore(nix): Update Flake dependencies" @@ -37,11 +28,9 @@ jobs: # fetch remote state git fetch # if branch exists on remote already - BRANCH_EXISTS=false if git checkout "$COMMIT_BRANCH" > /dev/null 2>&1; then - # pull changeshttps://github.com/1Password/shell-plugins/pull/595 + # pull changes git pull - BRANCH_EXISTS=true else # otherwise, create the branch and push it to remote git checkout -b "$COMMIT_BRANCH" @@ -57,7 +46,8 @@ jobs: --field content="$(base64 -w 0 $FILE_TO_COMMIT)" \ --field branch="$COMMIT_BRANCH" \ --field sha="$(git rev-parse $COMMIT_BRANCH:$FILE_TO_COMMIT)" - if [ "$BRANCH_EXISTS" = "false" ]; then + OPEN_PR_COUNT=$(gh pr list --head "$COMMIT_BRANCH" --state open --json number --jq 'length') + if [ "$OPEN_PR_COUNT" -eq 0 ]; then gh pr create --title "[automation]: Update Flake dependencies" \ --body "This is an automated PR to update \`flake.lock\`" \ --label "flake.lock automation" \ From 7e4e122e97844c47ec75f601c67b96863a3e844a Mon Sep 17 00:00:00 2001 From: Scott Lougheed Date: Fri, 24 Jul 2026 09:36:44 -0700 Subject: [PATCH 7/8] correcting team name --- .github/workflows/update-flake-dependencies.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index 2ee35cd7..240f0175 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -51,7 +51,7 @@ jobs: gh pr create --title "[automation]: Update Flake dependencies" \ --body "This is an automated PR to update \`flake.lock\`" \ --label "flake.lock automation" \ - --reviewer open-source \ + --reviewer 1password/open-source \ --base main --head $COMMIT_BRANCH fi fi From 7a339318c769611f1cafdc53f5175d0debeeaecd Mon Sep 17 00:00:00 2001 From: Scott Lougheed Date: Fri, 24 Jul 2026 10:01:37 -0700 Subject: [PATCH 8/8] restoring preliminary app token minting step --- .github/workflows/update-flake-dependencies.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index 240f0175..d508178b 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -13,14 +13,23 @@ jobs: with: egress-policy: audit + - name: Generate GitHub App installation token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ secrets.FLAKE_BOT_APP_ID }} + private-key: ${{ secrets.FLAKE_BOT_APP_PRIVATE_KEY }} + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + token: ${{ steps.app-token.outputs.token }} - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 with: use-flakehub: false - name: Update flake.lock and create signed commit with flake.lock changes env: - GITHUB_TOKEN: ${{ secrets.OP_BOT_TOKEN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} FILE_TO_COMMIT: flake.lock COMMIT_BRANCH: automation/update-flake-dependencies COMMIT_MESSAGE: "chore(nix): Update Flake dependencies" @@ -51,7 +60,7 @@ jobs: gh pr create --title "[automation]: Update Flake dependencies" \ --body "This is an automated PR to update \`flake.lock\`" \ --label "flake.lock automation" \ - --reviewer 1password/open-source \ + --reviewer 1Password/open-source \ --base main --head $COMMIT_BRANCH fi fi