ci: add manual nixpkgs version-bump dispatch workflow

.github/workflows/nixpkgs-update.yml

@@ -0,0 +1,95 @@
+name: nixpkgs update
+
+# Manually-triggered accelerator that opens (or UPDATES) a single version-bump
+# PR for `togl` and `libtogl` on NixOS/nixpkgs.
+#
+# Posture: the PRIMARY update path is the r-ryantm bot, enabled by
+# `passthru.updateScript = nix-update-script { }` on both derivations — it
+# auto-opens bump PRs after releases with no action from you. This workflow is
+# the OPTIONAL accelerator for when you want a bump faster than the bot.
+#
+# Rapid successive releases are handled by re-using a fixed head branch
+# (`nixpkgs-auto-update/togl`): a second run UPDATES the same open PR in place
+# rather than opening a duplicate — so you never have to invalidate a prior PR.
+#
+# Prerequisites before this can run:
+#   1. `togl` / `libtogl` must already exist on nixpkgs master (initial PR merged).
+#   2. Repo secret `NIXPKGS_UPDATE_TOKEN`: a PAT for an account that has a fork
+#      at `smorin/nixpkgs`, with `repo` scope (push to the fork + open the PR).
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to bump to (e.g. 0.6.0). Blank = auto-detect latest release."
+        required: false
+        type: string
+      dry_run:
+        description: "Compute the bump and print the diff, but do not open a PR."
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  bump:
+    name: Bump togl + libtogl in nixpkgs
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      # Base the PR on the live nixpkgs master so it stays mergeable; full
+      # history lets create-pull-request branch cleanly.
+      - name: Check out nixpkgs master
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          repository: NixOS/nixpkgs
+          ref: master
+          fetch-depth: 0
+
+      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+
+      - name: Record current version
+        id: before
+        run: |
+          old=$(grep -oP 'version = "\K[^"]+' pkgs/by-name/to/togl/package.nix)
+          echo "version=$old" >> "$GITHUB_OUTPUT"
+
+      # nix-update bumps the version and recomputes src hash + cargoHash, and
+      # builds the package to verify them. togl and libtogl share a source and
+      # version, so each is updated to the same release.
+      - name: Bump togl and libtogl
+        run: |
+          args=()
+          if [ -n "${{ inputs.version }}" ]; then args+=(--version "${{ inputs.version }}"); fi
+          nix run nixpkgs#nix-update -- "${args[@]}" togl
+          nix run nixpkgs#nix-update -- "${args[@]}" libtogl
+
+      - name: Record new version
+        id: after
+        run: |
+          new=$(grep -oP 'version = "\K[^"]+' pkgs/by-name/to/togl/package.nix)
+          echo "version=$new" >> "$GITHUB_OUTPUT"
+
+      - name: Show diff
+        run: git diff
+
+      - name: Open or update the bump PR
+        if: ${{ !inputs.dry_run }}
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.NIXPKGS_UPDATE_TOKEN }}
+          push-to-fork: smorin/nixpkgs
+          branch: nixpkgs-auto-update/togl
+          base: master
+          delete-branch: true
+          commit-message: "togl,libtogl: ${{ steps.before.outputs.version }} -> ${{ steps.after.outputs.version }}"
+          title: "togl,libtogl: ${{ steps.before.outputs.version }} -> ${{ steps.after.outputs.version }}"
+          body: |
+            Automated version bump for `togl` and `libtogl`
+            (`${{ steps.before.outputs.version }}` → `${{ steps.after.outputs.version }}`).
+
+            Generated by the upstream repo's `nixpkgs update` workflow via `nix-update`
+            (recomputes `hash` + `cargoHash`, builds to verify). This is the maintainer's
+            fast path; the r-ryantm bot remains the automatic backstop.