From 1a7c4cb6a9a6714c10516572ea3320e44d323172 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Wed, 15 Jul 2026 16:25:46 +0300 Subject: [PATCH 1/3] ci: fix update-flake-lock PR creation (duplicate auth header) checkout@v6 persists credentials that collide with the auth header set by create-pull-request, producing a duplicate Authorization header and a HTTP 400 on push. Disable credential persistence since create-pull-request supplies its own token. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/update-flake-lock.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml index 5093b73cd5..6b8aed2099 100644 --- a/.github/workflows/update-flake-lock.yml +++ b/.github/workflows/update-flake-lock.yml @@ -14,6 +14,11 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + with: + # create-pull-request supplies its own auth via the `token` input. + # Leaving checkout's credentials persisted causes a duplicate + # Authorization header with checkout v6+ and a HTTP 400 on push. + persist-credentials: false - name: Install Nix uses: ./.github/actions/nix-install-ephemeral From efe30517f6371d40013d10e3b2d25cad7ea3acd2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Thu, 16 Jul 2026 20:20:14 +0300 Subject: [PATCH 2/3] ci: use update-flake-lock action with a GitHub App token Switch to DeterminateSystems/update-flake-lock for better ergonomics and authenticate via actions/create-github-app-token. A GitHub App token is required because the org disables "Allow GitHub Actions to create and approve pull requests", so GITHUB_TOKEN cannot open the PR. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/update-flake-lock.yml | 43 ++++++++++--------------- 1 file changed, 17 insertions(+), 26 deletions(-) diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml index 6b8aed2099..cf21271934 100644 --- a/.github/workflows/update-flake-lock.yml +++ b/.github/workflows/update-flake-lock.yml @@ -12,39 +12,30 @@ jobs: contents: write pull-requests: write steps: + - name: Generate app token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ secrets.UPDATE_APP_ID }} + private-key: ${{ secrets.UPDATE_APP_PRIVATE_KEY }} + - name: Checkout repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: - # create-pull-request supplies its own auth via the `token` input. - # Leaving checkout's credentials persisted causes a duplicate - # Authorization header with checkout v6+ and a HTTP 400 on push. - persist-credentials: false + token: ${{ steps.app-token.outputs.token }} - name: Install Nix uses: ./.github/actions/nix-install-ephemeral - - name: Update critical flake inputs - run: | - nix flake update \ - nixpkgs \ - rust-overlay \ - multigres \ - nix-eval-jobs - - - name: Create Pull Request - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + - name: Update flake.lock and open PR + uses: DeterminateSystems/update-flake-lock@834c491b2ece4de0bbd00d85214bb5e83b4da5c6 # v28 with: - token: ${{ secrets.GITHUB_TOKEN }} - commit-message: "chore: update flake.lock (monthly)" - title: "chore: update flake.lock (monthly)" - body: | - Automated monthly update of critical flake inputs: - - `nixpkgs` (nixos-unstable channel) - - `rust-overlay` - - `multigres` - - `nix-eval-jobs` - branch: auto-update-flake-lock - base: develop - labels: | + token: ${{ steps.app-token.outputs.token }} + inputs: nixpkgs rust-overlay multigres nix-eval-jobs + commit-msg: "chore: update flake.lock (monthly)" + pr-title: "chore: update flake.lock (monthly)" + pr-labels: | dependencies automated + branch: auto-update-flake-lock + base: develop From 3a4e190d25fb3e0b56a408c529a271ff5ca19377 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Wed, 22 Jul 2026 01:51:44 +0300 Subject: [PATCH 3/3] ci: use client-id input for create-github-app-token (app-id deprecated) --- .github/workflows/update-flake-lock.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml index cf21271934..27ca4b55a7 100644 --- a/.github/workflows/update-flake-lock.yml +++ b/.github/workflows/update-flake-lock.yml @@ -16,7 +16,7 @@ jobs: id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ secrets.UPDATE_APP_ID }} + client-id: ${{ secrets.UPDATE_APP_ID }} private-key: ${{ secrets.UPDATE_APP_PRIVATE_KEY }} - name: Checkout repository