Automatic NixOS Upgrades with Forgejo Actions

name: Update Flake Inputs

on:
  schedule:
    - cron: "0 4 * * *" # Run daily at 04:00 UTC — one hour before hosts auto-upgrade.
  workflow_dispatch: # Allow triggering manually from the Forgejo UI.

jobs:
  update:
    name: Update flake.lock and diff all hosts
    runs-on: nixos-builder # A native NixOS runner — leverages the host Nix store as cache.
    steps:
      # --- 1. SSH setup ---
      # Write the deploy key to a temp file so git can push branches
      # and sign commits over SSH. The key is cleaned up in the final step.
      - name: Configure SSH key for git push and commit signing
        run: |
          SSH_DIR="$RUNNER_TEMP/.ssh"
          mkdir -p "$SSH_DIR"
          echo "${{ secrets.GIT_PRIVATE_KEY }}" > "$SSH_DIR/forgejo_key"
          chmod 600 "$SSH_DIR/forgejo_key"

          # Point git at the deploy key for all SSH operations.
          SSH_BIN="$(command -v ssh)"
          export GIT_SSH_COMMAND="$SSH_BIN -i $SSH_DIR/forgejo_key -o StrictHostKeyChecking=no"

          # Persist into subsequent steps via Forgejo environment file.
          echo "GIT_SSH_COMMAND=$GIT_SSH_COMMAND" >> "$FORGEJO_ENV"
          echo "SSH_KEY_PATH=$SSH_DIR/forgejo_key"  >> "$FORGEJO_ENV"

      - name: Checkout repository
        uses: https://data.forgejo.org/actions/checkout@v6

      # --- 2. Git identity ---
      # Configure the CI bot identity and enable SSH commit signing.
      # ⚠️  Replace remote URL, user.name, and user.email with your values.
      - name: Configure git identity and SSH remote
        run: |
          git config user.name "ci"
          git config user.email "ci@example.com"
          git config gpg.format ssh
          git config user.signingkey "$SSH_KEY_PATH"
          git config commit.gpgsign true
          git remote set-url origin git@your-forgejo:nix/nixos.git

      # --- 3. Discover hosts ---
      # Evaluate the flake to list all nixosConfigurations, filtering out
      # any ending in "-minimal" (installer images, etc.).
      # Adjust the regex to match your naming convention.
      - name: Identify host configurations
        id: hosts
        run: |
          HOSTS=$(nix eval .#nixosConfigurations \
            --apply 'cs: builtins.filter
              (n: builtins.match ".*-minimal" n == null)
              (builtins.attrNames cs)' \
            --json | nix run nixpkgs#jq -- -r '.[]' \
            | tr '\n' ' ')
          echo "Found hosts: $HOSTS"
          echo "list=$HOSTS" >> "$FORGEJO_OUTPUT"

      # --- 4. Snapshot: build BEFORE the update ---
      # Build every host's system closure from the current flake.lock.
      # The result symlinks (result-before-<host>) are kept for diffing later.
      # `|| true` ensures a single failing host doesn't abort the whole run.
      - name: Build current configurations (before update)
        run: |
          for host in ${{ steps.hosts.outputs.list }}; do
            echo "::group::Building current $host"
            nix build \
              ".#nixosConfigurations.$host.config.system.build.toplevel" \
              -o "result-before-$host" || true
            echo "::endgroup::"
          done

      # --- 5. Update flake.lock ---
      # Pull the latest revisions of all flake inputs (nixpkgs, home-manager, etc.).
      - name: Update flake inputs
        run: nix flake update

      # --- 6. Early exit if nothing changed ---
      # If all inputs resolved to the same revisions, skip the rest.
      - name: Check for changes
        id: check
        run: |
          if git diff --quiet flake.lock; then
            echo "changed=false" >> "$FORGEJO_OUTPUT"
            echo "No flake.lock changes — nothing to do."
          else
            echo "changed=true" >> "$FORGEJO_OUTPUT"
          fi

      # --- 7. Snapshot: build AFTER the update & diff ---
      # Rebuild every host with the updated lock file, then compare the
      # before/after store paths using nvd. The diff shows exactly which
      # packages were added, removed, or changed version — the equivalent
      # of comparing two NixOS generations before either is deployed.
      - name: Build updated configurations and generate diffs
        id: diffs
        if: steps.check.outputs.changed == 'true'
        run: |
          DIFF_REPORT=""
          for host in ${{ steps.hosts.outputs.list }}; do
            echo "::group::Building updated $host"
            nix build \
              ".#nixosConfigurations.$host.config.system.build.toplevel" \
              -o "result-after-$host" || true
            echo "::endgroup::"

            # Only diff if both builds succeeded.
            if [ -e "result-before-$host" ] && \
               [ -e "result-after-$host" ]; then
              HOST_DIFF=$(nix run nixpkgs#nvd -- diff \
                "result-before-$host" "result-after-$host" 2>&1 || true)
              DIFF_REPORT="${DIFF_REPORT}### ${host}"$'\n'
              DIFF_REPORT="${DIFF_REPORT}\`\`\`"$'\n'
              DIFF_REPORT="${DIFF_REPORT}${HOST_DIFF}"$'\n'
              DIFF_REPORT="${DIFF_REPORT}\`\`\`"$'\n\n'
            fi
          done

          # Export the full report as a multi-line output variable.
          {
            echo "report<<DIFF_EOF"
            printf '%s' "$DIFF_REPORT"
            echo "DIFF_EOF"
          } >> "$FORGEJO_OUTPUT"

      # --- 8. Open a pull request ---
      # Commit the updated flake.lock to a dated branch, then call the
      # Forgejo API to create a PR whose body contains the per-host diffs.
      # ⚠️  Replace the API URL with your Forgejo instance and repo path.
      - name: Create branch, commit, and open pull request
        if: steps.check.outputs.changed == 'true'
        env:
          DIFF_REPORT: ${{ steps.diffs.outputs.report }}
          FORGEJO_TOKEN: ${{ forgejo.token }} # Provided automatically by Forgejo.
        run: |
          DATE=$(date +%Y-%m-%d)
          BRANCH="auto/flake-update-$DATE"

          # Remove a stale branch from a previous run on the same day.
          git push origin --delete "$BRANCH" 2>/dev/null || true
          git checkout -b "$BRANCH"
          git add flake.lock
          git commit -m "chore: update flake inputs $DATE"
          git push origin "$BRANCH"

          # Compose the PR body with the generation diff report.
          BODY=$(printf '%s\n\n%s\n\n%s\n%s\n%s' \
            "## Automated flake.lock update ($DATE)" \
            "Package changes per host (via nvd):" \
            "$DIFF_REPORT" \
            "---" \
            "*Auto-generated by the update workflow.*")

          # Create the pull request via the Forgejo REST API.
          nix run nixpkgs#curl -- -sf -X POST \
            -H "Authorization: token $FORGEJO_TOKEN" \
            -H "Content-Type: application/json" \
            "https://your-forgejo/api/v1/repos/nix/nixos/pulls" \
            -d "$(nix run nixpkgs#jq -- -n \
              --arg title "chore: update flake inputs $DATE" \
              --arg body "$BODY" \
              --arg head "$BRANCH" \
              --arg base "main" \
              '{title: $title, body: $body, head: $head, base: $base}')"

      # --- 9. Cleanup ---
      # Always remove the SSH key and build symlinks, even on failure.
      - name: Cleanup
        if: always()
        run: |
          rm -f "$SSH_KEY_PATH"
          rm -f result-before-* result-after-*

## Automated flake.lock update (2025-04-12)

Package changes per host (via nvd):

### webserver

  [nvd output showing package upgrades, additions, and removals]

### devbox

  [nvd output for this host]

# modules/auto-upgrade.nix
{
  config,
  lib,
  ...
}:
let
  hostname = config.networking.hostName;
in
{
  options.services.auto-upgrade.enable =
    lib.mkEnableOption "automatic daily flake-based NixOS upgrade";

  config = lib.mkIf config.services.auto-upgrade.enable {
    system.autoUpgrade = {
      enable = true;

      # Fetch the latest main branch from your Git server.
      # Each host selects its own nixosConfiguration by hostname.
      flake = "git+https://your-forgejo/nix/nixos.git#${hostname}";

      # Never update flake.lock on the host — CI handles that.
      flags = [
        "--no-update-lock-file"
      ];

      # Run daily at 05:00 (host-local time), one hour after CI.
      dates = "05:00";

      # Do not reboot automatically.
      # Most services restart on nixos-rebuild switch.
      allowReboot = false;

      # "switch" activates immediately.
      # Use "boot" to defer activation until next reboot.
      operation = "switch";
    };
  };
}

# flake.nix (simplified)
{
  outputs = { nixpkgs, ... }: {
    nixosConfigurations = {
      webserver = nixpkgs.lib.nixosSystem {
        modules = [
          ./modules/auto-upgrade.nix
          ./hosts/webserver
        ];
      };

      devbox = nixpkgs.lib.nixosSystem {
        modules = [
          ./modules/auto-upgrade.nix
          ./hosts/devbox
        ];
      };
    };
  };
}

# hosts/webserver/default.nix
{
  services.auto-upgrade.enable = true;
}

04:00 UTC  Forgejo Actions runs on CI builder
           ├─ nix flake update
           ├─ Build all hosts before & after
           ├─ Generate per-host nvd diffs
           └─ Open PR with diff report

   You     Review PR, check package changes, merge to main

05:00      Each NixOS host (systemd timer)
           ├─ git fetch main (via flake URL)
           ├─ nix build own configuration
           └─ nixos-rebuild switch