Automatic NixOS Upgrades with Forgejo Actions

#!/usr/bin/env bash
#
# Build all NixOS host configurations before and after a flake update,
# then report per-host package diffs via nvd.
#
# Exit codes:
#   0 — at least one host has closure changes (diff report on stdout)
#   1 — unexpected error
#   2 — flake.lock did not change after update
#   3 — flake.lock changed but no host closures differ
#
# Options:
#   --skip-update   Skip 'nix flake update' (useful when flake.lock is
#                   already updated and you just want to diff)
#
set -euo pipefail

SKIP_UPDATE=false
for arg in "$@"; do
  case "$arg" in
    --skip-update) SKIP_UPDATE=true ;;
    *) echo "Unknown option: $arg" >&2; exit 1 ;;
  esac
done

# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------
log()   { echo "  $*" >&2; }
ok()    { echo "  ✓ $*" >&2; }
fail()  { echo "  ✗ $*" >&2; }
# In CI: use ::group::/::endgroup:: for collapsible sections.
# Locally: print readable section headers instead.
if [ -n "${CI:-}" ]; then
  step()     { echo "::group::$1" >&2; }
  endstep()  { echo "::endgroup::" >&2; }
else
  step()     { echo >&2; echo "── $1 ──" >&2; }
  endstep()  { :; }
fi

# ---------------------------------------------------------------------------
# 1. Discover full (non-minimal) host configurations
# ---------------------------------------------------------------------------
step "Discovering hosts"
HOSTS=$(nix eval .#nixosConfigurations \
  --apply 'cs: builtins.filter (n: builtins.match ".*-minimal" n == null) (builtins.attrNames cs)' \
  --json | nix run nixpkgs#jq -- -r '.[]')

if [ -z "$HOSTS" ]; then
  fail "No host configurations found."
  exit 1
fi
HOST_COUNT=$(echo "$HOSTS" | wc -w | tr -d ' ')
log "Found $HOST_COUNT host(s): $(echo "$HOSTS" | tr '\n' ' ')"
endstep

# ---------------------------------------------------------------------------
# 2. Build current (before-update) configurations
# ---------------------------------------------------------------------------
for host in $HOSTS; do
  step "Building current $host"
  nix build ".#nixosConfigurations.$host.config.system.build.toplevel" \
    -o "result-before-$host" || true
  endstep
done

# ---------------------------------------------------------------------------
# 3. Update flake inputs
# ---------------------------------------------------------------------------
if [ "$SKIP_UPDATE" = false ]; then
  step "Updating flake inputs"
  nix flake update
  endstep
fi

# ---------------------------------------------------------------------------
# 4. Check whether flake.lock actually changed
# ---------------------------------------------------------------------------
step "Checking for flake.lock changes"
if git diff --quiet flake.lock 2>/dev/null; then
  ok "No changes — nothing to do."
  endstep
  exit 2
fi
ok "flake.lock has changed, rebuilding hosts."
endstep

# ---------------------------------------------------------------------------
# 5. Build updated configurations and generate per-host diffs
# ---------------------------------------------------------------------------
DIFF_REPORT=""
HAS_CHANGES=false
CHANGED_HOSTS=""
UNCHANGED_HOSTS=""

for host in $HOSTS; do
  step "Building updated $host"
  nix build ".#nixosConfigurations.$host.config.system.build.toplevel" \
    -o "result-after-$host" || true
  endstep

  if [ -e "result-before-$host" ] && [ -e "result-after-$host" ]; then
    step "Package diff for $host"
    HOST_DIFF=$(nix run nixpkgs#nvd -- diff "result-before-$host" "result-after-$host" 2>&1 || true)
    echo "$HOST_DIFF" >&2
    endstep

    if [ "$(readlink "result-before-$host")" != "$(readlink "result-after-$host")" ]; then
      HAS_CHANGES=true
      CHANGED_HOSTS="$CHANGED_HOSTS $host"
      DIFF_REPORT="${DIFF_REPORT}### ${host}"$'\n'"\`\`\`"$'\n'"${HOST_DIFF}"$'\n'"\`\`\`"$'\n\n'
    else
      UNCHANGED_HOSTS="$UNCHANGED_HOSTS $host"
    fi
  fi
done

# ---------------------------------------------------------------------------
# 6. Report results
# ---------------------------------------------------------------------------
step "Summary"
if [ -n "$CHANGED_HOSTS" ]; then
  ok "Changed:  $CHANGED_HOSTS"
fi
if [ -n "$UNCHANGED_HOSTS" ]; then
  log "Unchanged:$UNCHANGED_HOSTS"
fi

if [ "$HAS_CHANGES" = false ]; then
  fail "flake.lock changed but no host closures differ."
  endstep
  exit 3
fi

ok "Done — diff report ready."
endstep

# Print the diff report to stdout for consumers (CI, local review, etc.)
printf '%s' "$DIFF_REPORT"

name: Update Flake Inputs

on:
  schedule:
    - cron: "0 2 * * *" # Daily at 02:00 UTC — well before hosts auto-upgrade.
  workflow_dispatch: # Allow manual trigger from the Forgejo UI.

env:
  GIT_USER_NAME: ci # ⚠️ Replace with your CI bot name.
  GIT_USER_EMAIL: ci@example.com # ⚠️ Replace with your CI bot email.

jobs:
  update:
    name: Update flake.lock and diff all hosts
    runs-on: nixos-builder # A native NixOS runner — leverages the host Nix store.
    steps:
      - name: Checkout repository
        uses: https://data.forgejo.org/actions/checkout@v6

      # Write the deploy key so git can push branches and sign commits.
      - name: Configure SSH key for git push and commit signing
        run: |
          SSH_DIR="$RUNNER_TEMP/.ssh"
          mkdir -p "$SSH_DIR"
          echo "${{ secrets.GIT_PRIVATE_KEY }}" > "$SSH_DIR/forgejo_key"
          chmod 600 "$SSH_DIR/forgejo_key"
          SSH_BIN="$(command -v ssh)"
          export GIT_SSH_COMMAND="$SSH_BIN -i $SSH_DIR/forgejo_key -o StrictHostKeyChecking=no"
          echo "GIT_SSH_COMMAND=$GIT_SSH_COMMAND" >> "$FORGEJO_ENV"
          echo "SSH_KEY_PATH=$SSH_DIR/forgejo_key" >> "$FORGEJO_ENV"
          FORGEJO_DOMAIN="${FORGEJO_SERVER_URL#https://}"
          FORGEJO_DOMAIN="${FORGEJO_DOMAIN#http://}"
          echo "FORGEJO_DOMAIN=$FORGEJO_DOMAIN" >> "$FORGEJO_ENV"

      # Configure the CI bot identity and SSH commit signing.
      - name: Configure git identity, signing, and SSH remote
        run: |
          git config user.name "${{ env.GIT_USER_NAME }}"
          git config user.email "${{ env.GIT_USER_EMAIL }}"
          git config gpg.format ssh
          git config user.signingkey "$SSH_KEY_PATH"
          git config commit.gpgsign true
          git remote set-url origin git@${{ env.FORGEJO_DOMAIN }}:${{ forgejo.repository }}.git

      # Run the diff script. Exit codes 2 and 3 are expected
      # "no-op" conditions — only code 0 means a PR is needed.
      - name: Update flake inputs and diff all hosts
        id: diff
        run: |
          DIFF_REPORT=$(bash ./scripts/flake-update-diff.sh) && STATUS=0 || STATUS=$?

          case "$STATUS" in
            0)
              echo "has_changes=true" >> "$FORGEJO_OUTPUT"
              {
                echo "report<<DIFF_EOF"
                printf '%s\n' "$DIFF_REPORT"
                echo "DIFF_EOF"
              } >> "$FORGEJO_OUTPUT"
              ;;
            2) echo "No flake.lock changes, skipping PR." ;;
            3) echo "No host closure changes, skipping PR." ;;
            *) exit "$STATUS" ;;
          esac

      # Commit the updated flake.lock and open a PR with the diff report.
      - name: Create branch, commit, and open pull request
        if: steps.diff.outputs.has_changes == 'true'
        env:
          DIFF_REPORT: ${{ steps.diff.outputs.report }}
          FORGEJO_TOKEN: ${{ forgejo.token }}
        run: |
          DATE=$(date +%Y-%m-%d)
          BRANCH="auto/flake-update-$DATE"

          git push origin --delete "$BRANCH" || true
          git checkout -b "$BRANCH"
          git add flake.lock
          git commit -m "chore: update flake inputs $DATE"
          git push origin "$BRANCH"

          # jq --arg safely handles all escaping (backticks, newlines, quotes)
          PAYLOAD=$(nix run nixpkgs#jq -- -n \
            --arg title "chore: update flake inputs $DATE" \
            --arg head  "$BRANCH" \
            --arg base  "main" \
            --arg diff  "$DIFF_REPORT" \
            '{
              title: $title, head: $head, base: $base,
              body: "## Automated flake.lock update\n\nPackage changes per host (via nvd):\n\n\($diff)\n---\n*Auto-generated by the update workflow.*"
            }')

          nix run nixpkgs#curl -- -sf -X POST \
            -H "Authorization: token $FORGEJO_TOKEN" \
            -H "Content-Type: application/json" \
            "${{ forgejo.server_url }}/api/v1/repos/${{ forgejo.repository }}/pulls" \
            -d "$PAYLOAD"

      - name: Cleanup
        if: always()
        run: |
          rm -f "$SSH_KEY_PATH"
          rm -f result-before-* result-after-*

## Automated flake.lock update

Package changes per host (via nvd):

### webserver

  [nvd output showing package upgrades, additions, and removals]

### devbox

  [nvd output for this host]

# modules/auto-upgrade.nix
{
  config,
  lib,
  ...
}:
let
  hostname = config.networking.hostName;
in
{
  options.services.auto-upgrade.enable =
    lib.mkEnableOption "automatic daily flake-based NixOS upgrade";

  config = lib.mkIf config.services.auto-upgrade.enable {
    system.autoUpgrade = {
      enable = true;

      # Fetch the latest main branch from your Git server.
      # Each host selects its own nixosConfiguration by hostname.
      flake = "git+https://your-forgejo/nix/nixos.git#${hostname}";

      # Never update flake.lock on the host — CI handles that.
      flags = [
        "--no-update-lock-file"
      ];

      # Run daily at 05:00 (host-local time), one hour after CI.
      dates = "05:00";

      # Do not reboot automatically.
      # Most services restart on nixos-rebuild switch.
      allowReboot = false;

      # "switch" activates immediately.
      # Use "boot" to defer activation until next reboot.
      operation = "switch";
    };
  };
}

# flake.nix (simplified)
{
  outputs = { nixpkgs, ... }: {
    nixosConfigurations = {
      webserver = nixpkgs.lib.nixosSystem {
        modules = [
          ./modules/auto-upgrade.nix
          ./hosts/webserver
        ];
      };

      devbox = nixpkgs.lib.nixosSystem {
        modules = [
          ./modules/auto-upgrade.nix
          ./hosts/devbox
        ];
      };
    };
  };
}

# hosts/webserver/default.nix
{
  services.auto-upgrade.enable = true;
}

02:00 UTC  Forgejo Actions runs on CI builder
           ├─ scripts/flake-update-diff.sh
           │   ├─ Discover hosts, build before
           │   ├─ nix flake update
           │   ├─ Build after, nvd diff per host
           │   └─ Report (stdout → workflow)
           └─ Open PR with diff report

   You     Review PR, check package changes, merge to main

05:00      Each NixOS host (systemd timer)
           ├─ git fetch main (via flake URL)
           ├─ nix build own configuration
           └─ nixos-rebuild switch