fix(nix): use shared nix-update-hash workflow

[drewr]

Update: Use the shared action instead.

---

Recent repository rule changes require all changes to main to go through pull requests. There is no secure way to bypass this for the github-actions[bot] — repository rules don't have a bypass mechanism like branch protection rules do.

This reverts the approach from #193 (commit 4acc066) which switched the workflow to direct push, and restores the original PR-based flow using peter-evans/create-pull-request@v7.

Why this matters: The nix-update-hash workflow has been failing on every run since the repository rules were enforced, because git push to main is rejected. Renovate PRs that update go.mod/go.sum are not getting their vendorHash updated automatically.

[scotwells]

Should the workflow be pushing to the feature branch where the go mod file is being changed?

We should also consider moving this to the actions repo so we can reuse it across repos.

[drewr]

Updated this branch to delegate to a new shared action in datum-cloud/actions#75 rather than inlining the workflow steps.

A few things changed along the way:

Target branch was not hard-coded — peter-evans/create-pull-request was already using the repo default branch implicitly (no base param). No change needed there.

Fixed: hash PR now targets the triggering branch, not main — the original approach (and the earlier commit in this PR) would have opened the flake.nix fix PR against main, separate from the Renovate PR that changed go.mod/go.sum. The shared action sets base: ${{ github.ref_name }} so the hash update targets the branch that triggered the workflow, keeping the dep update and hash fix together in one review.

Prerequisite for the shared action — the calling repo must have a Taskfile.yml with a nix-update-hash task and the script it invokes (scripts/update-nix-hash.go here). This is documented in the actions repo.

This PR should merge after datum-cloud/actions#75 since it references @main.

[scotwells]

Why not push to the feature branch instead? We use use version references when referencing shared actions

[drewr]

It should be pushing to wherever the changed go.mod is happening. What are you seeing?

[scotwells]

It's creating a PR like you mentioned in your comment above and the description on the actions repo PR. I would expect it to push a new commit to the branch of the existing PR instead of opening a new PR.

      - name: Create Pull Request
        if: steps.git-check.outputs.changed == 'true'
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: ${{ inputs.commit-message }}
          branch: ${{ inputs.pr-branch }}
          branch-suffix: timestamp
          base: ${{ github.ref_name }}
          title: ${{ inputs.pr-title }}
          body: ${{ inputs.pr-body }}

[drewr]

If it's not part of a branch, then it should be a PR. But hmm, that might be too confusing. I was trying to avoid the race condition of pushing to main after merge.

[scotwells]

I wouldn't push to main, it should push to the feature branch of the PR.

[drewr]

The current logic will create the PR every time, using whatever base makes sense given the changed go.mod. That seemed like a good compromise, though admittedly it's cumbersome to order the merges.

[drewr]

Yes, if it's already on a feature branch I'd prefer it just push there. Let me see if we can do both.

[scotwells]

Probably makes sense to enable the setting on the repo to be up to date with its base branch before it's allowed to be merged. That way you can always make sure the nix hash is updated based on the latest changes in main + the changes in the feature branch.

[drewr]

That's a good idea. Can I enforce that in the action?

[scotwells]

That should just be a standard git operation to confirm the current branch isn't behind main at all. The other approach is part of the repo rulesets to prevent a PR being merged until status checks pass and the feature branch is up-to-date with the latest in the base branch.

[drewr]

Won't let me do it.

[drewr]

Got this to take

[drewr]

Rebased out testing the hash update.