name: Nix Update Hash

on:
  push:
    branches: [main]
    paths:
      - "nix/**"
      - "flake.nix"
      - "flake.lock"
      - "package.json"
      - "package-lock.json"
      - "packages/highlight/**"
      - "packages/server/**"
      - "packages/relay/**"
      - "packages/cli/**"
      - "scripts/update-nix.sh"
      - "scripts/fix-lockfile.mjs"
      - ".github/workflows/nix-update-hash.yml"

permissions:
  contents: read

jobs:
  update-hash:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.PASEO_BOT_APP_ID }}
          private-key: ${{ secrets.PASEO_BOT_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}
          token: ${{ steps.app-token.outputs.token }}

      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "npm"

      - uses: cachix/install-nix-action@v31
        with:
          nix_path: nixpkgs=channel:nixos-unstable

      - name: Update lockfile + Nix hash if stale
        run: ./scripts/update-nix.sh

      - name: Build Nix package
        run: nix build .#default -o result

      - name: Commit hash/lockfile updates
        run: |
          git diff --quiet package-lock.json nix/npm-deps.hash && exit 0
          git config user.name "paseo-ai[bot]"
          git config user.email "266920839+paseo-ai[bot]@users.noreply.github.com"
          git add package-lock.json nix/npm-deps.hash
          git commit -m "fix: update lockfile signatures and Nix hash [skip ci]"
          git push