automatically update vendor hashes for dependabot updates (direnv#1145)

.github/workflows/update-vendor-hash.yml

@@ -0,0 +1,30 @@
+name: Update vendorHash
+on: pull_request
+
+permissions:
+  contents: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Install Nix
+        uses: cachix/install-nix-action@v22
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Update checksum
+        run: |
+          ./scripts/update-vendor-hash
+          # git push if we have a diff
+          if [[ -n $(git diff) ]]; then
+            git add default.nix
+            git config --global user.email "<49699333+dependabot[bot]@users.noreply.github.com>"
+            git config --global user.name "dependabot[bot]"
+            git commit -m "update vendorHash"
+            git push origin HEAD:${{ github.head_ref }}
+          fi

default.nix

@@ -1,4 +1,4 @@
-{ pkgs ? import ./nix { } }:
+{ pkgs ? import ./nix { }, vendorHash ? "sha256-eQaQ77pOYC8q+IA26ArEhHQ0DCU093TbzaYhdV3UydE=" }:
 let
   inherit (pkgs)
     bash
@@ -12,7 +12,7 @@ buildGoModule rec {
   version = lib.fileContents ./version.txt;
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-eQaQ77pOYC8q+IA26ArEhHQ0DCU093TbzaYhdV3UydE=";
+  inherit vendorHash;
 
   src = builtins.fetchGit ./.;
 

script/update-vendor-hash

@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix -p coreutils -p gnused -p gawk
+
+set -exuo pipefail
+
+failedbuild=$(nix build --impure --expr '(with import <nixpkgs> {}; pkgs.callPackage ./. { vendorHash = ""; })' 2>&1 || true)
+echo "$failedbuild"
+checksum=$(echo "$failedbuild" | awk '/got:.*sha256/ { print $2 }')
+sed -i -e "s|vendorHash ? \".*\"|vendorHash ? \"$checksum\"|" default.nix