npins-update-action

A composite Forgejo action that keeps npins pins up to date. It walks every pin in npins/sources.json, runs npins update <pin> on a fresh base branch, and opens one PR per outdated pin (with a compare URL when the pin's forge is known). Up-to-date pins are skipped; the job exits non-zero if any pin fails.

Usage

On git.fediversity.eu, a same-instance uses: reference to a sibling repo's action fails to clone: the runner attaches a caller-repo-scoped job token that cannot read another repo, so the action checkout gets a cross-repo 401 (forgejo#3571). Until that is fixed, clone this (public) repo anonymously in a plain step and run its script directly:

name: update-dependencies
on:
  workflow_dispatch: # allows manual triggering
  schedule:
    - cron: "0 0 1 * *" # monthly
jobs:
  update-npins:
    runs-on: native
    steps:
      - uses: actions/checkout@v4
      - name: Run npins-update-action
        shell: bash
        run: |
          action_dir="$(mktemp -d)"
          git clone --depth 1 \
            https://git.fediversity.eu/fediversity/npins-update-action "$action_dir"
          "$action_dir/update-npins.sh"
        env:
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
          TOKEN: ${{ github.token }}
          BOT_PAT: ${{ secrets.BOT_PAT }}
          BASE_BRANCH: main
          BRANCH_PREFIX: automation/npins-update
          FORGEJO_URL: ${{ github.server_url }}
          REPO: ${{ github.repository }}

The clone step runs update-npins.sh against the caller's checked-out repo, so it operates on that repo's own npins/sources.json. The env: names are what the script reads directly (the composite action.yml's hyphenated inputs: map to the same names, and are used once the uses: path works).

If you consume it from a different Forgejo/GitHub instance where a sibling uses: clone works, you can instead reference the action:

      - uses: https://git.fediversity.eu/fediversity/npins-update-action@v1
        with:
          deploy-key: ${{ secrets.DEPLOY_KEY }}
          token: ${{ github.token }}
          bot-pat: ${{ secrets.BOT_PAT }}

Inputs

Input	Env (clone form)	Required	Default	Description
deploy-key	DEPLOY_KEY	yes		SSH deploy key with push access, used to push the per-pin update branches.
token	TOKEN	yes		Token used to list existing PRs (typically github.token).
bot-pat	BOT_PAT	no	""	Bot PAT used to create PRs so they trigger pull_request workflows.
base-branch	BASE_BRANCH	no	main	Branch to base updates on and target PRs against.
branch-prefix	BRANCH_PREFIX	no	automation/npins-update	Prefix for the per-pin update branches (<branch-prefix>/<pin>).

Required repo secrets

• DEPLOY_KEY — an SSH private key whose public half is registered as a write-enabled Deploy Key on the consuming repo, so the action can push update branches. See Setting up DEPLOY_KEY below.
• BOT_PAT — bot personal access token (org-level on fediversity, so member repos inherit it). When set, PRs are created with it so they trigger pull_request workflows; otherwise token is used and PRs do not trigger those workflows.

Setting up DEPLOY_KEY

Unlike BOT_PAT, a deploy key is scoped to a single repo, so each consuming repo needs its own:

1. Generate a keypair (see ssh-keygen):

   ssh-keygen -t ed25519 -N "" -f npins-deploy -C "npins-update@<repo>"
   

2. Register the public key (npins-deploy.pub) under the repo's Settings -> Deploy Keys -> Add Deploy Key, and enable write access (a read-only deploy key cannot push the update branches).

3. Store the private key (npins-deploy, including the -----BEGIN/END----- lines) as an Actions secret named DEPLOY_KEY under Settings -> Actions -> Secrets. Then delete the local key files.

Runner

Targets NixOS runners: the script prepends /run/current-system/sw/bin to PATH and invokes tooling via nix run nixpkgs#{jq,npins}. It is lightweight, so route it to a small tier — e.g. runs-on: native. Match the label to whatever the target instance's runners advertise (Fediversity splits execution class from the ram-<N>g RAM tier, so a bare native suffices here).