npins-update-action

A composite Forgejo action that keeps npins pins up to date. It walks every pin in npins/sources.json, runs npins update <pin> on a fresh base branch, and opens one PR per outdated pin (with a compare URL when the pin's forge is known). Up-to-date pins are skipped; the job exits non-zero if any pin fails.

Usage

name: update-dependencies
on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 1 * *" # monthly
jobs:
  update-npins:
    runs-on: native-1g
    steps:
      - uses: actions/checkout@v4
      - uses: https://git.fediversity.eu/fediversity/npins-update-action@v1
        with:
          deploy-key: ${{ secrets.DEPLOY_KEY }}
          token: ${{ github.token }}
          bot-pat: ${{ secrets.BOT_PAT }}

The checkout step is required: the action operates on the checked-out repo's own npins/sources.json.

Inputs

Input	Required	Default	Description
deploy-key	yes		SSH deploy key with push access, used to push the per-pin update branches.
token	yes		Token used to list existing PRs (typically github.token).
bot-pat	no	""	Bot PAT used to create PRs so they trigger pull_request workflows.
base-branch	no	main	Branch to base updates on and target PRs against.
branch-prefix	no	automation/npins-update	Prefix for the per-pin update branches (<branch-prefix>/<pin>).

Required repo secrets

• DEPLOY_KEY — an SSH deploy key with push access, so the action can push update branches.
• BOT_PAT — optional bot personal access token. When set, PRs are created with it so they trigger pull_request workflows; otherwise token is used and PRs do not trigger those workflows.

Runner

Targets NixOS runners: the script prepends /run/current-system/sw/bin to PATH and invokes tooling via nix run nixpkgs#{jq,npins}. Run it on a lightweight runner such as native-1g.