| 1 | # This module fetches nixpkgs master and syncs the GitHub maintainer team. |
| 2 | { config, pkgs, ... }: |
| 3 | let |
| 4 | rfc39Secret = f: { |
| 5 | file = f; |
| 6 | owner = "rfc39"; |
| 7 | }; |
| 8 | in |
| 9 | { |
| 10 | age.secrets.rfc39-credentials = rfc39Secret ../build/secrets/rfc39-credentials.age; |
| 11 | age.secrets.rfc39-github = rfc39Secret ../build/secrets/rfc39-github.age; |
| 12 | age.secrets.rfc39-record-push = rfc39Secret ../build/secrets/rfc39-record-push.age; |
| 13 | |
| 14 | users.users.rfc39 = { |
| 15 | description = "RFC39 Maintainer Team Sync"; |
| 16 | home = "/var/lib/rfc39-sync"; |
| 17 | createHome = true; |
| 18 | isSystemUser = true; |
| 19 | group = "rfc39"; |
| 20 | }; |
| 21 | users.groups.rfc39 = { }; |
| 22 | |
| 23 | programs.ssh.knownHosts."github.com".publicKey = |
| 24 | "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"; |
| 25 | |
| 26 | systemd.services.rfc39-sync = { |
| 27 | description = "Sync the Maintainer Team "; |
| 28 | path = [ |
| 29 | config.nix.package |
| 30 | pkgs.git |
| 31 | pkgs.openssh |
| 32 | pkgs.rfc39 |
| 33 | ]; |
| 34 | startAt = "*:0/30"; |
| 35 | serviceConfig.User = "rfc39"; |
| 36 | serviceConfig.Group = "keys"; |
| 37 | serviceConfig.Type = "oneshot"; |
| 38 | serviceConfig.PrivateTmp = true; |
| 39 | script = '' |
| 40 | set -eux |
| 41 | |
| 42 | export GIT_SSH_COMMAND='ssh -i ${config.age.secrets.rfc39-record-push.path}' |
| 43 | export GIT_AUTHOR_NAME="rfc39" |
| 44 | export GIT_AUTHOR_EMAIL="rfc39@eris" |
| 45 | export GIT_COMMITTER_NAME="rfc39" |
| 46 | export GIT_COMMITTER_EMAIL="rfc39@eris" |
| 47 | |
| 48 | recordsdir=$HOME/rfc39-record |
| 49 | if ! [[ -e "$recordsdir" ]]; then |
| 50 | git clone git@github.com:NixOS/rfc39-record.git "$recordsdir" |
| 51 | fi |
| 52 | cd "$recordsdir" |
| 53 | git fetch origin --no-auto-maintenance |
| 54 | git checkout main |
| 55 | git reset --hard origin/main |
| 56 | git maintenance run --auto |
| 57 | |
| 58 | nixpkgsdir=$HOME/nixpkgs |
| 59 | if ! [[ -e $nixpkgsdir ]]; then |
| 60 | git clone https://github.com/NixOS/nixpkgs.git $nixpkgsdir |
| 61 | fi |
| 62 | cd $nixpkgsdir |
| 63 | git fetch origin --no-auto-maintenance |
| 64 | git checkout origin/master |
| 65 | git maintenance run --auto |
| 66 | |
| 67 | rfc39 \ |
| 68 | --dump-metrics --metrics-delay=240 --metrics-addr=0.0.0.0:9190 \ |
| 69 | --credentials ${config.age.secrets.rfc39-credentials.path} \ |
| 70 | --maintainers ./maintainers/maintainer-list.nix \ |
| 71 | sync-team NixOS 3345117 --limit 50 \ |
| 72 | --invited-list "$recordsdir/invitations" |
| 73 | |
| 74 | cd "$recordsdir" |
| 75 | |
| 76 | if ! git diff --quiet; then |
| 77 | git add . |
| 78 | git commit -m "Automated team sync results." |
| 79 | git push origin main |
| 80 | fi |
| 81 | ''; |
| 82 | }; |
| 83 | |
| 84 | } |