name: Bump Flake Inputs

on:
  workflow_dispatch:
  schedule:
    - cron: "3 0 * * *" # run daily at 00:03 UTC

permissions: {}

jobs:
  update-lockfile:
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Lix
        uses: ./.github/actions/install-lix

      - name: Update Lockfile
        id: pr
        uses: DeterminateSystems/update-flake-lock@c5930b397a673a70ca70be06020e943aeac310a1 # v27
        with:
          token: ${{ secrets.GH_TOKEN_UPDATES }}
          git-author-name: bell's bot
          git-author-email: bot@isabelroses.com
          git-committer-name: bell's bot
          git-committer-email: bot@isabelroses.com
          commit-msg: "flake.lock: update all inputs"
          pr-title: "flake.lock: update all inputs"
          branch: update-flake-inputs
          pr-body: |
            ```
            {{ env.GIT_COMMIT_MESSAGE }}
            ```

      - name: Merge Pull Request
        run: gh pr merge --rebase --auto --delete-branch "$PR"
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN_UPDATES }}
          PR: ${{ steps.pr.outputs.pull-request-url }}