initial commit

.github/workflows/diff-pr.yml

@@ -0,0 +1,45 @@
+name: diff-pr
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: diff-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  dix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: worktree base for diff
+        run: git worktree add "$RUNNER_TEMP/base" "${{ github.event.pull_request.base.sha }}"
+
+      - name: build closures and render diff
+        run: |
+          nix run .#ci -- diff "$RUNNER_TEMP/base" . \
+            "### System closure diff vs \`${{ github.event.pull_request.base.ref }}\`" \
+            > "$RUNNER_TEMP/comment.md"
+          nix run .#ci -- inspect-diff "$RUNNER_TEMP/base" . \
+            "### Inspection diff vs \`${{ github.event.pull_request.base.ref }}\`" \
+            >> "$RUNNER_TEMP/comment.md"
+
+      - name: post/update PR comment
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.api_url }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+        run: nix run .#ci -- post-comment "<!-- dix-diff -->" "$RUNNER_TEMP/comment.md"

.github/workflows/diff-tag.yml

@@ -0,0 +1,37 @@
+name: diff-tag
+
+on:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  dix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: diff latest tag against HEAD
+        run: |
+          tag=$(git tag --sort=-creatordate | head -n1)
+          if [ -z "$tag" ]; then
+            echo "No tags yet, skipping diff." | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          git worktree add "$RUNNER_TEMP/old" "$tag"
+          head=$(git rev-parse --short HEAD)
+          {
+            nix run .#ci -- diff "$RUNNER_TEMP/old" . \
+              "# System closure diff: \`$tag\` -> \`$head\`"
+            nix run .#ci -- inspect-diff "$RUNNER_TEMP/old" . \
+              "# Inspection diff: \`$tag\` -> \`$head\`"
+          } | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/flake-check.yml

@@ -0,0 +1,26 @@
+name: flake-check
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: flake-check-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  flake-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - run: nix flake check -L

.github/workflows/flake-update.yml

@@ -0,0 +1,33 @@
+name: flake-update
+
+on:
+  schedule:
+    - cron: "17 4 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - run: nix flake update
+
+      - name: open/update PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.api_url }}
+          REPO: ${{ github.repository }}
+        run: |
+          printf 'Automated `nix flake update`.\n' > "$RUNNER_TEMP/body.md"
+          nix run .#ci -- open-pr \
+            flake-update "$GITHUB_REF_NAME" "flake.lock: update inputs" "$RUNNER_TEMP/body.md" automated

.github/workflows/lint.yml

@@ -0,0 +1,41 @@
+name: lint
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: lint-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: pick reporter
+        run: |
+          if [ "${{ github.event_name }}" = pull_request ]; then
+            echo "REPORTER=github-pr-review" >> "$GITHUB_ENV"
+          else
+            echo "REPORTER=local" >> "$GITHUB_ENV"
+          fi
+
+      - name: run linters
+        run: nix run .#ci -- lint . "$RUNNER_TEMP/findings"
+
+      - name: report findings
+        env:
+          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: nix run .#ci -- lint-report "$REPORTER" "$RUNNER_TEMP/findings"

.github/workflows/vulnix.yml

@@ -0,0 +1,41 @@
+name: vulnix
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: scan host closures
+        id: scan
+        run: echo "count=$(nix run .#ci -- vulnix . "$RUNNER_TEMP/issue.md")" >> "$GITHUB_OUTPUT"
+
+      - name: file/update issue
+        if: steps.scan.outputs.count != '0'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.api_url }}
+          REPO: ${{ github.repository }}
+        run: nix run .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"
+
+      - name: close resolved issue
+        if: steps.scan.outputs.count == '0'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.api_url }}
+          REPO: ${{ github.repository }}
+        run: nix run .#ci -- close-issue vulnix